Power system data privacy compliance examination method and system

Abstract

The invention relates to a power system data privacy compliance examination method and system. The method comprises the steps of obtaining power data, and dynamically generating privacy metadata corresponding to the power data based on a large language model; monitoring data flow of the power data, applicable privacy regulations and processing modes to update the privacy metadata; dynamically generating a privacy protection decision by utilizing a self-adaptive privacy protection strategy engine according to the privacy metadata; and tracking the state of the whole life cycle of the power data, and generating a compliance audit report. According to the method, dynamic and automatic review of power system data privacy compliance is realized by introducing the large language model and utilizing semantic understanding and reasoning capabilities of the large language model on privacy regulations, and the privacy protection decision is dynamically generated by utilizing the self-adaptive privacy protection strategy engine, so that personalized protection of power data is realized. And finally, by tracking the state of the whole life cycle of the power data, ensuring that compliance inspection covers the whole life cycle of the data.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a method and system for power system data privacy compliance review. Background Art

[0002] With the deepening of global digital transformation, the power system has gradually developed into a highly intelligent, data-driven system, generating and processing a large amount of user data, equipment data and grid operation data. These data play a key role in improving the operating efficiency of the power system and optimizing user services. However, with the widespread use of data, data privacy and compliance issues have also become the focus of global attention. In the existing power system, a large amount of user personal information and sensitive data are involved in the process of data collection, storage, processing and transmission, especially data monitoring of smart meters, user electricity consumption behavior analysis and equipment operation data. These data are not only highly sensitive, but also directly related to user privacy and grid security. Therefore, ensuring the privacy compliance of power system data has become a priority issue that power companies must solve in data operations.

[0003] Currently, the solutions for privacy protection and compliance review of power systems are mainly based on manually written rules and preset compliance standards for data processing. Although the above manual solutions can help power companies identify and respond to privacy risks to a certain extent, there are the following problems:

[0004] 1. Difficulty in understanding and adapting to complex regulations: Privacy protection regulations vary greatly in different regions around the world, and the regulations are complex. Power companies need to invest a lot of human resources to analyze and review them one by one. This manual method is inefficient, prone to interpretation bias, and unable to dynamically adapt to changes in regulations.

[0005] 2. Diversity of data usage scenarios leads to limited applicability of rules: There are many data usage scenarios in the power system, including real-time data processing, predictive analysis, and historical data storage. Traditional privacy protection strategies based on preset rules cannot flexibly adapt to these scenarios, often leading to compliance loopholes or over-protection, which in turn affects business efficiency.

[0006] 3. Lack of automation and dynamism: Most existing privacy protection solutions rely on manual review and cannot respond to privacy risks in data flow in real time. As the amount of data in the power system increases, traditional solutions are difficult to keep up with the needs of large-scale data processing and difficult to provide efficient and automated compliance review.

[0007] Therefore, in response to existing problems in the field of power system data privacy compliance review, there is an urgent need for an innovative system that can dynamically parse global privacy regulations, adapt to different power data usage scenarios in real time, and provide automated and personalized privacy protection solutions to address the limitations of existing technologies. Summary of the invention

[0008] Based on this, it is necessary to provide an efficient, dynamic and intelligent power system data privacy compliance review method and system to address the above technical issues.

[0009] In a first aspect, the present application provides a method for reviewing data privacy compliance in a power system. The method comprises:

[0010] Obtain power data and dynamically generate privacy metadata corresponding to the power data based on the large language model;

[0011] Monitor the data flow, applicable privacy regulations and processing methods of power data to update privacy metadata;

[0012] Based on privacy metadata, an adaptive privacy protection strategy engine is used to dynamically generate privacy protection decisions;

[0013] Track the status of power data throughout its lifecycle and generate compliance audit reports.

[0014] In one embodiment, obtaining power data and dynamically generating privacy metadata corresponding to the power data based on a large language model includes:

[0015] Based on the large language model, the power data is correlated and compared with privacy regulations to assess the sensitivity level of the power data;

[0016] Determine several business scenarios corresponding to power data; each business scenario has a dynamic mapping relationship with privacy regulations;

[0017] Generate privacy labels for power data based on sensitivity levels, business scenarios, and privacy regulations corresponding to business scenarios;

[0018] Generate privacy metadata based on privacy labels.

[0019] In one embodiment, the privacy metadata is stored in a distributed storage manner;

[0020] Create an index for the stored privacy metadata and establish a query port based on the index;

[0021] Set up access control mechanisms for the query port.

[0022] In one embodiment, dynamically generating a privacy protection decision using an adaptive privacy protection strategy engine based on privacy metadata includes:

[0023] Based on the business scenarios of power data and the privacy regulations matching the privacy metadata, we use the adaptive privacy protection policy engine and the reasoning ability of the large language model to determine whether the current business scenario requires privacy protection.

[0024] When it is determined that the current business scenario requires privacy protection, the policy rule library containing different types of privacy protection technologies and corresponding applicable conditions is called to match the corresponding privacy protection technology and generate a privacy protection decision.

[0025] In one embodiment, the policy rule library introduces a large language model for automatic updating based on privacy regulations, application scenarios, and user feedback.

[0026] In one embodiment, the execution effect of the privacy protection decision is monitored and evaluated in real time; the evaluation criteria of the execution effect include protection strength, system performance consumption, and regulatory compliance;

[0027] Automatically adjust privacy protection decisions based on the evaluation results of the execution effect.

[0028] In a second aspect, the present application also provides a power system data privacy compliance review system. The system includes:

[0029] A privacy metadata generation module is used to obtain power data and dynamically generate privacy metadata corresponding to the power data based on a large language model;

[0030] A dynamic update module for monitoring the data flow of power data, applicable privacy regulations and processing methods to update privacy metadata;

[0031] The privacy compliance policy generation module is used to dynamically generate privacy protection decisions based on privacy metadata using an adaptive privacy protection policy engine;

[0032] The full-link tracking and auditing module is used to track the status of power data throughout its life cycle and generate compliance audit reports.

[0033] In a third aspect, the present application further provides a computer device, which includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps in the above-mentioned power system data privacy compliance review method when executing the computer program.

[0034] In a fourth aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, which implements the steps in the above-mentioned power system data privacy compliance review method when executed by a processor.

[0035] In a fifth aspect, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned power system data privacy compliance review method are implemented.

[0036] The above-mentioned power system data privacy compliance review method and system obtain power data, dynamically generate privacy metadata corresponding to the power data based on the large language model; monitor the data flow, applicable privacy regulations and processing methods of power data to update the privacy metadata; based on the privacy metadata, use the adaptive privacy protection strategy engine to dynamically generate privacy protection decisions; track the status of the power data throughout its life cycle and generate a compliance audit report. By introducing a large language model and using its semantic understanding and reasoning capabilities of privacy regulations, dynamic and automated review of power system data privacy compliance is achieved, and an adaptive privacy protection strategy engine is used to dynamically generate privacy protection decisions to achieve personalized protection of power data. Finally, by tracking the status of the power data throughout its life cycle, ensure that the compliance review covers the entire life cycle of the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] Figure 1 A flowchart of a method for reviewing data privacy compliance in a power system according to an embodiment of the present invention is provided;

[0038] Figure 2 A schematic diagram of a process for generating and dynamically updating privacy metadata in one embodiment;

[0039] Figure 3 is a flowchart of an adaptive privacy protection strategy engine in one embodiment;

[0040] Figure 4 A schematic diagram of a process for generating a privacy protection decision in one embodiment;

[0041] Figure 5 It is a flowchart of full-link tracking and auditing in one embodiment;

[0042] Figure 6 A structural block diagram of a power system data privacy compliance review system in one embodiment. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0044] The present invention aims to solve several key technical problems existing in the current power system data privacy compliance review, mainly including automated processing of privacy compliance, dynamic data protection, personalized compliance strategy generation, and privacy compliance tracking and auditing throughout the life cycle.

[0045] 1. Automation and dynamism of privacy compliance: Existing privacy compliance review methods rely on manual rule setting and manual review, which cannot cope with the complex and changing requirements of regulations and lack the ability to dynamically adjust for different scenarios. This invention hopes to introduce a large language model and use its semantic understanding and reasoning ability of privacy regulations to achieve automated review of power system data privacy compliance and adapt to different business scenarios and data flow dynamics.

[0046] 2. Personalized privacy compliance strategy generation: Existing compliance reviews often use generalized rules and lack personalized protection measures for different power systems and user data scenarios. This invention uses a large language model combined with specific data flows and business needs in the power system to dynamically generate personalized privacy compliance strategies, ensuring that protection measures meet regulatory requirements without affecting business efficiency.

[0047] 3. Full life cycle privacy compliance tracking: Every link of power system data from collection to storage, processing, transmission and use may face privacy risks. Existing technologies cannot achieve full process tracking and real-time compliance review. The present invention solves this problem by generating dynamic privacy metadata for each piece of data, monitoring and recording the processing status of the data in real time, and ensuring that compliance review covers the entire life cycle of the data.

[0048] By solving the above problems, the present invention can provide an efficient, dynamic and intelligent power system data privacy compliance review solution.

[0049] This application embodiment provides a power system data privacy compliance review method, such as Figure 1 As shown, the following steps are included:

[0050] Step 102: Obtain power data, and dynamically generate privacy metadata corresponding to the power data based on the large language model.

[0051] This step collects and analyzes the data flows generated in the power system in real time, and provides basic support for subsequent privacy protection and compliance reviews by intelligently assessing the sensitivity and privacy risks of the data flows.

[0052] The specific method of data collection is as follows: design standardized interfaces for different data sources of the power system, and collect real-time data streams through API or data bus. Each interface must support high-concurrency data input to ensure that the operation of the power system is not affected.

[0053] In addition, the data needs to be monitored during the data collection process, and distributed stream processing frameworks such as Apache Kafka and Apache Flink are used for real-time data processing and monitoring. These frameworks can ensure low latency of data during transmission and provide a reliable message delivery mechanism. The data stream of the power system will be packaged as event data and transmitted to the monitoring system in real time. The monitoring system establishes a real-time monitoring mechanism to continuously track the amount of information and changes in the data stream. The mechanism should realize real-time streaming processing of data, including the capture of newly generated data, error handling and logging.

[0054] By accessing the core data stream of the power system, different types of data in the system can be captured and monitored in real time, including user power consumption information, equipment status data, network transmission data, etc. The system needs to be able to ensure stable data collection and real-time monitoring of data streams under high data throughput.

[0055] In other embodiments, after the power data is collected and analyzed in real time by the data flow monitoring module, the collected power data is preprocessed, including formatting, cleaning and de-redundancy processing. Then, the content and source of the data are structured and extracted using a data parsing algorithm, and the extracted features are used for subsequent sensitivity analysis.

[0056] Next, a large language model is used to perform privacy sensitivity analysis on the processed power data to generate corresponding privacy metadata.

[0057] Step 104 , monitor the data flow, applicable privacy regulations and processing methods of the power data to update the privacy metadata.

[0058] By generating, updating and maintaining privacy metadata for each piece of electricity data, it is ensured that electricity data always carries privacy compliance information at every stage of its life cycle.

[0059] The core of this step is to track key information such as the source of data, privacy sensitivity, and processing requirements through privacy metadata, to ensure that metadata can be automatically updated during the data life cycle, and to ensure that the processing of power data always complies with the latest privacy regulations and usage requirements.

[0060] Specifically, whether to trigger the automatic update of privacy metadata mainly considers two aspects: the first is the usage scenario of power data, and the second is the matching privacy regulations. For the usage scenario of power data, the system continuously monitors the usage of data in the store, including its transmission path, usage target, and processing method. Through this monitoring, the system can perceive whether the usage scenario of power data has changed, such as power data flowing from the analysis module to the storage module or transmitted to a third-party service provider. The monitoring module triggers the corresponding update logic to ensure that the processing requirements in the metadata always match the current scenario. For privacy regulations, when the processing scenario of power data changes, the system calls the large language model to re-analyze whether the data complies with the latest privacy regulations. For example, when data is transferred from internal use to sharing with third-party services, the system re-analyzes its matching privacy regulations, applies corresponding privacy protection measures, and records the change in the privacy metadata.

[0061] In addition, the system presets a set of automatic update rules to automatically update metadata when the following situations are detected:

[0062] Data flow: when data is transferred to a new module or a new business scenario;

[0063] Changes in privacy regulations: When updates to privacy regulations or compliance requirements are detected, the system automatically applies new rules to privacy metadata;

[0064] Change in processing requirements: When the system or user actively changes the way data is processed (such as enabling encryption or anonymization), update the corresponding metadata fields.

[0065] Step 106: Dynamically generate a privacy protection decision using an adaptive privacy protection strategy engine based on the privacy metadata.

[0066] The adaptive privacy protection strategy engine is one of the core modules of this system. It is responsible for automatically selecting and applying the most appropriate privacy protection measures based on the privacy metadata of power data and real-time usage scenarios. Through the reasoning ability of the large language model, this module dynamically adjusts the privacy protection strategy to adapt to different power system scenarios and ensure the compliance and privacy security of data processing.

[0067] This step dynamically generates personalized privacy protection decisions based on the specific business scenarios, data usage requirements, and privacy regulations of the power system. By combining the reasoning capabilities of the large language model, the analysis results of the privacy metadata, and the business scenario model, privacy protection strategies for different data streams and business scenarios are generated to ensure that privacy protection measures meet compliance requirements and effectively support business needs.

[0068] Step 108, track the status of the entire life cycle of power data and generate a compliance audit report.

[0069] This step block is responsible for tracking every piece of data in the power system, from generation, transmission, storage to use, throughout its entire life cycle, ensuring privacy compliance at every stage. This module generates a compliance audit report by recording and auditing the flow path of data and its privacy protection status to ensure that the data processing process is transparent and complies with privacy regulations.

[0070] This embodiment greatly expands the boundaries of traditional privacy compliance review by utilizing a large language model, giving full play to the generation, reasoning, adaptation and interaction capabilities of the large language model, making data privacy protection of the power system more intelligent, flexible and automated.

[0071] In one embodiment, step 102 includes: correlating and comparing power data with privacy regulations based on a large language model to evaluate the sensitivity level of the power data; determining several business scenarios corresponding to the power data; each business scenario has a dynamic mapping relationship with privacy regulations; generating a privacy label corresponding to the power data based on the sensitivity level, business scenario and the privacy regulations corresponding to the business scenario; and generating privacy metadata based on the privacy label.

[0072] The core of this step is the privacy compliance analysis based on the large language model. Figure 2 As shown in the figure, the large language model performs semantic matching based on the content characteristics of power data and privacy regulations, automatically analyzes whether the data contains user personal information, sensitive power data (such as equipment status information, real-time load information, etc.), and evaluates its privacy sensitivity. A privacy sensitivity score is generated for each piece of data, which is calculated by the model based on the type of data (personal data, business data, equipment data, etc.) and privacy regulations. According to the score, the data is classified as highly sensitive, low sensitive or non-sensitive data, that is, the sensitivity level is evaluated.

[0073] While conducting the sensitivity level assessment, it is necessary to determine the business scenarios of power data. The sensitivity of data in different scenarios may be different, so this part implements dynamic analysis for specific scenarios. Therefore, in this step, not only the sensitivity analysis of the data itself is performed, but also the actual business scenarios of the power system are combined to identify the data usage risks in different scenarios and assess their sensitivity levels. Specifically, it is necessary to model the specific business scenarios of the power company. Common scenarios include user behavior analysis, equipment status monitoring, load forecasting, etc. The modeling of each scenario includes key information such as the purpose, target, and processing method of the data. Based on the scenario model, the system can dynamically identify the compliance risks of data in different usage scenarios. Through the large language model, the system dynamically maps the terms in the privacy regulations with specific business scenarios. For example, in the scenario of user data analysis, the system will identify whether the data processing in the scenario complies with the requirements of user privacy regulations. If the usage of the scenario (such as third-party data sharing) triggers a compliance risk, the system will automatically issue a warning.

[0074] Based on the analysis results of the sensitivity and usage scenarios of power data, the system needs to generate a privacy compliance label for each piece of power data to identify the privacy risk level and processing requirements of the data. Based on the privacy rules and sensitivity analysis results generated by the large language model, the system designs a rule engine for privacy compliance labels. The engine is responsible for generating corresponding label information based on data characteristics and regulatory requirements. Label information includes privacy risk level, applicability of regulatory terms, data processing restrictions, etc. Preferably, the system supports dynamic updates of privacy labels. When data is transferred to other business scenarios, or the way data is used changes, the system will re-analyze and update the privacy label to ensure that the data remains compliant throughout its life cycle.

[0075] This step can perform privacy sensitivity assessment on data flows in the power system in real time and efficiently, and dynamically generate privacy compliance labels, providing strong technical support for subsequent privacy protection strategies.

[0076] In other embodiments, Figure 2 As shown in Figure 1, after the privacy label is generated, the corresponding data analysis report is also generated. These outputs will serve as inputs for subsequent steps (such as the adaptive privacy protection strategy engine and full-link tracking) to ensure privacy compliance in every link of the entire system.

[0077] In other embodiments, the system parses privacy regulations (such as GDPR and CCPA) through a large language model to generate compliance rules. These rules are stored in the form of structured data, and then associated and compared with power system data based on the compliance rules. The compliance rules can also be used for other matching and analysis in subsequent steps.

[0078] After obtaining the privacy label, structured privacy metadata is generated for each piece of power data based on the privacy label. These privacy metadata should include information such as the sensitivity assessment results of the power data, data processing scenarios, compliance requirements, and usage restrictions. The structural design of privacy metadata must ensure flexibility to support the diverse needs of different types of data (such as user data, device data, real-time data, etc.).

[0079] Privacy metadata is a structured document that can be stored in JSON, XML, or other suitable formats. Privacy metadata can include the following key fields:

[0080] Data ID: A unique identifier used to track the flow and processing of data in the system;

[0081] Data source: the source of the recorded data, such as user devices, smart meters, server logs, etc.

[0082] Sensitivity level: Based on the data flow monitoring and analysis results of the previous module, record the privacy sensitivity of the data (such as high sensitivity, medium sensitivity or non-sensitive);

[0083] Privacy regulation mapping: List the privacy regulations related to the data (such as specific chapters in GDPR) and mark the restrictions on the use of data in different scenarios;

[0084] Processing requirements: specify the compliance requirements for the data during transmission, storage and use, such as whether encryption, anonymization or desensitization is required;

[0085] Update timestamp: Records the last update time of metadata to ensure that the system can track the latest privacy compliance status.

[0086] The privacy metadata is generated by interacting with the monitoring module for real-time collection and analysis of power data. After the data flow monitoring module performs a sensitivity assessment on each piece of power data, it passes the analysis results to the privacy metadata generation module. The privacy metadata generation module dynamically generates corresponding privacy metadata for each piece of data based on preset rules and regulatory requirements of large language model parsing.

[0087] In one embodiment, the privacy metadata is stored in a distributed storage manner; an index is created for the stored privacy metadata, and a query port is created based on the index; and an access control mechanism is set for the query port.

[0088] Privacy metadata must be stored in an efficient and scalable manner and support fast access by other modules of the system so that the system can obtain and update the privacy status of the data in real time.

[0089] Based on the above purpose, in this embodiment, the privacy metadata should be stored separately from the main data in the power system, but associated through the data ID. An efficient distributed storage system (such as Cassandra or MongoDB) can be selected to store privacy metadata to support the system's large-scale data processing and query requirements. The system creates an index for each privacy metadata, and the index can be based on fields such as data ID, sensitivity level, and regulatory requirements. The query module supports other modules to quickly access metadata at any point in time to obtain the latest privacy compliance status. At the same time, in order to ensure the security of privacy metadata, the system needs to set up a strict access control mechanism. Only authorized modules or users can access or modify privacy metadata to prevent unauthorized access or tampering.

[0090] In other embodiments, the structure design of privacy metadata should have good scalability to support future regulatory updates or the introduction of new data types. The system should also have automated maintenance capabilities to ensure that privacy metadata is always accurate and effective.

[0091] Specifically, the design of privacy metadata should take into account future changes in privacy regulations and allow the addition of new fields (such as new regulatory terms, processing requirements for special scenarios, etc.) without affecting the stability of the existing system. Data storage formats (such as JSON or XML) can flexibly support the expansion of fields.

[0092] In addition, the system needs to set up regular maintenance tasks to automatically check the integrity and consistency of privacy metadata. For example, the system can regularly scan the privacy metadata in storage to ensure that each piece of power data has the latest privacy compliance status, and regenerate or update the privacy metadata when necessary.

[0093] Steps 102 and 104 generate privacy metadata for each piece of power system data and are dynamically updated as needed.

[0094] In one embodiment, according to the privacy metadata, an adaptive privacy protection policy engine is used to dynamically generate a privacy protection decision, including: based on the business scenario of the power data and the privacy regulations matched by the privacy metadata, an adaptive privacy protection policy engine is used, combined with the reasoning ability of the large language model, to determine whether the current business scenario requires privacy protection; when it is determined that the current business scenario requires privacy protection, a policy rule library containing different types of privacy protection technologies and corresponding applicable conditions is called, the corresponding privacy protection technology is matched, and a privacy protection decision is generated.

[0095] like Figure 3As shown in the figure, the adaptive privacy protection policy engine can dynamically generate and apply privacy protection measures suitable for current data processing needs, namely privacy protection decisions, based on the privacy metadata of power data, real-time business scenarios, and the latest privacy regulations. The core of the adaptive privacy protection policy engine is a rule-based decision system that combines a large language model for reasoning. The decision system generates a policy solution based on preset rules by parsing key information in the privacy metadata (such as data sensitivity level, privacy regulations, etc.).

[0096] Policy generation relies on real-time scenario analysis and reasoning. The policy engine dynamically generates protection measures based on the following information:

[0097] Privacy metadata: including sensitivity levels, processing requirements, and regulatory mappings;

[0098] Data processing scenario: real-time monitoring of data usage, including whether the data is shared, transmitted, stored, etc.;

[0099] Privacy regulation analysis: The regulatory interpretation provided by the large language model is used to match the privacy protection measures applicable in the current scenario.

[0100] Specifically, the above information is extracted through scene perception and large language model technology. Among them, scene perception technology is used to monitor the operating status of the power system in real time and capture the usage scenarios of data in different processing links. Scene perception technology determines the current usage of power data by analyzing the flow of data and processing operations (such as transmission, storage or analysis). The large language model is used to infer the privacy risks in the current scenario and match the corresponding regulatory provisions based on the privacy metadata of the data. Through the reasoning ability of the model, the system can determine whether special privacy protection measures are required in the current scenario, such as whether encryption or desensitization needs to be enabled when data is transmitted to external service providers.

[0101] When the scenario changes, the policy engine will automatically generate or adjust the current privacy protection decision. For example:

[0102] Encryption policy: When sensitive data is detected to be transmitted to an external network, the system will automatically generate an encryption policy to ensure that sensitive information is not leaked during data transmission;

[0103] Anonymization strategy: In data analysis scenarios, the system may apply anonymization strategies to process large-scale user electricity consumption data without exposing user identity information;

[0104] Data classification strategy: For data of different sensitivity levels, the system will automatically apply protection measures of different strengths, such as applying stronger encryption algorithms to highly sensitive data and lightweight protection methods to low-sensitivity data.

[0105] Based on the generated privacy protection decisions, specific privacy protection technologies are applied to ensure that data is always properly protected during transmission, storage, and use. Privacy protection technologies include but are not limited to:

[0106] Encryption mechanism: The system can select different encryption algorithms (such as AES, RSA, etc.) to encrypt sensitive data to ensure the security of data during transmission and storage. The encryption mechanism will dynamically select the appropriate encryption algorithm and key management method based on the sensitivity of the data;

[0107] Data desensitization: In certain usage scenarios (such as data display or data sharing), the system will desensitize sensitive data. Common desensitization techniques include character replacement, partial shielding, data disruption, etc. The system will select the most appropriate desensitization technology based on the specific content and usage requirements of the data;

[0108] Anonymization technology: For data involving user personal information, the system can apply anonymization technology. Anonymization can not only mask user identity information, but also protect user privacy while ensuring data availability through technologies such as adding noise, clustering or randomization processing;

[0109] Access control and permission management: The system will automatically set access control permissions based on policy generation results. Through fine-grained access control mechanisms, the system can ensure that only authorized users or modules can access sensitive data.

[0110] In other embodiments, the system can continuously optimize strategies based on the actual implementation effects of privacy protection decisions to improve the efficiency and compliance of privacy protection.

[0111] Specifically, the system has a built-in policy effectiveness evaluation module to monitor and analyze the execution effect of the privacy protection policy in real time. The evaluation criteria include data protection strength, system performance consumption, regulatory compliance, etc. When the policy effectiveness evaluation finds that the protection strength is insufficient or the performance is overloaded, the system will automatically adjust the privacy protection policy. For example, in the batch processing scenario of sensitive data, if the system detects a performance bottleneck caused by encryption, it can dynamically adjust to a performance-optimized protection solution. In addition, by introducing the continuous learning capability of the large language model, the system can automatically update the policy rule base based on new privacy regulations, usage scenarios, and user feedback. In this way, the system can continuously optimize the privacy protection solution as privacy protection technology advances and power system scenarios change.

[0112] like Figure 4As shown in the figure, after building an adaptive privacy protection policy engine, personalized privacy compliance policy generation is performed. This step can generate highly customized privacy protection policies based on the specific business needs and regulatory requirements of the power company, ensuring that the data privacy protection measures in the power system not only comply with regulatory requirements, but can also flexibly adapt to changes in business scenarios, providing a more refined and intelligent privacy protection solution.

[0113] This step first requires modeling the business scenarios of the power company so that the system can understand the data flow and usage requirements in different business scenarios. The business scenario model is the basis for generating personalized privacy protection strategies.

[0114] The system has a built-in business scenario modeling framework that supports converting common business processes of power companies into structured scenario models. For example, the scenario model can include specific scenarios such as user power consumption behavior analysis, equipment status monitoring, load forecasting, and dispatch control. Scenario elements include:

[0115] Data type: identifies the type of data involved in the scenario (such as user data, device data, real-time monitoring data, etc.);

[0116] Data flow: describes the flow path of data in the scenario, such as data flowing from the acquisition module to the analysis module and then into the storage module;

[0117] Usage requirements: Define the purpose and specific requirements of data usage in this scenario, such as user behavior analysis, device status prediction, etc.

[0118] During the scenario modeling process, the system matches the business scenarios of power companies with privacy regulations. For example, in the scenario of user behavior analysis, the system will identify privacy information that requires special attention (such as personal electricity usage data) and generate preliminary compliance requirements based on relevant regulations (such as GDPR).

[0119] Combine privacy metadata and business scenario models to generate appropriate privacy protection policies for each specific business scenario to ensure that data usage meets compliance requirements and supports business objectives.

[0120] Specifically, the privacy metadata is parsed first. The system combines the information in the privacy metadata (such as data sensitivity, privacy risk level, processing requirements, etc.) with the data flow and usage requirements in the business scenario. Privacy metadata contains the sensitivity assessment results and compliance requirements of the data, which provides a basis for generating personalized privacy policies. Then, the system analyzes its needs for different business scenarios. For example, in the user data analysis scenario, the system needs to consider how the data can be effectively analyzed while maintaining privacy compliance. In the device monitoring scenario, the system will give priority to the real-time and security of the data to ensure efficient data transmission and use. Finally, based on the combination of privacy metadata and business scenarios, the system dynamically generates privacy protection policies suitable for the current business scenarios. The system will dynamically adjust these policies according to the specific scenarios to ensure that business efficiency is not affected while protecting privacy.

[0121] The personalized privacy protection strategy will include:

[0122] Data processing measures: such as whether the data needs to be encrypted, anonymized or desensitized;

[0123] Usage restrictions: such as restrictions on sharing or external transmission of data;

[0124] Storage protection measures: whether additional security measures are required during the storage phase (such as encrypted storage or access control).

[0125] In other embodiments, during the actual operation of the power system, the business scenario may change, and the system needs to automatically adjust the privacy protection strategy according to the scenario changes.

[0126] Specifically, the system uses the business scenario monitoring module to detect in real time whether the business scenario of the power company has changed. For example, when user data is transferred from the analysis module to the sharing module, the system will detect this scenario change and adjust the privacy protection strategy according to the new usage scenario.

[0127] When a business scenario change is detected, the system will call the large language model to re-analyze the compliance requirements of the current scenario and generate a new privacy protection policy. For example, when data is transferred from an internal usage scenario to an external partner, the system will automatically enable stricter encryption and desensitization measures to ensure that the data complies with privacy regulations when it is transmitted externally.

[0128] The privacy protection policy rule base maintained by the system will be updated as regulations and business needs change. The large language model continuously learns new regulations to ensure that the generated policies are always consistent with the latest regulatory requirements. The update mechanism of the rule base ensures that the system can quickly adapt to new privacy protection needs.

[0129] In other embodiments, the generated personalized privacy protection strategy can also be applied to data processing in the power system, and feedback and optimization can be performed based on the application effect.

[0130] Specifically, the system passes the generated personalized privacy protection policies to the data processing module through the application interface. During the data transmission, storage and use process, the system will automatically execute these policies. For example, the system will apply appropriate encryption or anonymization processing according to the policy to ensure the privacy security of the data throughout its life cycle.

[0131] The system monitors the actual implementation of the privacy protection strategy and continuously provides feedback on the effectiveness of the strategy. For example, if it is found that a certain encryption measure affects system performance when processing large-scale data, the system will dynamically adjust the strategy based on the feedback and select a more suitable encryption scheme.

[0132] The system continuously optimizes the generation of personalized privacy protection policies through the learning ability of the large language model. As the business scenarios of power companies change, the system will continue to collect feedback data and optimize policies based on this data. For example, when a power company introduces new business processes or regulations, the system can automatically adjust and generate new compliance policies.

[0133] Personalized privacy compliance policy generation step. The output is a personalized privacy protection policy generated for each business scenario. The policy content includes data processing measures, usage restrictions, storage requirements, etc. The output policy will be passed to the data processing module and executed during the operation of the system. In this step, data usage requirements and scenario change information are obtained based on privacy metadata and business scenarios, and the generated policy is passed to the adaptive privacy protection policy engine to execute the personalized policy. The system can generate highly customized privacy protection policies based on the specific business needs and regulatory requirements of the power company. Personalized privacy compliance policy generation ensures that data privacy protection measures in the power system not only meet regulatory requirements, but also can flexibly adapt to changes in business scenarios, providing a more refined and intelligent privacy protection solution.

[0134] Step 106 outputs the privacy protection decision in the current scenario and the specific protection measures applied to the data. The output content includes encryption method, anonymization scheme, desensitization processing strategy, etc., and provides a detailed log of the policy execution.

[0135] In one embodiment, the execution effect of the privacy protection decision is monitored and evaluated in real time; the evaluation criteria for the execution effect include protection strength, system performance consumption, and regulatory compliance; and the privacy protection decision is automatically adjusted based on the evaluation results of the execution effect.

[0136] like Figure 5As shown, in the power system, the entire process of data collection and use is tracked to ensure that the privacy protection measures in each link are correctly applied and the status changes of data in different modules are recorded.

[0137] Specifically, the system assigns a universally unique identifier (UUID) to each piece of data when it is generated, ensuring that the data can be uniquely identified and tracked at every stage of its life cycle. The UUID is attached to the privacy metadata of the data as the basis for tracking the data throughout its life cycle.

[0138] In addition, trackers are embedded in each processing link of the system to record the flow path of data in real time. The tracker records the time, location, relevant modules and purpose of each data transmission, storage, access or processing operation. Each recorded information is associated with the UUID of the data to ensure that the system can trace back the complete flow link of the data.

[0139] The system not only records the flow of data, but also records changes in its privacy protection status. For example, when data is transferred from the storage module to an external system, the system records the encryption status during the transfer process; when data is desensitized in the analysis module, the system records the desensitization method and processing results. All status changes are updated in the metadata and synchronized with the tracking records.

[0140] During the continuous full-link tracking process, detailed audit logs are generated to ensure that every data operation and privacy protection measure is fully recorded, providing a basic basis for subsequent compliance reviews.

[0141] Audit logs are recorded in a structured format (such as JSON, XML, etc.) and contain the following key fields:

[0142] UUID: used to identify the audit object data;

[0143] Operation timestamp: records the time when the data operation occurs;

[0144] Operation type: including data reading, transmission, storage, processing and other operation types;

[0145] Operation module: records the system module or external interface that performs the operation;

[0146] Privacy status change: records the privacy protection status of data before and after the operation, such as whether it is encrypted, anonymized, or desensitized;

[0147] Compliance check results: Record whether each operation complies with privacy regulations and which regulatory provisions apply.

[0148] Preferably, the system stores the audit log in a distributed database to ensure high availability and fast query of the log. In order to prevent the audit log from being tampered with, the system can use encrypted storage and digital signature technology to ensure the integrity and security of each log.

[0149] Due to the large scale of data processing in the power system, the system needs to adopt a distributed storage solution (such as Elasticsearch, Apache Cassandra) to store audit logs and optimize the storage structure according to query requirements. The index mechanism can be based on fields such as UUID, operation type, and operation time to ensure fast retrieval and analysis of logs.

[0150] In other embodiments, by real-time tracking of data flows and operations, the system can conduct compliance reviews to ensure that each operation complies with the corresponding privacy regulations. At the same time, the system can automatically detect non-compliant operations and issue warnings.

[0151] Specifically, while tracking data flows, the system checks the compliance of data operations in real time based on privacy regulations and internal corporate compliance policies. For example, when data is transferred to a third party, the system automatically checks whether the necessary encryption or desensitization measures have been applied, and confirms whether the operation complies with relevant regulations (such as the data transfer clause in GDPR).

[0152] The system uses a large language model to analyze the applicable terms of privacy regulations and compares them with actual operations. When the system detects operations that do not comply with privacy regulations, it generates violation records and triggers alerts. For example, unauthorized access and unencrypted transmission of highly sensitive data will be automatically captured by the system.

[0153] When the system detects an illegal operation, it will immediately issue an alarm and notify relevant personnel or modules through APIs or message queues (such as Kafka). The system will provide detailed violation information, including violation data, operation time, violation reasons, and possible regulatory violations, to help operators respond and correct quickly.

[0154] In other embodiments, the system generates a compliance review report that can be used by auditors and regulatory agencies, detailing the flow and operation history of each piece of data in the power system and providing compliance analysis results.

[0155] Specifically, the system provides a variety of audit report templates to meet different audit and compliance needs. The templates will be customized according to the specific requirements of the power company or regulations. The report content includes data flow path, operation history, application of privacy protection measures, compliance check results, etc.

[0156] The system has a built-in compliance scoring mechanism that scores the compliance of each piece of data based on its operation history and privacy protection status. For example, the score will take into account factors such as the sensitivity of the data, the encryption status in the transmission path, and whether it has been desensitized. The compliance score can help power companies quickly assess the privacy compliance of overall data processing.

[0157] The system supports automatic generation of audit reports on a regular basis and can be scheduled according to audit requirements. For example, a complete compliance review report is automatically generated once a month and sent to the relevant compliance officer or external audit agency. The system also supports customized generation of special audit reports for a certain period of time or for a certain type of data.

[0158] Step 108 outputs power data tracking records, audit logs, and compliance reports. The output content can be used internally in the system or provided to external compliance review or audit agencies. The compliance report contains detailed operation records, compliance scores, and review results, providing power companies with complete data privacy audit records. This step can provide comprehensive privacy compliance auditing and tracking functions to ensure that the data processing process in the power system is transparent, controllable, and in compliance with privacy regulations around the world. This module helps power companies achieve comprehensive data compliance management and generate complete reports for audit and supervision.

[0159] The main innovative features of the present invention include:

[0160] (1) Adaptive privacy protection policy engine: The system uses a large language model to intelligently analyze data usage scenarios and dynamically apply appropriate privacy protection measures (such as encryption, anonymization, desensitization, etc.). The engine adaptively adjusts policies to ensure data privacy compliance in different scenarios.

[0161] (2) Dynamic generation and update of privacy compliance metadata: Generate privacy compliance metadata for each piece of power data, including the sensitivity, source, processing requirements, etc. These metadata will be dynamically updated as the data is transmitted and processed, enabling full tracking of the data privacy status.

[0162] (3) Privacy compliance chain tracking and auditing: The large language model automatically generates a complete compliance tracking report by analyzing the data processing chain, recording whether each processing link complies with privacy regulations, and automatically issues warnings and provides rectification suggestions when non-compliant behavior is detected.

[0163] (4) Personalized privacy compliance strategy generation: The system generates personalized privacy compliance strategies based on the actual data flow and the needs of the power company or specific business. Through model reasoning, specific privacy protection solutions are given for data flows and business scenarios in the power system.

[0164] The beneficial effects achieved by the present invention include:

[0165] (1) Dynamically adjust privacy protection strategies: The adaptive privacy protection strategy engine analyzes different data processing scenarios through a large language model and automatically selects the optimal privacy protection method to achieve flexible and dynamic compliance assurance.

[0166] (2) Full-chain compliance tracking: Dynamic generation and updating of privacy metadata, as well as tracking of the entire data life cycle by large language models, ensure that each step of data processing complies with the latest privacy regulations.

[0167] (3) Personalized policy generation: By generating and deducing personalized privacy compliance policies, power companies can customize data protection solutions based on actual business needs while ensuring compliance and business efficiency.

[0168] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0169] Based on the same inventive concept, the embodiment of the present application also provides a power system data privacy compliance review system for implementing the power system data privacy compliance review method involved above. The implementation scheme for solving the problem provided by the system is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more power system data privacy compliance review system embodiments provided below can refer to the limitations of the power system data privacy compliance review method above, and will not be repeated here.

[0170] In one embodiment, a power system data privacy compliance review system is provided, comprising:

[0171] A privacy metadata generation module is used to obtain power data and dynamically generate privacy metadata corresponding to the power data based on a large language model;

[0172] A dynamic update module for monitoring the data flow of power data, applicable privacy regulations and processing methods to update privacy metadata;

[0173] The privacy compliance policy generation module is used to dynamically generate privacy protection decisions based on privacy metadata using an adaptive privacy protection policy engine;

[0174] The full-link tracking and auditing module is used to track the status of power data throughout its life cycle and generate compliance audit reports.

[0175] In one embodiment, Figure 6 As shown, the power system data privacy compliance review system includes:

[0176] Data flow monitoring and analysis module: real-time monitoring of data flows in the power system, identification and classification of data sensitivity and privacy levels. This module combines the semantic understanding capabilities of the large language model, analyzes data usage scenarios, and generates corresponding privacy compliance labels.

[0177] Privacy metadata generation and dynamic update module: Generates privacy compliance metadata for each piece of data, recording the data's sensitivity level, source, processing requirements, etc. Privacy metadata will be automatically updated as the data flows and processes, ensuring the dynamic traceability of privacy information.

[0178] Adaptive privacy protection strategy engine: Based on the analysis results of real-time data, it adaptively selects the most appropriate privacy protection technology (such as encryption, anonymization, etc.) to ensure that the corresponding compliance strategies are automatically applied in different data processing scenarios.

[0179] Personalized privacy compliance policy generation module: Through the large language model, the system generates personalized privacy protection policies based on the specific business scenarios and regulatory requirements of the power company to ensure compliance with different business needs.

[0180] Full-link tracking and auditing module: Tracks the entire life cycle of data from collection to processing, storage and transmission, and generates detailed compliance tracking reports. When privacy risks are detected, the module automatically issues warnings and gives rectification suggestions.

[0181] Each module interacts with other modules through API interfaces. For example, the data flow monitoring and analysis module interacts with other modules of the system through internal APIs, and the analysis reports and labels generated by the module are passed to the audit module to ensure the integrity and accuracy of the final audit report. The privacy metadata generation and dynamic update module provides a standardized API interface, allowing other modules (such as the adaptive privacy protection policy engine and the full-link tracking module) to query and update privacy metadata in real time. The adaptive privacy protection policy engine interacts with other modules (such as the privacy metadata module and the full-link tracking module) through API interfaces. The policy engine generates policies based on privacy metadata and scenario changes, and passes them to the data processing module in real time through the interface. The personalized privacy compliance policy generation module interacts with other modules through APIs. This module obtains data usage requirements and scenario change information from the privacy metadata module and the business scenario monitoring module, and passes the generated policies to the adaptive privacy protection policy engine for the execution of personalized policies. The full-link tracking and audit module interacts with other modules through API interfaces, especially closely collaborating with the privacy metadata module and the adaptive privacy protection policy engine. The audit module will regularly obtain data operation records and protection policies from these modules, and pass the tracking and audit results back to the system's decision-making module for policy adjustment.

[0182] The overall design of this embodiment realizes intelligent and dynamic compliance review and protection of power system data privacy by introducing a large language model. The system consists of multiple functional modules, which respectively handle functions such as data flow monitoring, privacy compliance metadata generation, dynamic privacy protection, adaptive compliance strategy generation, full-link tracking and auditing. The system process covers all aspects of data collection, processing, storage and transmission to ensure the full life cycle protection of data privacy.

[0183] Each module in the above-mentioned power system data privacy compliance review system can be implemented in whole or in part through software, hardware and their combination. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of the above modules.

[0184] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in all the above method embodiments when executing the computer program.

[0185] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in all the above method embodiments are implemented.

[0186] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in all the above method embodiments when executed by a processor.

[0187] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant laws, regulations and standards of relevant countries and regions.

[0188] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited thereto. The processors involved in each embodiment provided in this application may be general-purpose processors, central processing units, graphics processors, digital signal processors, programmable logic devices, data processing logic devices based on quantum computing, etc., but are not limited thereto.

[0189] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0190] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A power system data privacy compliance review method, characterized in that: The method comprises: Acquire power data, and dynamically generate privacy metadata corresponding to the power data based on a large language model; Monitoring the data flow, applicable privacy regulations and processing methods of the power data to update the privacy metadata; Dynamically generate a privacy protection decision using an adaptive privacy protection strategy engine based on the privacy metadata; Track the status of the power data throughout its life cycle and generate compliance audit reports.

2. The method according to claim 1, characterized in that The acquiring of power data and dynamically generating privacy metadata corresponding to the power data based on the large language model includes: Associating and comparing the power data with privacy regulations based on a large language model to evaluate the sensitivity level of the power data; Determine several business scenarios corresponding to the power data; each of the business scenarios has a dynamic mapping relationship with the privacy regulations; generating the privacy label corresponding to the power data according to the sensitivity level, the business scenario, and the privacy regulations corresponding to the business scenario; The privacy metadata is generated according to the privacy tag.

3. The method according to claim 1, characterized in that The method further comprises: Storing the privacy metadata in a distributed storage manner; Creating an index for the stored privacy metadata, and creating a query port based on the index; An access control mechanism is set for the query port.

4. The method according to claim 1, characterized in that: The step of dynamically generating a privacy protection decision by using an adaptive privacy protection strategy engine according to the privacy metadata includes: Based on the business scenario of the power data and the privacy regulations matched by the privacy metadata, the adaptive privacy protection strategy engine is used in combination with the reasoning ability of the large language model to determine whether the current business scenario requires privacy protection; When it is determined that the current business scenario requires privacy protection, a policy rule library containing different types of privacy protection technologies and corresponding applicable conditions is called, the corresponding privacy protection technology is matched, and the privacy protection decision is generated.

5. The method according to claim 4, characterized in that: The policy rule library introduces a large language model for automatic updating according to the privacy regulations, the application scenarios and user feedback.

6. The method according to claim 4, characterized in that The method further comprises: Monitor and evaluate the execution effect of the privacy protection decision in real time; the evaluation criteria of the execution effect include protection strength, system performance consumption, and regulatory compliance; The privacy protection decision is automatically adjusted according to the evaluation result of the execution effect.

7. A power system data privacy compliance review system, characterized in that: The system comprises: A privacy metadata generation module, used to obtain power data and dynamically generate privacy metadata corresponding to the power data based on a large language model; A dynamic update module, used to monitor the data flow of the power data, applicable privacy regulations and processing methods, so as to update the privacy metadata; A privacy compliance policy generation module, configured to dynamically generate a privacy protection decision using an adaptive privacy protection policy engine according to the privacy metadata; The full-link tracking and auditing module is used to track the status of the power data throughout its life cycle and generate a compliance audit report.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images