Multi-Layered Security Framework for Online Banking Systems Using Java and MySQL

International Research Journal of Engineering and Technology (IRJET)

e-ISSN: 2395-0056

Volume: 13 Issue: 03 | Mar 2026

p-ISSN: 2395-0072

www.irjet.net

Multi-Layered Security Framework for Online Banking Systems Using Java and MySQL IMRAN RIYAZ AHMAD D B1, B SHYAMALA DEVI 2 1 PG Student, Department of Computer Applications, Jaya College of Arts and Science, Chennai 2Assistant Professor & Head, Department of Computer Applications, Jaya College of Arts and Science,Chennai

---------------------------------------------------------------------***--------------------------------------------------------------------2. Literature Review digital transformation of banking

Abstract: The

necessitates robust applications resilient to escalating cyber threats. This paper details the engineering of a fortified online banking platform leveraging the Java EE ecosystem, JDBC for database connectivity, and MySQL for data persistence. The system's core innovation is its multi-layered security model, which integrates defense mechanisms at every application tier, including an Adaptive Risk-Based Authentication (RBA) framework. Critical implemented features include adaptive bcrypt hashing for credential storage, AES-256 encryption for sensitive data at rest, and mandatory parameterized queries through JDBC to nullify SQL injection. Role-based access control and mandatory session validation enforce strict authorization policies. The results confirm that the proposed architecture effectively upholds the principles of data confidentiality, integrity, and availability, providing a scalable and secure framework for remote financial operations, mitigating risks like phishing, data breaches, and injection attacks.

Previous studies in secure financial systems consistently emphasize several critical pillars. A common theme is the indispensability of strong encryption and multi-factor authentication as primary defenses. Java is frequently lauded for its built-in security manager and sandboxed execution environment, making it a stalwart choice for enterprise backend development. JDBC is recognized as the standard conduit for secure database operations in Java, while MySQL's adherence to ACID properties ensures transactional reliability for financial records. Despite these established practices, a recurring shortfall in many existing systems is the ad-hoc implementation of security, lacking a centralized, enforceable strategy and consistent secure-coding standards.

Furthermore, many systems employ static authentication, which provides a poor user experience or insufficient security for high-risk scenarios. This work aims to bridge this gap by proposing a cohesive security architecture that is integral to the system's design rather than a supplementary feature, incorporating an adaptive authentication model.

Keywords: Secure Banking Architecture, Java Security Framework, JDBC Transaction Integrity, MySQL Data Encryption, Multi-layer Cyber Defense, Financial Application Development.

3. Proposed Adaptive RBA Framework Architecture This is the core innovation of the platform. The architecture can be visualized as a pipeline integrated within the broader system architecture, designed to dynamically assess risk and challenge users appropriately.

1. INTRODUCTION The proliferation of digital finance has made web-based banking a global standard, introducing significant challenges in safeguarding user assets and data from sophisticated cyber-attacks. Threats such as phishing, SQL injection, and session hijacking continuously evolve, demanding a proactive and layered security approach. This research addresses this imperative by constructing a secure banking environment founded on the core tenets of information security: confidentiality, integrity, authentication, and nonrepudiation. The technological triad of Java, JDBC, and MySQL provides a powerful foundation for this endeavor, offering platform-agnostic development, secure database communication, and transactional reliability. This study explores the end-to-end implementation of this system, from its architectural blueprint to its functional modules and the integrated security protocols that fortify it, with a specific focus on an innovative Adaptive RBA framework.

© 2026, IRJET

|

Impact Factor value: 8.315

[User Action] -> [Risk Analysis Engine] -> [Policy Decision Point] -> [Security Enforcement]

3.1. Risk Analysis Engine This component collects and analyzes contextual data to generate a real-time risk score.

Input Modules:

|



Transaction Context: Amount, beneficiary (new vs. frequent), transaction type.



User Context: IP Address & Geo-Location (compared to usual), time of day (unusual?).



Device & Session Context: Device fingerprint, session age, login history.

ISO 9001:2008 Certified Journal

|

Page 427



International Research Journal of Engineering and Technology (IRJET)

e-ISSN: 2395-0056

Volume: 13 Issue: 03 | Mar 2026

p-ISSN: 2395-0072

www.irjet.net

Scoring Model: A weighted scoring algorithm (e.g., based on a simple rule set or a lightweight machine learning model like Random Forest).

Example: Risk_Score = (Amount_Weight * Amount_Score) + (Location_Weight * Location_Score) + ...

3.2. Policy Decision Point This module defines thresholds and corresponding actions based on the computed risk score. 

Low Risk (Score: 0-30): Allow transaction immediately.



Medium Risk (Score: 31-70): Require Soft OTP (Email).



High Risk (Score: 71-100): Require Hard OTP (SMS) or Block and flag for review.

3.3. Security Enforcement This component executes the decision by invoking the appropriate authentication module (e.g., OTP service, biometric check) before the transaction is finalized.

4. System Architecture The system is structured on a proven three-tier model to ensure separation of concerns and enhanced security management. The Adaptive RBA framework is embedded within the Application Layer.

Presentation Layer: Comprises dynamic JSP pages with HTML/CSS/JavaScript, responsible for the user interface and client-side input validation.

Figure 1: Three-Tier Architecture with Integrated RBA

Application Layer: The core business logic is handled

by Java Servlets, which act as controllers. This layer manages user authentication, transaction processing, and orchestrates all interactions with the database. It hosts the Adaptive RBA Engine and other dedicated security modules: an Authentication Manager for credential verification, a Transaction Validator for business rule compliance, an Encryption Engine for data protection, and an Audit Logger.

5. System Modules User Authentication Module: Manages secure access through username/password, with passwords hashed using bcrypt. Incorporates CAPTCHA to deter automated attacks and manages user sessions with strict timeouts. This module interacts with the RBA framework for step-up authentication.

Account Management Module: Allows customers to view account balances, update personal contact information, and review system-generated notifications.

Database Layer: MySQL server stores all persistent data, including user credentials, account details, transaction ledgers, and audit trails.

Funds Transfer Module: Handles all transaction types internal transfers, bill payments, and deposits/withdrawals.

This module is directly integrated with the RBA framework; every transaction request is first evaluated for risk before processing.

Administrative Module: Provides bank staff with tools to manage user accounts, monitor system logs for suspicious

© 2026, IRJET

|

Impact Factor value: 8.315

|

ISO 9001:2008 Certified Journal

|

Page 428

International Research Journal of Engineering and Technology (IRJET)

e-ISSN: 2395-0056

Volume: 13 Issue: 03 | Mar 2026

p-ISSN: 2395-0072

www.irjet.net

patterns, approve or block transactions flagged by the RBA, and generate financial reports.

as logging balance updates. The InnoDB storage engine is utilized to guarantee ACID-compliant transaction processing.

Security Core Module: A centralized component enforcing input sanitization, coordinating the use of JDBC Prepared Statements, managing encryption routines, and maintaining comprehensive system logs. The RBA framework is a key component of this module.

8. Implementation with Java & JDBC The implementation uses a stack of Java Servlets, JSP, and the JDBC API, deployed on an Apache Tomcat server. The JDBC driver facilitates all database interactions. A key practice is the use of Pre-pared Statement for every database query involving user input, completely neutralizing SQL injection threats. Financial operations are wrapped in database transactions, managed via connection. Set Auto Commit (false), commit(), and rollback(), to ensure all steps in a transaction complete successfully or none do, preserving data consistency. The RBA engine is implemented as a central Java service class invoked by Servlets before authorizing sensitive actions.

6. Security Mechanisms Implemented Data Protection: A strategic distinction is made between hashing and encryption. Passwords are irreversibly hashed with bcrypt. Highly sensitive data like account numbers are encrypted using AES-256. All client-server communication is secured with TLS. Injection Attack Mitigation: SQL Injection is systematically prevented by exclusively using JDBC Prepared Statements, ensuring user input is treated as data, not executable code.

9. Results and Evaluation The system underwent rigorous testing. Security penetration tests using tools like OWASP ZAP confirmed its resilience, successfully blocking all common SQL injection and crosssite scripting (XSS) attack vectors. The RBA framework was validated to correctly trigger step-up authentication challenges for simulated high-risk scenarios (e.g., large transfers to new beneficiaries from unfamiliar locations).

Performance benchmarks under simulated user loads showed sub-second response times for standard operations, with the deliberate computational cost of bcrypt hashing and RBA analysis adding a minimal and justifiable overhead. The transaction management system flawlessly maintained data atomicity and consistency, even during simulated system failures mid-transaction.

Access Control: A Role-Based Access Control (RBAC) model is enforced, granting permissions based on user roles (e.g., 'Customer', 'Admin'). The RBA framework provides a dynamic, context-aware layer over this static RBAC. Session Integrity: User sessions are tracked with unique, random tokens. Sessions are configured to expire after a period of inactivity, and cookies are flagged as HttpOnly and Secure to thwart client-side script access and ensure encrypted transmission.

Auditing and Monitoring: All significant events— logins, transactions, RBA decisions, profile changes—are recorded in an immutable audit log. This allows for monitoring, forensic analysis, and regulatory compliance.

9. Conclusion This project has successfully demonstrated the engineering of a secure, scalable, and efficient online banking platform by leveraging the robustness of the Java EE ecosystem, the reliability of JDBC, and the transactional integrity of MySQL. The proposed multi-layered security architecture provides a formidable defense-in-depth strategy against prevalent web application vulnerabilities. A key innovation of this work is the integration of an Adaptive Risk-Based Authentication (RBA) framework, which moves beyond static security models by dynamically assessing risk and applying contextaware authentication challenges. The results from rigorous penetration testing and performance benchmarking confirm that the system effectively upholds the core principles of data confidentiality, integrity, and availability. By systematically implementing security controls such as bcrypt hashing, AES-256 encryption, JDBC prepared statements, and robust session management, the platform mitigates critical risks like injection attacks, credential theft, and session hijacking, thereby providing a trustworthy framework for remote financial operations.

7. Database Design (MySQL) The schema is normalized for integrity and performance.

Core entities include: 

users (user_id, name, email, pass word_ hash, role, is_active)



accounts (account_id, user_id, account_number_encrypted, balance, created_on)



transactions (transaction_id, from_account, to_account, amount, type, timestamp, status)



audit_logs (log_id, user_id, action, risk_score, ip_address, timestamp)

Database-level integrity is maintained using foreign key constraints. Triggers are employed for automated tasks, such

© 2026, IRJET

|

Impact Factor value: 8.315

|

ISO 9001:2008 Certified Journal

|

Page 429

International Research Journal of Engineering and Technology (IRJET)

e-ISSN: 2395-0056

Volume: 13 Issue: 03 | Mar 2026

p-ISSN: 2395-0072

www.irjet.net

10. Future Work

[3] Oracle Corporation. (2023). MySQL 8.0 Reference Manual.

Oracle Corporation.

Retrieved from https://dev.mysql.com/doc/refman/8.0/en/

While the current system establishes a strong security foundation, several avenues exist for further enhancement and research: 1.

[4] Stallings, W. (2017). Cryptography and Network Security: Principles and Practice (7th ed.). Pearson Education.

Advanced Fraud Detection with Machine Learning: The current rule-based Risk Analysis Engine could be replaced or augmented with a machine learning model (e.g., an Anomaly Detection algorithm or a Deep Learning network). Such a model could be trained on historical transaction data to identify complex, non-linear fraud patterns that are difficult to capture with static rules, thereby improving the accuracy and predictive power of the RBA framework.

2.

Integration of Biometric Authentication: To further strengthen the authentication chain and improve user convenience, future iterations could integrate biometric methods. The "Security Enforcement" module could be expanded to support fingerprint scanners, facial recognition, or voice authentication as a factor for step-up authentication, particularly for high-value transactions.

3.

Blockchain for Immutable Transaction Ledgers: Exploring the use of a private or permissioned blockchain to record transaction settlements could provide an additional layer of security and transparency. Once a transaction is confirmed in the core banking system, a hash of it could be written to a blockchain, creating an immutable and independently verifiable audit trail.

4.

Real-Time Behavioral Analytics: Enhancing the RBA's context collection to include real-time behavioral biometrics, such as keystroke dynamics and mouse movement patterns, could provide a continuous and transparent authentication mechanism, further securing sessions against hijacking.

5.

API Security for Open Banking: As the industry moves towards open banking, future work could focus on developing and securing RESTful APIs using standards like OAuth 2.0 and OpenID Connect, allowing secure third-party integration while maintaining strict control over data access.

[5] Viega, J., & McGraw, G. (2001). Building Secure Software: How to Avoid Security Problems the Right Way. AddisonWesley Professional.

[6] Tanenbaum, A. S., & Van Steen, M. (2017). Distributed Systems: Principles and Paradigms (3rd ed.). Pearson Education.

[7] Halfond, W. G., Viegas, J., & Orso, A. (2006). A Classification of SQL Injection Attacks and Countermeasures. Proceedings of the IEEE International Symposium on Secure Software Engineering, 1-10.

References [1] Oracle Corporation. (2023). Java Platform, Enterprise Edition (Java EE) Specification, Version 8. Oracle Press.

[2] OWASP Foundation. (2021). OWASP Top Ten Web Application Security Risks.

OWASP. Retrieved from https://owasp.org/www-project-top-ten/

© 2026, IRJET

|

Impact Factor value: 8.315

|

ISO 9001:2008 Certified Journal

|

Page 430