An inter-agency business risk prevention and control method, device and electronic equipment

Abstract

The application discloses a cross-institutional business risk prevention and control method and device and electronic equipment, and relates to the technical field of finance, and comprises the following steps: when real-time risk assessment is abnormal, determining the risk assessment result of the current business based on batch business data when real-time risk assessment is performed on real-time business data by a stream processing engine; determining risk information according to the risk assessment result and the real-time business data, performing hierarchical encryption processing on the risk information to generate a risk message; and sending the risk message to a target institution, so that the target institution cooperatively performs risk interception on the current business. Preferentially, real-time business data is used for risk assessment, thereby ensuring the timeliness of risk assessment; when real-time assessment has a problem, a backup assessment mechanism of batch business data is seamlessly degraded, thereby ensuring the high availability and business continuity of cross-institutional risk control; and hierarchical encryption processing is used when risk information is transmitted, thereby ensuring the security of data transmission.

Description

Technical Field

[0001] This invention relates to the field of financial technology, and in particular to a cross-institutional business risk control method, apparatus, and electronic device. Background Technology

[0002] Currently, risk control in the financial sector often involves cross-institutional data transmission in order to achieve business risk control through the collaborative efforts of multiple institutions.

[0003] Existing technologies have significant shortcomings in both data security and system reliability when sharing data across different structures for risk control. Currently, financial institutions generally use a Hadoop+Hive batch processing architecture, which suffers from poor timeliness. During data transmission, they rely on Secure Sockets Layer (SSL) channels or static key encryption, which can lead to plaintext data being written to disk in middleware. The system architecture often adopts a master-slave cold standby mode, which results in long failover times and is prone to data loss or service interruption when anomalies occur, making it difficult to simultaneously meet the needs of regulatory compliance and high-concurrency real-time business. Summary of the Invention

[0004] This invention provides a cross-organizational business risk prevention and control method, apparatus and electronic device to achieve reliable risk prevention and control while ensuring data transmission security.

[0005] According to a first aspect of the present invention, a cross-organizational business risk prevention and control method is provided, the method comprising: acquiring real-time business data and batch business data of the current business, wherein the batch business data includes historical correlation data of the real-time business data; When performing real-time risk assessment on the real-time business data through the streaming processing engine, if an anomaly occurs in the real-time risk assessment, the risk assessment result of the current business is determined based on the batch business data. Risk information is determined based on the risk assessment results and the real-time business data. The risk information is then subjected to layered encryption processing to generate a risk message, wherein the risk message contains encrypted data, a key envelope, and a signature. The risk message is sent to the target organization so that the target organization can intercept risks related to the current business collaboration.

[0006] According to another aspect of the present invention, a cross-organizational business risk control device is provided, the device comprising: The business data acquisition module is used to acquire real-time business data and batch business data of the current business, wherein the batch business data includes historical related data of the real-time business data; The risk assessment result acquisition module is used to determine the risk assessment result of the current business based on the batch business data when an anomaly occurs in the real-time risk assessment of the real-time business data through the streaming processing engine. The risk message generation module is used to determine risk information based on the risk assessment results and the real-time business data, and to generate a risk message by performing layered encryption processing on the risk information. The risk message contains encrypted data, a key envelope, and a signature. The risk interception module is used to send the risk message to the target organization so that the target organization can intercept the risk of the current business collaboration.

[0007] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising: one or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any embodiment of the present invention.

[0008] According to another aspect of the present invention, a storage medium for computer-executable instructions is provided, on which a computer program is stored, which, when executed by a processor, implements the method as described in any of the embodiments of the present invention.

[0009] The technical solution of this invention prioritizes the use of real-time business data for risk assessment, thereby ensuring the timeliness of risk assessment; when problems occur in real-time assessment, a backup assessment mechanism for batch business data is seamlessly triggered, thereby ensuring the high availability and business continuity of cross-organizational risk control; and layered encryption is used when transmitting risk information to ensure the security of data transmission.

[0010] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a flowchart of a cross-organizational business risk prevention and control method provided in Embodiment 1 of the present invention; Figure 2This is a flowchart of another cross-organizational business risk prevention and control method provided by Embodiment 2 of the present invention; Figure 3 This is a schematic diagram of the structure of a cross-organizational business risk control device according to Embodiment 3 of the present invention; Figure 4 This is a structural block diagram of an electronic device provided in Embodiment 4 of the present invention. Detailed Implementation

[0013] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0014] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, apparatus, product, or terminal device that includes a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or terminal devices.

[0015] Example 1 Figure 1 This is a flowchart of a cross-organizational business risk prevention and control method provided in Embodiment 1 of the present invention. This embodiment is applicable to situations involving business risk prevention and control. The method can be executed by a cross-organizational business risk prevention and control device, which can be implemented in hardware and / or software, and can be integrated into an electronic device with data processing capabilities. Figure 1 As shown, the method includes: S101: Obtain real-time business data and batch business data for the current business.

[0016] Optionally, real-time business data and batch business data of the current business can be obtained, including: receiving real-time business data pushed by the internal system for the current business in real time through a specified message middleware; and receiving batch business data related to the current business pushed by the external system through a specified file transfer protocol.

[0017] Specifically, the financial institution's core business system will push the generated transaction data to the system in real time through a designated message middleware to ensure that the data can be transmitted instantly and uninterruptedly. For example, when a user opens an account or makes a large transfer, the core business system will send the real-time account opening event into the stream processing channel in JSON format and transmit it to the current institution through the stream processing channel. At the same time, for batch business data transmitted from external systems through the batch processing channel, the system will receive it using a designated file transfer protocol, and the batch business data will include historical related data of the real-time business data. Of course, this embodiment is only an example and does not limit the specific methods of obtaining real-time business data and batch business data.

[0018] S102, when performing real-time risk assessment on real-time business data through the streaming processing engine, determines the risk assessment result of the current business based on batch business data when an anomaly occurs in the real-time risk assessment.

[0019] Optionally, when performing real-time risk assessment on real-time business data through a streaming processing engine, if an anomaly occurs in the real-time risk assessment, the risk assessment result of the current business can be determined based on batch business data. This includes: performing real-time risk assessment on real-time business data through a streaming processing engine and monitoring the duration of the real-time risk assessment; determining whether the streaming processing engine has completed the assessment within a specified duration; if so, determining that the real-time risk assessment is normal and directly obtaining the risk assessment result of the current business generated by the real-time risk assessment; otherwise, determining that the real-time risk assessment is abnormal, obtaining the batch risk assessment result obtained by the batch processing engine based on the batch business data, and determining the risk assessment result of the current business from the batch risk assessment result.

[0020] Optionally, real-time risk assessment of real-time business data can be performed using a streaming processing engine, including: The streaming engine extracts customer IDs and key operational information from real-time business data. In the customer dimension table, a hierarchical index is used to perform correlation queries on customer IDs to obtain key customer information. The key operational information and key customer information are input into a pre-trained risk scoring model to obtain the risk assessment results of the current business. The risk assessment results generated by the streaming engine are written to the first information table in the data storage layer.

[0021] Specifically, this implementation constructs a hybrid computing architecture that integrates real-time stream processing and batch processing. A stream processing engine performs risk assessment on real-time business data, while a batch processing engine performs risk assessment on batch business data. These two paths can serve as backups for each other in case of data anomalies. For real-time business data, the stream processing engine standardizes and cleans the received data, identifying customer IDs and key operational information. Then, based on the customer ID, a query is performed in the customer dimension table. Due to the massive volume of customer data, the customer dimension table employs a B+ tree index, a highly efficient data structure, ensuring millisecond-level response even with billions of data points. Furthermore, key customer information for the current business is obtained through correlation analysis, and this key customer information is information that the system can apply and analyze with user authorization. In this embodiment, the extracted key operational information and the key customer information obtained through correlation analysis are combined and input into a pre-trained risk scoring model. The risk scoring model in this embodiment includes both a traditional rule engine and machine learning algorithms. For example, an alarm is triggered if a single transfer exceeds 50,000. In addition, it can identify more hidden risk patterns. This embodiment does not limit the specific calculation principle of the risk scoring model. After comprehensive analysis, the system will output risk assessment results in real time, such as risk scores. When the risk score is high, it indicates that there is a significant security risk in the current business. The risk assessment results are then written to the first information table in the data storage layer, such as the Merge-On-Read table.

[0022] Optionally, obtaining the batch risk assessment results obtained by the batch processing engine based on batch business data includes: obtaining batch risk assessment results by performing risk assessment on batch business data through the batch processing engine while the streaming processing engine performs real-time risk assessment; and writing the batch risk assessment results into the second information table of the data storage layer, wherein the batch risk assessment results include the risk assessment results of the current business.

[0023] In this embodiment, the system prioritizes using a streaming processing engine for rapid real-time risk assessment when processing each transaction. However, it also monitors the duration of the streaming engine's real-time risk assessment. If a result is calculated within the specified time, it is used directly. If the specified time exceeds the limit, it indicates that the system may have encountered a sudden data surge causing overload, insufficient resources, or processing delays. In this case, the real-time risk assessment is deemed abnormal, and a backup plan is immediately activated. To avoid blocking or affecting normal user transactions, the system immediately degrades and extracts the corresponding risk assessment result from the batch processing engine's pre-calculated results. This implementation achieves a "real-time calculation first, batch results as a backup" switching logic through the backup plan, balancing the timeliness and stability of risk control. Even if the real-time calculation engine experiences a temporary performance bottleneck due to sudden traffic surges, the system can seamlessly switch to batch results, thus preventing a large number of normal transactions from being incorrectly intercepted or timed out due to system lag.

[0024] It should be noted that, in this implementation, while performing real-time risk assessment, the system's backend utilizes a batch processing engine to perform risk assessments on batch business data, obtaining batch risk assessment results. These results are then uniformly written to a second information table in the data storage layer, such as a copy-on-write table. Therefore, under normal circumstances, the streaming engine performs real-time calculations, which is fast and provides results directly. In abnormal situations, the system immediately retrieves the pre-calculated results from the second information table. This design of parallel streaming and batch processing combined with separate result storage ensures that even if the real-time system crashes, the system has readily available and accurate batch results that can seamlessly take over, guaranteeing the absolute continuity of financial operations. Furthermore, the first information table, Merge-On-Read, is characterized by its extremely fast write speed. Data is rapidly written to disk as incremental logs upon arrival, making it ideal for real-time scenarios like financial operations that require high-frequency, high-speed writes. The second information table, Copy-On-Write, directly overwrites old data during writes. While this increases write costs slightly, it ensures absolute physical cleanliness and consistency, making it ideal for handling large-scale historical data corrections or completions. To ensure that the data seen during business queries is complete and consistent, an underlying automatic compression mechanism merges the two tables. This design satisfies the rapid response requirements of financial risk control while strictly adhering to the bottom line of data consistency.

[0025] S103 determines risk information based on risk assessment results and real-time business data, and generates risk messages by performing layered encryption processing on the risk information.

[0026] Optionally, the risk information is subjected to layered encryption processing to generate a risk message, including: encrypting the risk information using a randomly generated SM4 symmetric encryption key to obtain encrypted data; obtaining the target organization's pre-configured SM2 public key, and using the SM2 public key to perform asymmetric encryption on the SM4 symmetric encryption key to generate a key envelope; generating an initial message based on the encrypted data and the key envelope, generating a digest for the initial message using the SM3 algorithm, and using the current organization's SM2 private key to encrypt and sign the digest to generate a digital signature; and adding the digital signature to the initial message for encapsulation to generate the risk message.

[0027] Specifically, in this implementation, after obtaining the risk assessment result (e.g., high risk, risk coefficient of 8) and key operational information from real-time business data (e.g., transfer amount, receiving account, and transaction time), the risk assessment result and key operational information are combined to generate the final risk information to be transmitted externally. The current structure performs layered encryption processing on the combined risk information to ultimately package it into a highly secure risk message.

[0028] In this implementation, the layered encryption process mainly involves three layers of protection: The first layer (field-level encryption) involves dynamically generating a unique SM4 symmetric encryption key for each transmission batch to encrypt the data. This means that even if a hacker intercepts the data, they cannot decrypt all batches of information using the same key. The second layer (key encapsulation) uses the SM2 asymmetric encryption algorithm to prevent the SM4 key from being stolen during transmission. Specifically, the SM4 key is locked with the target organization's pre-configured SM2 public key, forming a key envelope. Only the recipient with the corresponding private key can open the envelope to obtain the SM4 key, decrypt the data, and generate the initial message based on the encrypted data and the key envelope. The third layer (message-level signature) prevents the initial message from being maliciously modified during transmission. The system uses the SM3 hash algorithm to generate a unique digest for the entire message and uses the current organization's SM2 private key to encrypt and sign the digest, generating a digital signature. Upon receiving the data, the target organization can verify its integrity and authenticity. Therefore, in this embodiment, the national cryptographic algorithm of "SM4 encrypted data + SM2 encryption key + SM3 anti-tamper signature" is adopted in the data transmission stage, realizing three-dimensional protection from a single sensitive field to the entire message, and completely eliminating the risk of data leakage and tampering during cross-organizational transmission.

[0029] S104 sends a risk message to the target organization so that the target organization can intercept risks related to the current business collaboration.

[0030] Specifically, this real-time method employs intelligent transmission protocols and national cryptographic channels to send generated risk messages to target institutions, such as regulatory platforms, clearing centers, or telecommunications operators. This allows both parties to collaborate and jointly intercept risky transactions. Because the messages are layered and encrypted, the target institution can securely and compliantly decrypt them upon receipt to obtain detailed risk intelligence about the transaction. Therefore, the current institution's system not only calculates the risk but also securely transmits the risk intelligence to downstream or partner institutions, triggering a cross-institutional collaborative defense mechanism to ultimately prevent potential fraud or money laundering transactions from occurring.

[0031] Optionally, a risk message may be sent to the target organization to enable the target organization to intercept risks related to the current business collaboration. This may include: receiving a Level 1 business termination instruction triggered by a risk warning sent by the target organization and intercepting risks in the current business according to the Level 1 business termination instruction; or, directly receiving a Level 2 business termination instruction from the target organization and forcibly intercepting risks in the current business according to the Level 2 business termination instruction, wherein the Level 2 business termination instruction is of a higher level than the Level 1 business termination instruction.

[0032] Specifically, this implementation can determine different interception methods based on the type of the target institution. For example, when the target institution is determined to be an institution of the same level as the current institution, such as a telecommunications operator, the target institution can send a risk warning to the current user after receiving the risk message, for example, by notifying them via SMS that the transaction has a security risk. If the user sees the warning, they will actively click "Cancel Transaction" or "Confirm Risk and Terminate" on the human-computer interaction interface corresponding to the current institution, triggering the generation of a Level 1 business termination instruction. The current institution will then intercept the current transaction based on this instruction. When the target institution is determined to be a regulatory platform or other institution of a higher level than the current institution, the target institution, upon receiving the risk message and determining that the current transaction has a risk, will directly generate a Level 2 business termination instruction and send it to the current institution. The current institution will then forcibly intercept the current transaction based on the Level 2 business termination instruction, such as directly freezing the account or refusing the transfer. This is a rigid risk control measure, entirely controlled by the system or risk control personnel, leaving no room for user intervention. Since the Level 2 business termination instruction is of a higher level than the Level 1 business termination instruction, if the current institution receives both instructions simultaneously, or in conflict, the system will unconditionally prioritize the Level 2 forced interception. Therefore, it can be seen that the cross-institutional collaborative interception in this implementation is divided into two modes: "user cancels after being prompted (Level 1)" and "institution directly forces blocking (Level 2)". This hierarchical design not only ensures that the user's operating experience is respected in low-risk scenarios, but also ensures that the current institution has the right to veto when facing extremely high risks, thus achieving mandatory security backup.

[0033] The technical solution of this invention prioritizes the use of real-time business data for risk assessment, thereby ensuring the timeliness of risk assessment; when problems occur in real-time assessment, a backup assessment mechanism for batch business data is seamlessly triggered, thereby ensuring the high availability and business continuity of cross-organizational risk control; and layered encryption is used when transmitting risk information to ensure the security of data transmission.

[0034] Example 2 Figure 2 This is a flowchart of another cross-organizational business risk prevention and control method provided by an embodiment of the present invention. Based on the above embodiment, after sending the risk message to the target organization, it further includes obtaining the risk interception result for the current business and generating a risk interception log based on the risk interception result, such as... Figure 2 As shown, the method includes: S201, obtain real-time business data and batch business data for the current business.

[0035] Optionally, real-time business data and batch business data of the current business can be obtained, including: receiving real-time business data pushed by the internal system for the current business in real time through a specified message middleware; and receiving batch business data related to the current business pushed by the external system through a specified file transfer protocol.

[0036] S202, when performing real-time risk assessment on real-time business data through the streaming processing engine, determines the risk assessment result of the current business based on batch business data when an anomaly occurs in the real-time risk assessment.

[0037] Optionally, when performing real-time risk assessment on real-time business data through a streaming processing engine, if an anomaly occurs in the real-time risk assessment, the risk assessment result of the current business can be determined based on batch business data. This includes: performing real-time risk assessment on real-time business data through a streaming processing engine and monitoring the duration of the real-time risk assessment; determining whether the streaming processing engine has completed the assessment within a specified duration; if so, determining that the real-time risk assessment is normal and directly obtaining the risk assessment result of the current business generated by the real-time risk assessment; otherwise, determining that the real-time risk assessment is abnormal, obtaining the batch risk assessment result obtained by the batch processing engine based on the batch business data, and determining the risk assessment result of the current business from the batch risk assessment result.

[0038] Optionally, real-time risk assessment of real-time business data can be performed using a streaming processing engine, including: The streaming engine extracts customer IDs and key operational information from real-time business data. In the customer dimension table, a hierarchical index is used to perform correlation queries on customer IDs to obtain key customer information. The key operational information and key customer information are input into a pre-trained risk scoring model to obtain the risk assessment results of the current business. The risk assessment results generated by the streaming engine are written to the first information table in the data storage layer.

[0039] Optionally, obtaining the batch risk assessment results obtained by the batch processing engine based on batch business data includes: obtaining batch risk assessment results by performing risk assessment on batch business data through the batch processing engine while the streaming processing engine performs real-time risk assessment; and writing the batch risk assessment results into the second information table of the data storage layer, wherein the batch risk assessment results include the risk assessment results of the current business.

[0040] S203 determines risk information based on risk assessment results and real-time business data, and generates risk messages by performing layered encryption processing on the risk information.

[0041] Optionally, the risk information is subjected to layered encryption processing to generate a risk message, including: encrypting the risk information using a randomly generated SM4 symmetric encryption key to obtain encrypted data; obtaining the target organization's pre-configured SM2 public key, and using the SM2 public key to perform asymmetric encryption on the SM4 symmetric encryption key to generate a key envelope; generating an initial message based on the encrypted data and the key envelope, generating a digest for the initial message using the SM3 algorithm, and using the current organization's SM2 private key to encrypt and sign the digest to generate a digital signature; and adding the digital signature to the initial message for encapsulation to generate the risk message.

[0042] S204 sends a risk message to the target organization so that the target organization can intercept risks related to the current business collaboration.

[0043] Optionally, a risk message may be sent to the target organization to enable the target organization to intercept risks related to the current business collaboration. This may include: receiving a Level 1 business termination instruction triggered by a risk warning sent by the target organization and intercepting risks in the current business according to the Level 1 business termination instruction; or, directly receiving a Level 2 business termination instruction from the target organization and forcibly intercepting risks in the current business according to the Level 2 business termination instruction, wherein the Level 2 business termination instruction is of a higher level than the Level 1 business termination instruction.

[0044] S205: Obtain the risk interception results for the current business and generate risk interception logs based on the risk interception results.

[0045] Specifically, in this implementation, after executing a risk interception action, the system collects the final status of the interception and generates a detailed interception log. For example, the system tracks and obtains the final risk interception result of the current transaction. This result typically includes status information such as whether the interception was successful, what level of interception instruction was triggered (level one or level two), and the specific reason for the interception, in order to generate a risk interception log. This risk interception log is like a surveillance video of the system, recording in detail the entire process of this high-risk transaction from identification to interception.

[0046] In addition to intercepting risks, the risk control system must also generate logs. Generating risk interception logs has extremely high business value in the financial system, primarily for: compliance auditing, meeting the traceability requirements of financial regulatory agencies for risk control operations; post-event review, in case of customer complaints (such as a normal transaction being mistakenly intercepted), the logs can be used to reconstruct the risk control decision-making process at the time; and model optimization, providing historical data support for subsequent risk control model iterations.

[0047] The technical solution of this invention prioritizes the use of real-time business data for risk assessment, thereby ensuring the timeliness of risk assessment; when problems occur in real-time assessment, a backup assessment mechanism for batch business data is seamlessly triggered, thereby ensuring the high availability and business continuity of cross-organizational risk control; and layered encryption is used when transmitting risk information to ensure the security of data transmission.

[0048] Example 3 Figure 3 This is a schematic diagram of a cross-organizational business risk control device provided in an embodiment of the present invention. Figure 3 As shown, the device includes: a business data acquisition module 310, a risk assessment result acquisition module 320, a risk message generation module 330, and a risk interception module 340.

[0049] The business data acquisition module 310 is used to acquire real-time business data and batch business data of the current business, wherein the batch business data includes historical related data of the real-time business data. The risk assessment result acquisition module 320 is used to determine the risk assessment result of the current business based on batch business data when an anomaly occurs in the real-time risk assessment of real-time business data through the streaming processing engine. The risk message generation module 330 is used to determine risk information based on risk assessment results and real-time business data, and to generate risk messages by performing layered encryption processing on the risk information. The risk message contains encrypted data, a key envelope, and a signature. The risk interception module 340 is used to send risk messages to the target organization so that the target organization can intercept risks related to the current business collaboration.

[0050] Optionally, the business data acquisition module 310 is used to receive real-time business data pushed by the internal system for the current business through a specified message middleware. Receive batch business data related to the current business from external systems via a specified file transfer protocol.

[0051] Optionally, the risk assessment result acquisition module 320 is used to perform real-time risk assessment on real-time business data through a streaming processing engine and to monitor the duration of the real-time risk assessment. Determine whether the streaming engine has completed its assessment within a specified time period. If so, the real-time risk assessment is deemed normal, and the risk assessment result for the current business generated by the real-time risk assessment is directly obtained. Otherwise, if an anomaly is detected in the real-time risk assessment, the batch risk assessment results obtained by the batch processing engine based on the batch business data are retrieved, and the risk assessment results of the current business are determined from the batch risk assessment results.

[0052] Optionally, the risk assessment result acquisition module 320 includes a real-time risk assessment unit, which is used to extract customer ID and key operation information from real-time business data through a streaming processing engine. In the customer dimension table, a hierarchical index is used to perform a related query on the customer ID to obtain key customer information. Input key operational and customer information into a pre-trained risk scoring model to obtain risk assessment results for the current business. The risk assessment results generated by the streaming engine are written to the first information table in the data storage layer.

[0053] Optionally, the risk assessment result acquisition module 320 includes a batch risk assessment unit, which is used to perform risk assessment on batch business data through the batch processing engine to obtain batch risk assessment results while the streaming processing engine performs real-time risk assessment. The batch risk assessment results are written to the second information table in the data storage layer, where the batch risk assessment results include the risk assessment results of the current business.

[0054] Optionally, the risk message generation module 330 is used to encrypt the risk information using a randomly generated SM4 symmetric encryption key to obtain encrypted data; Obtain the target organization's pre-configured SM2 public key, and use the SM2 public key to perform asymmetric encryption on the SM4 symmetric encryption key to generate a key envelope; An initial message is generated based on the encrypted data and key envelope. A digest of the initial message is generated using the SM3 algorithm. The digest is then encrypted and signed using the organization's SM2 private key to generate a digital signature. Add a digital signature to the initial message and encapsulate it to generate a risk message.

[0055] Optionally, a risk interception module is used to receive a Level 1 business termination instruction triggered by a risk warning sent by a user based on a target institution, and to intercept the current business based on the Level 1 business termination instruction. Alternatively, it can directly receive a Level 2 business termination instruction from the target institution and forcibly intercept the current business based on the Level 2 business termination instruction. The Level 2 business termination instruction is of a higher level than the Level 1 business termination instruction.

[0056] The cross-organizational business risk prevention and control device provided in this embodiment of the invention can execute the cross-organizational business risk prevention and control method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method.

[0057] Example 4 Figure 4 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0058] The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the invention described and / or claimed herein.

[0059] like Figure 4 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0060] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other electronic devices through computer networks such as the Internet and / or various telecommunications networks.

[0061] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, central processing unit (CPU), graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as cross-organizational business risk control methods.

[0062] That is, to obtain real-time business data and batch business data for the current business, wherein the batch business data includes historical related data of the real-time business data; When performing real-time risk assessment on real-time business data through a streaming processing engine, the risk assessment result of the current business is determined based on batch business data when an anomaly occurs in the real-time risk assessment. Risk information is determined based on risk assessment results and real-time business data. The risk information is then subjected to layered encryption to generate risk messages, which contain encrypted data, key envelopes, and signatures. The risk message is sent to the target organization so that the target organization can intercept risks related to the current business collaboration.

[0063] In some embodiments, the cross-agency business risk control method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the cross-agency business risk control method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the cross-agency business risk control method by any other suitable means (e.g., by means of firmware).

[0064] Various embodiments of the apparatuses and techniques described above herein can be implemented in digital electronic circuit devices, integrated circuit devices, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), device-on-a-chip (SoC) devices, complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable device including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage device, at least one input device, and at least one output device, and transmitting data and instructions to the storage device, the at least one input device, and the at least one output device.

[0065] Computer programs used to implement the cross-agency business risk control method of this invention can be written in any combination of one or more programming languages. These computer programs can be provided to the processor of a general-purpose computer or a special-purpose computer, such that when executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer programs can be executed entirely on the machine, partially on the machine, or as a standalone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0066] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution apparatus, device, or electronic device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage electronics, magnetic storage electronics, or any suitable combination thereof.

[0067] To provide interaction with a user, the devices and techniques described herein can be implemented on an electronic device having: a display device (e.g., a touchscreen) for displaying information to the user; and buttons through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0068] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0069] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A cross-organizational business risk prevention and control method, characterized in that, The method includes: Obtain real-time business data and batch business data for the current business, wherein the batch business data includes historical associated data of the real-time business data; When performing real-time risk assessment on the real-time business data through the streaming processing engine, if an anomaly occurs in the real-time risk assessment, the risk assessment result of the current business is determined based on the batch business data. Risk information is determined based on the risk assessment results and the real-time business data. The risk information is then subjected to layered encryption processing to generate a risk message, wherein the risk message contains encrypted data, a key envelope, and a signature. The risk message is sent to the target organization so that the target organization can intercept risks related to the current business collaboration.

2. The method according to claim 1, characterized in that, The acquisition of real-time business data and batch business data for the current business includes: The system receives real-time business data pushed by the internal system for the current business through a designated message middleware. Receive the batch business data related to the current business pushed by the external system through a specified file transfer protocol.

3. The method according to claim 1, characterized in that, When performing real-time risk assessment on the real-time business data through a streaming processing engine, if an anomaly occurs in the real-time risk assessment, the risk assessment result for the current business is determined based on the batch business data, including: The streaming processing engine performs real-time risk assessment on the real-time business data and monitors the duration of the real-time risk assessment. Determine whether the streaming engine has completed its evaluation within a specified time period. If so, determine that the real-time risk assessment is normal, and directly obtain the risk assessment result for the current business generated by the real-time risk assessment. Otherwise, if an anomaly is detected in the real-time risk assessment, the batch risk assessment result obtained by the batch processing engine based on the batch business data is acquired, and the risk assessment result of the current business is determined from the batch risk assessment result.

4. The method according to claim 3, characterized in that, The real-time risk assessment of the real-time business data through the streaming processing engine includes: The streaming processing engine extracts customer IDs and key operation information from the real-time business data. In the customer dimension table, a hierarchical index is used to perform a related query on the customer IDs to obtain key customer information. The key operational information and the key customer information are input into a pre-trained risk scoring model to obtain the risk assessment results for the current business. The risk assessment results generated by the streaming engine are written into the first information table of the data storage layer.

5. The method according to claim 3, characterized in that, The batch risk assessment results obtained by the batch processing engine based on the batch business data include: While the streaming processing engine performs real-time risk assessment, the batch processing engine performs risk assessment on the batch business data to obtain the batch risk assessment results. The batch risk assessment results are written to the second information table of the data storage layer, wherein the batch risk assessment results include the risk assessment results of the current business.

6. The method according to claim 3, characterized in that, The step of generating a risk message by performing layered encryption processing on the risk information includes: The risk information is encrypted using a randomly generated SM4 symmetric encryption key to obtain encrypted data; Obtain the pre-configured SM2 public key of the target organization, and use the SM2 public key to perform asymmetric encryption on the SM4 symmetric encryption key to generate a key envelope; An initial message is generated based on the encrypted data and the key envelope. A digest of the initial message is generated using the SM3 algorithm. The digest is then encrypted and signed using the organization's SM2 private key to generate a digital signature. The digital signature is added to the initial message and then encapsulated to generate the risk message.

7. The method according to claim 1, characterized in that, Sending the risk message to the target organization so that the target organization can intercept risks related to the current business collaboration includes: Receive a Level 1 service termination instruction triggered by a risk warning sent by a user based on the target institution, and perform risk interception on the current service according to the Level 1 service termination instruction; Alternatively, the system may directly receive a Level 2 business termination instruction from the target organization and forcibly intercept the current business based on the Level 2 business termination instruction, wherein the Level 2 business termination instruction is of a higher level than the Level 1 business termination instruction.

8. A cross-organizational business risk control device, characterized in that, The device includes: The business data acquisition module is used to acquire real-time business data and batch business data of the current business, wherein the batch business data includes historical related data of the real-time business data; The risk assessment result acquisition module is used to determine the risk assessment result of the current business based on the batch business data when an anomaly occurs in the real-time risk assessment of the real-time business data through the streaming processing engine. The risk message generation module is used to determine risk information based on the risk assessment results and the real-time business data, and to generate a risk message by performing layered encryption processing on the risk information. The risk message contains encrypted data, a key envelope, and a signature. The risk interception module is used to send the risk message to the target organization so that the target organization can intercept the risk of the current business collaboration.

9. An electronic device, characterized in that, The electronic device includes: One or more processors; Storage device for storing one or more programs. When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1-7.

10. A storage medium for computer-executable instructions, wherein a computer program is stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1-7.

Images