Data privacy measurement method for intelligent connected automobile

Abstract

The invention provides a data privacy measurement method for an intelligent connected automobile, and the method comprises the steps: calculating a privacy attribute weight through an analytic hierarchy process, and carrying out the correction of the privacy attribute weight through combining with the privacy preference of a user, so as to generate a personalized privacy weight; generating a personalized privacy risk through weighted information entropy, and periodically updating the personalized privacy risk according to a sliding time window mechanism; calculating privacy leakage probability distribution of time and space dimensions through gamma distribution, generating a space-time privacy risk, and updating the space-time privacy risk by adopting a sliding time window mechanism; and fusing the personalized privacy risk and the space-time privacy risk through weighted average to generate a comprehensive privacy risk value, and verifying the accuracy of the measurement result in combination with the privacy evaluation parameters. According to the method, the privacy security of the intelligent network connection automobile can be effectively guaranteed, the privacy protection strategy can be adaptively adjusted according to user requirements, and the privacy security of the intelligent network connection automobile in different environments is guaranteed.

Description

Technical Field

[0001] This application relates to the field of information security technology, and particularly to a data privacy measurement method for intelligent connected vehicles. Background Art

[0002] In the prior art, the privacy measurement problem of intelligent connected vehicles mainly involves how to effectively measure and protect the privacy of vehicle data in a highly dynamic environment. With the increase in data exchange between vehicles and between vehicles and infrastructure, privacy and security issues have become key challenges in intelligent connected vehicles. However, the characteristics of intelligent connected vehicles, such as dynamic changes, variable network topologies, and high real-time requirements, make it difficult for traditional privacy measurement methods to cope with these challenges. Especially in an unreliable or weakly trusted environment, how to effectively protect privacy becomes even more complex.

[0003] In terms of data privacy measurement, existing research is mostly based on information theory, mainly using measurement methods such as information entropy. These methods can design various privacy measurement models according to the prior knowledge of the attacker. Existing privacy protection technologies usually achieve privacy protection by perturbing the original data and blurring sensitive attributes. From the two aspects of privacy protection intensity and data availability, common privacy measurement indicators include entropy, mutual information, differential privacy, set pair analysis theory, etc. Combined with other mathematical tools such as graph theory, these methods can quantify and model communication privacy leakage, having a relatively forward-looking impact. However, the existing technology for measuring the privacy of intelligent connected vehicle data does not consider the impact of vehicle dynamic changes on the measurement of privacy leakage risk.

[0004] Personalized privacy risk measurement has gradually become an important direction in privacy measurement research. By combining mathematical models such as the analytic hierarchy process, the amount of privacy leakage can be calculated according to the privacy preference requirements of different users. In scenarios with user benefits such as crowd sensing, considering the timeliness of privacy preferences, dynamically adjusting the privacy preference threshold and privacy measurement matrix, so as to provide support for personalized privacy measurement. In applications such as recommendation systems and social networks, privacy protection based on personalized preferences can be optimized through customized algorithms. However, existing personalized privacy quantification means are still too single, usually relying on manual specification, and the granularity of the results is relatively coarse, with poor flexibility.

[0005] In terms of dynamic privacy measurement, existing research mainly focuses on how to measure privacy in dynamically changing scenarios. For example, mobile edge computing technology based on reinforcement learning has been used for IoT dynamic privacy measurement and protection, and these methods consider various factors such as privacy attributes, attribute preferences, and timeliness. However, the data of intelligent connected vehicles has characteristics such as large scale, unstructuredness, and dynamic change, making it difficult for traditional privacy measurement methods to be fully applicable. Especially in the data privacy detection of vehicle ad-hoc networks, the application of traditional static data privacy measurement methods has limitations, and it is necessary to design a dedicated privacy measurement model by combining the dynamic characteristics and real-time requirements of vehicle data.

[0006] In summary, the following are the disadvantages of the current data privacy measurement technology for intelligent connected vehicles:

[0007] (1) Existing data privacy measurement models do not consider the characteristics of dynamic changes in vehicles.

[0008] (2) There is a lack of personalized measurement for privacy in intelligent connected vehicles.

[0009] (3) Traditional privacy measurement methods for vehicles cannot meet the real-time requirements.

[0010] Therefore, in the face of the severe data security challenges brought by large-scale intelligent connected vehicles, it is urgent to build an effective large-scale intelligent connected vehicle dynamic precise and fine-grained privacy measurement method for the requirements of privacy detection accuracy, measurement timeliness, and user privacy protection intensity differences of intelligent connected vehicles, form personalized privacy protection means based on node difference preferences and data heterogeneity, protect important data and ensure the controllable and secure transfer of privacy data. Summary of the Invention

[0011] This application aims to solve at least one of the technical problems in the related art to some extent.

[0012] To this end, the first object of this application is to propose a data privacy measurement method for intelligent connected vehicles.

[0013] The second object of this application is to propose a data privacy measurement device for intelligent connected vehicles.

[0014] The third object of this application is to propose an electronic device.

[0015] The fourth object of this application is to propose a computer-readable storage medium.

[0016] The fifth object of this application is to propose a computer program product.

[0017] To achieve the above object, an embodiment of the first aspect of the present application proposes a data privacy measurement method for intelligent connected vehicles, including:

[0018] Construct a personalized dynamic privacy measurement model that integrates users' privacy preferences, calculate the privacy attribute weights through the analytic hierarchy process, and correct them in combination with users' privacy preferences to generate personalized privacy weights;

[0019] Based on the personalized privacy weights, calculate the users' personalized privacy risks through weighted information entropy, and periodically update the personalized privacy risks through a sliding time window mechanism;

[0020] Construct a spatio-temporal sensitive dynamic privacy measurement model, calculate the privacy leakage probability distributions in the time and space dimensions using the gamma distribution, generate spatio-temporal privacy risks through joint calculation, and periodically update the spatio-temporal privacy risks using a sliding time window mechanism;

[0021] Fuse the personalized privacy risks and the spatio-temporal privacy risks, generate a comprehensive privacy risk value through weighted average, and verify the accuracy of the risk measurement results in combination with privacy evaluation parameters.

[0022] Optionally, the constructing a personalized dynamic privacy measurement model that integrates users' privacy preferences, calculating the privacy attribute weights through the analytic hierarchy process, and correcting them in combination with users' privacy preferences to generate personalized privacy weights includes:

[0023] The vehicle node defines a set of privacy attributes S = {AT 1 , AT 2 , AT 3 ,..., AT n} according to the acquisition task, and structures the collected data into a privacy matrix G m*n using a non-negative numerical mapping function, where m is the number of samples and n is the number of privacy attributes;

[0024] Compare the n privacy attributes of the collected data pairwise in combination with expert evaluation opinions, and construct a judgment matrix M n*n = [b ij n*n , where b ij represents the relative importance degree of the i-th privacy attribute relative to the j-th privacy attribute;

[0025] Divide each column in the judgment matrix by the sum of all elements in that column to obtain a normalized matrix M' n*n , and perform a consistency test on the judgment matrix to ensure that its consistency ratio CR ≤ 0.1, where:

[0026] ​

[0027] where λ max is the maximum eigenvalue of the judgment matrix, n is the number of privacy attributes, and RI is the random consistency index;

[0028] For the normalized matrix M′ n*n that meets the conditions, sum the elements of each row and take the average to obtain the initial privacy attribute weight w of each privacy attribute;

[0029] Based on the user privacy preference weight w pref correct the initial privacy attribute weight w to obtain the personalized privacy weight w with user privacy preference final , and the formula is:

[0030] w final = θ 1 w + θ 2 w pref where θ 1 + θ 2 = 1

[0031]

[0032] where Co(w, w pref ) represents the correction function, and its function value satisfies the normalization condition; θ 1 and θ 2 are proportionality coefficients.

[0033] Optionally, based on the personalized privacy weight, calculate the user's personalized privacy risk through weighted information entropy, and periodically update the personalized privacy risk through a sliding time window mechanism, including:

[0034] Based on the personalized privacy weight and the privacy matrix, calculate the personalized privacy risk of the current window t through weighted information entropy H p (w final , G), and the formula is: The formula is:

[0035]

[0036] where is the personalized privacy weight of the i-th privacy attribute, and p(x j ) is the probability distribution of the j-th sample;

[0037] Use the sliding time window mechanism to divide the privacy data into time windows T with a fixed length 1 , T 2 , T 3 , …T m-1 , T m, and the privacy risk weight within each time window is controlled by a time decay function, and its expression is:

[0038]

[0039] If the privacy amounts in each time slot are respectively \(S = \{s 1 , s 2 , \cdots, s m \}\), then the total personalized privacy risk at time \(t\) is:

[0040]

[0041] where \(\lambda\) is the decay factor, \(t k \) is the cut-off time of the \(k\)-th time slot, and \(s k \) represents the privacy amount in the \(k\)-th time slot.

[0042] Optionally, the constructed spatio-temporally sensitive dynamic privacy metric model calculates the privacy leakage probability distributions in the time and space dimensions using the gamma distribution, and generates the spatio-temporal privacy risk through joint calculation, including:

[0043] Define the vehicle communication radius \(R\), the allowed tracking time \(T'\), the allowed tracking distance \(D'\), the maximum time \(T max and the maximum distance \(D max ;

[0044] Describe the privacy leakage of the user's location privacy in the time dimension and the space dimension respectively from a probabilistic perspective based on the gamma distribution function. Among them, the gamma distribution parameter formulas in the time dimension and the space dimension are respectively:

[0045]

[0046] Substitute the above distribution parameters \(\alpha t , \beta t , \alpha d , \beta d into the gamma distribution function respectively, and obtain the privacy leakage probability distribution functions in the time dimension and the space dimension. The formula is:

[0047]

[0048] In the formula, \(f t (t, \alpha t , \beta t ) is the privacy leakage probability distribution function in the time dimension, and \(f d (d, \alpha d , \beta d ) is the privacy leakage probability distribution function in the space dimension;

[0049] Calculate the spatio-temporal privacy risk by combining the privacy leakage probability distribution function in the time dimension and the space dimension. The formula is as follows:

[0050] L p =(1 - ∫ 0 T f t (x)dx)*(1 - ∫ 0 D f d (x)dx)

[0051] where T and D are the upper limit values of the time dimension and the space dimension respectively.

[0052] Optionally, fusing the personalized privacy risk and the spatio-temporal privacy risk to generate a comprehensive privacy risk value through weighted average, including:

[0053] Fuse the personalized privacy risk H p and the spatio-temporal privacy risk L p through weighted average. The calculation formula of the comprehensive privacy risk value is:

[0054] P metric =μ 1 H p +μ 2 L p

[0055] where P metric is the comprehensive privacy risk value, μ 1 , μ 2 are weighting factors, and μ 1 , μ 2 ∈[0, 1].

[0056] Optionally, verifying the accuracy of the risk measurement result by combining privacy evaluation parameters, including:

[0057] Introduce a privacy information evaluation parameter ρ to evaluate the accuracy rate of data privacy measurement. ΔH p represents the difference from the last privacy measurement result. Ensure the accuracy of this privacy measurement result by stipulating that the difference between the two is within the controllable range of ε. The calculation formula is:

[0058]

[0059] Combine the K-L divergence of the time and space privacy leakage distributions to calculate the difference or distance between the two probability distributions. The formula is:

[0060]

[0061] In the formula, f t (i) and fd (i) are the distribution functions of time and space privacy leakage respectively.

[0062] To achieve the above object, an embodiment of the second aspect of the present application proposes a data privacy measurement device for intelligent connected vehicles, including:

[0063] A personalized privacy weight generation module, configured to construct a personalized dynamic privacy measurement model integrating user privacy preferences, calculate privacy attribute weights through the analytic hierarchy process, and correct them in combination with user privacy preferences to generate personalized privacy weights;

[0064] A personalized privacy risk generation and update module, configured to calculate the user's personalized privacy risk based on the personalized privacy weights through weighted information entropy, and periodically update the personalized privacy risk through a sliding time window mechanism;

[0065] A spatio-temporal sensitive dynamic privacy measurement module, configured to construct a spatio-temporal sensitive dynamic privacy measurement model, calculate the privacy leakage probability distributions in the time and space dimensions using the gamma distribution, generate spatio-temporal privacy risks through joint calculation, and periodically update the spatio-temporal privacy risks through a sliding time window mechanism;

[0066] A comprehensive privacy risk generation and verification module, configured to fuse the personalized privacy risk and the spatio-temporal privacy risk, generate a comprehensive privacy risk value through weighted average, and verify the accuracy of the risk measurement result in combination with privacy evaluation parameters.

[0067] To achieve the above object, an embodiment of the third aspect of the present application proposes an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0068] The memory stores computer execution instructions;

[0069] The processor executes the computer execution instructions stored in the memory to implement the method described in any one of the first aspect.

[0070] To achieve the above object, an embodiment of the fourth aspect of the present application proposes a computer-readable storage medium, in which computer execution instructions are stored, and when the computer execution instructions are executed by a processor, they are used to implement the method described in any one of the first aspect.

[0071] To achieve the above object, an embodiment of the fifth aspect of the present application proposes a computer program product, which implements the method described in any one of the first aspect when executed by a processor.

[0072] The technical solutions provided by the embodiments of the present application at least bring the following beneficial effects:

[0073] (1) The present invention generates a personalized privacy metric value by introducing a personalized dynamic privacy metric model, calculating the weights of sensitive attributes in combination with the analytic hierarchy process, and correcting the weights according to the user's privacy preferences. This method can meet the differentiated privacy protection requirements of different users, making the privacy protection strategy more flexible and personalized, thereby enhancing the user's satisfaction with privacy protection.

[0074] (2) The spatio-temporal sensitive dynamic privacy model proposed by the present invention can dynamically capture the changes in privacy risks when a vehicle node interacts with surrounding facilities by assessing the privacy risks of the vehicle node in terms of time and communication distance during the driving process. This method effectively considers the dynamic change characteristics of vehicle data in the spatio-temporal dimension, making the privacy risk assessment more accurate and capable of adapting to the highly dynamic environment of intelligent connected vehicles.

[0075] (3) The present invention dynamically updates the privacy metric value by introducing a sliding time window mechanism and weighting the historical privacy risks in combination with a decay function. This method can comprehensively consider the impact of historical privacy risks and quickly respond to the privacy risks at the current moment, meeting the real-time privacy metric requirements of intelligent connected vehicle nodes and providing accurate privacy assessment results for vehicle users.

[0076] (4) The present invention can not only accurately measure the privacy leakage risk of vehicle nodes, but also achieve a balance between privacy protection and data availability through reasonable model design. The combination of personalized and spatio-temporal sensitive measurement methods not only ensures the intensity of privacy protection but also ensures the efficient flow of data in the vehicle network.

[0077] (5) The present invention specifically designs a privacy metric model for the dynamic characteristics and real-time requirements of data in intelligent connected vehicles, which is applicable to large-scale, unstructured, and dynamically changing data scenarios, and can effectively protect the privacy of vehicle data in a weakly trusted environment, with good practicability and scalability.

[0078] In summary, the present application can effectively solve the problems existing in the prior art in the privacy metric of intelligent connected vehicles, such as insufficient personalization, weak processing ability for spatio-temporal dynamic characteristics, and low real-time performance, and provides a more accurate and efficient solution for privacy protection in the intelligent connected vehicle scenario.

[0079] Additional aspects and advantages of the present application will be given in part in the following description, become apparent in part from the following description, or be learned through the practice of the present application. Brief Description of the Drawings

[0080] The above and / or additional aspects and advantages of the present application will become apparent and be readily understood from the following description of the embodiments in conjunction with the drawings, where:

[0081] Figure 1Schematic flowchart of a data privacy measurement method for intelligent connected vehicles provided by an embodiment of the present application;

[0082] Figure 2 Schematic diagram of the personalized dynamic privacy measurement method provided by an embodiment of the present application;

[0083] Figure 3 Schematic diagram of the division of vehicle data privacy attributes provided by an embodiment of the present application;

[0084] Figure 4 Attribute comparison scale diagram of the analytic hierarchy process provided by an embodiment of the present application;

[0085] Figure 5 Schematic diagram of the privacy measurement method for spatio-temporally sensitive vehicle nodes provided by an embodiment of the present application;

[0086] Figure 6 Schematic diagram of the spatio-temporally sensitive personalized dynamic privacy measurement method provided by an embodiment of the present application;

[0087] Figure 7 Schematic diagram of the structure of a data privacy measurement device for intelligent connected vehicles provided by an embodiment of the present application. Detailed implementation manners

[0088] The embodiments of the present application will be described in detail below. Examples of the embodiments are shown in the accompanying drawings, where the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are intended to explain the present application, but should not be construed as limiting the present application.

[0089] In view of the fact that the measurement of vehicle data privacy in the intelligent connected vehicle scenario is affected by users' privacy preferences and the dynamic changes of vehicles, in response to this problem, the embodiments of the present application provide a data privacy measurement method for intelligent connected vehicles. Figure 1 Schematic flowchart of a data privacy measurement method for intelligent connected vehicles provided by an embodiment of the present application. As Figure 1 shown, the method includes the following steps:

[0090] Step 101, construct a personalized dynamic privacy measurement model that integrates users' privacy preferences, calculate the privacy attribute weights through the analytic hierarchy process, and correct them in combination with users' privacy preferences to generate personalized privacy weights.

[0091] The purpose of this step is to build a personalized privacy measurement model, enabling intelligent connected vehicles to dynamically adjust privacy risk measurement according to the privacy preferences of different users when processing vehicle data, thereby achieving personalized privacy protection. This step combines the Analytic Hierarchy Process (AHP) and user privacy preference correction, providing higher accuracy and flexibility for privacy measurement.

[0092] Referring to Figure 2 , first, the vehicle node defines a set of privacy attributes S = {AT 1 , AT 2 , AT 3 ,..., AT n} according to the collection task, where AT i represents the i-th sensitive attribute, and the selection of these attributes all belongs to the range of privacy attributes defined in Figure 3 , such as vehicle location, driving speed, vehicle ID, etc. By defining this set, sensitive attributes in vehicle data can be effectively divided and identified, providing a basis for privacy protection.

[0093] Next, the vehicle node performs structured processing on the collected data. To quantify the sensitivity of each privacy attribute, the embodiment of this application adopts a non-negative numerical mapping function f j , which is defined as:

[0094] f j = R + ∪ {0}, j ∈ {1, 2,..., n}.

[0095] Through this mapping function, the sensitivity of each privacy attribute is mapped to a non-negative value, where the larger the mapped value, the higher the sensitivity of the attribute. For example, the sensitivity of vehicle location data may be higher than that of vehicle speed data, and its corresponding mapped value is also larger.

[0096] After the mapping is completed, the vehicle node structures the collected data into a privacy matrix G m*n , where m represents the number of data samples and n represents the number of privacy attributes. The purpose of constructing the privacy matrix G m*n is to convert the collected vehicle data into a unified structured form, facilitating the subsequent calculation of privacy weights and the quantitative analysis of privacy risks. This matrix not only describes the sensitivity distribution of the vehicle-collected data but also provides basic data support for personalized privacy measurement.

[0097] In the personalized dynamic privacy measurement model of this application, to quantify the impact of privacy attributes on the risk of privacy leakage, this embodiment uses the Analytic Hierarchy Process to obtain the initial privacy attribute weights of privacy attributes, and then corrects the weights through user privacy preferences to generate personalized privacy weights w final with user privacy preferences. The specific steps are as follows:

[0098] First, in combination with the expert evaluation opinions, pairwise comparisons are made on the n privacy attributes of the collected data to construct a judgment matrix M n*n =[b ij n*n , where b ij represents the relative importance degree of the i-th privacy attribute relative to the j-th privacy attribute. The judgment matrix is a symmetric matrix, satisfying b ij =1 / b ji and b ii =1. Through pairwise comparison, the subjective judgment of experts on the importance degree of privacy attributes can be quantified into specific values to construct a complete judgment matrix.

[0099] Subsequently, the judgment matrix M n*n is normalized. Specifically, each column in the judgment matrix is divided by the sum of all elements in that column to obtain a normalized matrix M′ n*n . Through the normalization operation, the data in the judgment matrix becomes more unified, providing a standardized basis for subsequent weight calculation.

[0100] It should be particularly noted that in order to ensure the rationality and consistency of the judgment matrix, this embodiment conducts a consistency test on the judgment matrix. Specifically, the consistency ratio CR is calculated to measure whether the judgment matrix has satisfactory consistency:

[0101]

[0102] In the formula, λ max is the maximum eigenvalue of the judgment matrix; n is the number of privacy attributes, that is, the order of the judgment matrix; RI is the random consistency index, and its value is related to the size of n and comes from the empirical value table.

[0103] In the embodiment of the present application, the consistency ratio is controlled at CR≤0.1. If CR≤0.1, it indicates that the judgment matrix has satisfactory consistency and meets the requirements of weight calculation. Otherwise, the judgment matrix needs to be adjusted again until the consistency test passes.

[0104] Finally, for the normalized matrix M′ n*n that passes the consistency test, the elements of each row are summed and averaged to obtain the initial privacy attribute weight w of each privacy attribute. The calculated w is the initial weight of each privacy attribute, reflecting the subjective judgment of experts on the relative importance of different privacy attributes.

[0105] It should be noted that in the personalized dynamic privacy measurement model, in order to generate a personalized privacy weight w final ​, it is necessary to correct the initial privacy attribute weight w obtained by the analytic hierarchy process. In this application, the user privacy preference weight w pref is used to correct the initial privacy weight. The specific correction method is as follows:

[0106] First, the weighted formula is used to combine the initial privacy weight w and the user privacy preference weight w pref to generate the final personalized privacy weight w final . The formula is:

[0107] w final = θ 1 w + θ 2 w pref

[0108] where θ 1 and θ 2 are proportionality coefficients that respectively control the influence of the initial weight and the user privacy preference weight on the final weight. To ensure the rationality of weight correction, the proportionality coefficients need to satisfy the following constraint conditions:

[0109] θ 1 + θ 2 = 1

[0110] To further determine the proportionality coefficients θ 1 and θ 2 , this application introduces a correction function Co(w, w pref ) to quantify the difference between the initial weight w and the user privacy preference weight w pref . Its definition is as follows

[0111]

[0112] In the formula, Co(w, w pref ) represents the correction function, and its function value satisfies the normalization condition.

[0113] It can be understood that the larger the value of the correction function, the greater the difference between the initial weight w and the user privacy preference weight w pref . At this time, the influence of the initial weight dominates; on the contrary, when the value of the correction function is small, it means that the difference between the two is small, and the correction effect of the user preference weight on the final weight is stronger.

[0114] In this process, the normalization characteristic of the correction function Co(w, w pref ) ensures the scientificity and rationality of the proportionality coefficient calculation. In this way, a balance can be achieved between the objective initial weight w and the user privacy preference weight w pref .

[0115] Finally, the generated personalized privacy weight w finalIt can not only reflect the user's privacy preferences, but also maintain the rationality and scientificity of the weight distribution. When the difference between the initial weight and the user preference weight is large (i.e., the correction function value is large), the influence of user preferences on the final weight is weak, which is suitable for scenarios where the influence of user preferences on the sensitivity of privacy attributes is small. When the difference between the initial weight and the user preference weight is small (i.e., the correction function value is small), the influence of user preferences on the final weight is strong, which is more suitable for scenarios where the user's subjective privacy needs are significant.

[0116] Through the above correction process, the finally generated personalized privacy weight w final can provide more accurate data support for personalized privacy measurement and lay a foundation for the formulation of user privacy protection strategies in intelligent connected vehicles.

[0117] Step 102: Based on the personalized privacy weight, calculate the user's personalized privacy risk through weighted information entropy, and periodically update the personalized privacy risk through the sliding time window mechanism.

[0118] In the personalized dynamic privacy measurement method, the embodiment of the present application first measures the privacy risk result of the current window t. Specifically, based on the personalized privacy weight w final and the privacy matrix G, calculate the personalized privacy risk of the current window t through the weighted information entropy H p (w final , G). The formula is:

[0119]

[0120] In the formula, is the personalized privacy weight of the i-th privacy attribute, and p(x j ) is the probability distribution of the j-th sample.

[0121] In the above formula, the inner summation calculates the privacy risk value p(x j )log 2 p(x j ) of each sample, and then combines the privacy attribute weight for weighted summation to obtain the personalized privacy risk of the current time window t This calculation method can reflect both the importance of privacy attributes and the user's personalized privacy preferences, thus generating an accurate personalized privacy risk assessment result.

[0122] To dynamically measure the privacy risk at the current moment and simultaneously consider the influence of historical data on the current privacy risk, the present application further introduces a sliding time window mechanism, which divides the privacy data into time windows T of a fixed length 1 , T 2 , T3 ,..., T m-1 , T m , thus dynamically calculating the comprehensive privacy risk at the current time t. The time window slides at fixed intervals over time, and the privacy risk weight within each time window is controlled by the time decay function R d (t), and its expression is:

[0123]

[0124] where λ is the decay factor and λ ∈ [0, 1], and t k is the cut-off time of the k-th time slot.

[0125] Through this time decay function, the influence weight of historical time slots on the current privacy risk can be measured. The older the historical data, the lower its weight on the current privacy risk. In this way, the interference of data in earlier time windows on the current privacy measurement result can be effectively reduced, so as to dynamically balance the influence of real-time privacy risk and historical privacy risk.

[0126] Suppose the privacy amounts within each time slot are respectively S = {s 1 , s 2 ,..., s m}, then the total personalized privacy risk at the current time t is:

[0127]

[0128] where s k represents the privacy amount within the k-th time slot, is the time decay weight of the k-th time slot.

[0129] Through the above formula, the total personalized privacy risk amount S H (t) is the result of weighted summation of the privacy risk amounts s k of all historical time slots. The sliding time window mechanism dynamically controls the weight of the privacy risk of historical time slots by introducing the time decay function R d (t), thus ensuring the real-time nature of privacy risk measurement.

[0130] Generally speaking, this step realizes the dynamic comprehensive analysis of the current privacy risk and historical privacy risk by combining the personalized privacy risk calculation and the sliding time window mechanism. It can not only reflect the personalized privacy needs of users, but also effectively cope with the dynamic changes and real-time requirements of privacy data in intelligent connected vehicles.

[0131] Step 103: Construct a spatio-temporal sensitive dynamic privacy metric model, calculate the privacy leakage probability distribution in the time and space dimensions using the gamma distribution, generate spatio-temporal privacy risks through joint calculation, and periodically update the spatio-temporal privacy risks using a sliding time window mechanism.

[0132] It can be understood that during the interaction between a vehicle node moving at high speed and surrounding facilities, due to the dynamic changes in interaction time and communication distance, there is a risk of privacy leakage. For this reason, this application proposes a spatio-temporal sensitive dynamic privacy metric model for quantifying the privacy leakage risk from two dimensions of time and space, which can be referred to Figure 5 and Figure 6 .

[0133] First, define the following parameters:

[0134] Vehicle communication radius R: The communication range of the vehicle node;

[0135] Allowed tracking time T′: The maximum time that a user allows to be tracked;

[0136] Allowed tracking distance D′: The maximum distance that a user allows to be tracked;

[0137] Maximum time T max : The maximum traceable time specified by the system;

[0138] Maximum distance D max : The maximum traceable distance specified by the system.

[0139] Among them, the values of the allowed tracking time and distance reflect the user's subjective preference for privacy sensitivity. The larger the value, the lower the user's sensitivity to privacy.

[0140] In order to describe the privacy leakage risk in the time and space dimensions from a probabilistic perspective, the embodiments of this application respectively establish privacy leakage probability distribution models in the time dimension and the space dimension based on the gamma distribution function, and their parameter formulas are as follows:

[0141] Gamma distribution parameters in the time dimension:

[0142]

[0143] Gamma distribution parameters in the space dimension:

[0144]

[0145] Then, the above gamma distribution parameters α t , β t , α d , β dSubstitute them into the gamma distribution function respectively to obtain the privacy leakage probability distribution functions in the time dimension and the space dimension. The formula is as follows:

[0146] Privacy leakage probability distribution function in the time dimension:

[0147]

[0148] Privacy leakage probability distribution function in the space dimension:

[0149]

[0150] In the formula, f t (t, α t , β t ) is the privacy leakage probability distribution function in the time dimension, f d (d, α d , β d ) is the privacy leakage probability distribution function in the space dimension, and Γ() is the gamma function.

[0151] Assume that the initial privacy amount is 1. This application combines the privacy leakage probability distribution functions in the time dimension and the space dimension to calculate the spatio-temporal privacy risk. The formula is as follows:

[0152] L p =(1 - ∫ 0 T f t (x)dx) * (1 - ∫ 0 D f d (x)dx)

[0153] Among them, T and D are the upper limit values in the time dimension and the space dimension respectively.

[0154] Through the above formula, the spatio-temporal privacy risk L p is the joint result of the privacy leakage probability in the time dimension and the privacy leakage probability in the space dimension. The gamma distribution models in the time and space dimensions can reflect the dynamic changes of the privacy leakage probability within the time and space ranges. Combining with the user's preferences for the sensitivity of time and space privacy, the privacy risk of vehicle nodes can be evaluated more accurately.

[0155] In addition, similar to the measurement of personalized privacy risk, in order to dynamically analyze the privacy risk of spatio-temporal sensitivity, this application introduces a sliding time window mechanism to perform periodic analysis on the measurement results of spatio-temporal sensitive privacy. Through the sliding time window mechanism, the privacy risk can be dynamically updated, comprehensively considering the data within the current time window and the privacy information of historical time slots.

[0156] Specifically, the spatio-temporal sensitive privacy data is segmented into time windows T 1 , T2 , T 3 , …T m-1 , T m . The privacy risk weight within each time window is controlled by the time decay function R d (t), and its expression is:

[0157]

[0158] where λ is the decay factor and λ ∈ [0, 1], and t k is the cut-off time of the k-th time slot.

[0159] Through this time decay function, the influence weight of historical time slots on the current privacy risk can be measured. The farther back in time the historical data is, the lower its weight on the current privacy risk. In this way, the interference of data in earlier time windows on the current privacy measurement result can be effectively reduced, so as to dynamically balance the influence of real-time privacy risk and historical privacy risk.

[0160] Suppose the spatio-temporal sensitive privacy amounts in each previous time slot are respectively S = {s 1 , s 2 ,..., s m}, then the spatio-temporal sensitive privacy measurement result at the current time t is calculated by the following formula:

[0161]

[0162] where s k represents the spatio-temporal sensitive privacy amount in the k-th time slot, is the time decay weight of the k-th time slot.

[0163] Through the above formula, the total spatio-temporal sensitive privacy measurement value S L (t) at the current time t is the result of weighted summation of the privacy amounts s k in all historical time slots. The time decay function ensures that the influence of the privacy amount in earlier time windows on the current privacy risk gradually weakens, while the privacy amount in the current time window has a more significant influence on the measurement result.

[0164] Moreover, the introduction of the sliding time window mechanism in spatio-temporal sensitive privacy measurement not only improves the dynamicity and real-time nature of privacy risk measurement, but also can reasonably balance the influence of historical data through the time decay function, avoiding the interference of outdated data on the current privacy risk measurement, thereby further enhancing the effect of privacy protection.

[0165] Step 104, fuse the personalized privacy risk and the spatio-temporal privacy risk, generate a comprehensive privacy risk value through weighted average, and verify the accuracy of the risk measurement result in combination with the privacy evaluation parameters.

[0166] In the privacy measurement method of this application, the personalized privacy risk H p and the spatio-temporal privacy risk L p are two independent privacy measurement results. To generate a comprehensive privacy risk value and more comprehensively evaluate the privacy risk of vehicle nodes under personalized privacy preferences and spatio-temporal dynamic changes, this application proposes a method of fusing the two privacy risks through weighted averaging.

[0167] The calculation formula for the comprehensive privacy risk value is:

[0168] P metric = μ 1 H p + μ 2 L p

[0169] where P metric is the comprehensive privacy risk value, μ 1 , μ 2 are the weighting factors, and μ 1 , μ 2 ∈ [0, 1].

[0170] Through the above weighted average formula, the two privacy measurement strategies can be adaptively selected according to the user's privacy preferences. When the user pays more attention to personalized privacy protection, μ1 can be set to a larger value, and at this time, the weight of the personalized privacy risk Hp is higher; when the user pays more attention to spatio-temporal privacy protection, then μ 2 can be set to a larger value, so as to enhance the influence of the spatio-temporal privacy risk L p on the comprehensive privacy risk. When one of the weighting factors is zero, for example, μ 1 = 0 or μ 2 = 0, it means that the comprehensive privacy risk value is only determined by the other privacy risk value.

[0171] In addition, to verify the accuracy of the comprehensive privacy risk value P metric , this application further introduces a privacy information evaluation parameter ρ to evaluate the accuracy rate of data privacy measurement.

[0172] The calculation formula for the privacy information evaluation parameter ρ is:

[0173]

[0174] In the formula, ΔH p represents the difference from the most recent privacy measurement result, is the personalized privacy risk of the current time window t, is the personalized privacy risk of the previous time window.

[0175] In the embodiments of the present application, a controllable range ε is set, and the controllable range ε is set according to the actual scenario. If the following conditions are met:

[0176] ρ = |ΔH p | < ε

[0177] It indicates that the privacy risk measurement result of this time has sufficient accuracy and stability; conversely, if ρ exceeds ε, it indicates that the accuracy of the privacy risk measurement result may be insufficient, and it is necessary to further verify and adjust the privacy risk calculation process.

[0178] To further verify the accuracy of the spatio-temporal perception privacy measurement result, the present application proposes to use the Kullback-Leibler divergence (referred to as the K-L divergence) to measure the distance between the time and space privacy measurement results. The K-L divergence is a classic method for measuring the difference or distance between two probability distributions. By analyzing the probability distribution f of privacy leakage in the time dimension and the probability distribution f of privacy leakage in the space dimension d between them, the rationality and accuracy of the spatio-temporal perception privacy measurement result can be evaluated.

[0179] The calculation formula of the K-L divergence is as follows:

[0180]

[0181] In the formula, D KL (f t ||f d ) represents the K-L divergence between the probability distribution f of privacy leakage in the time dimension and the probability distribution f of privacy leakage in the space dimension; f t and the probability distribution f of privacy leakage in the space dimension d ; f t (i) and f d (i) are the privacy leakage distribution functions in time and space respectively; i is the discrete point of the privacy leakage probability in the distribution.

[0182] By calculating the K-L divergence between the distribution f in the time dimension t and the distribution f in the space dimension d , the difference between the two privacy measurement results can be quantitatively evaluated, thereby ensuring the accuracy and reliability of the spatio-temporal perception privacy measurement result. At the same time, when the value of the K-L divergence is small, it can be considered that the privacy leakage risk measurements in the time and space dimensions have high consistency and complementarity, which provides a more reliable basis for the calculation of the comprehensive privacy risk.

[0183] To implement the above embodiments, the present application also proposes a data privacy measurement device for intelligent connected vehicles. Figure 7 It is a schematic structural diagram of a data privacy measurement device for intelligent connected vehicles provided by the embodiments of the present application. As Figure 7As shown, the device includes:

[0184] A personalized privacy weight generation module 100, which is used to construct a personalized dynamic privacy measurement model integrating user privacy preferences, calculate privacy attribute weights through the analytic hierarchy process and correct them in combination with user privacy preferences to generate personalized privacy weights;

[0185] A personalized privacy risk generation and update module 200, which is used to calculate the user's personalized privacy risk based on the personalized privacy weights through weighted information entropy, and periodically update the personalized privacy risk through a sliding time window mechanism;

[0186] A spatio-temporal sensitive dynamic privacy measurement module 300, which is used to construct a spatio-temporal sensitive dynamic privacy measurement model, calculate the privacy leakage probability distribution in the time and space dimensions using the gamma distribution, generate spatio-temporal privacy risks through joint calculation, and periodically update the spatio-temporal privacy risks through a sliding time window mechanism;

[0187] A comprehensive privacy risk generation and verification module 400, which is used to fuse the personalized privacy risk and the spatio-temporal privacy risk, generate a comprehensive privacy risk value through weighted average, and verify the accuracy of the risk measurement result in combination with privacy evaluation parameters.

[0188] To implement the above embodiments, the present application also proposes an electronic device, including: a processor, and a memory communicatively connected to the processor; the memory stores computer-executable instructions; the processor executes the computer-executable instructions stored in the memory to implement the method provided in the foregoing embodiments.

[0189] To implement the above embodiments, the present application also proposes a computer-readable storage medium storing computer-executable instructions, and when the computer-executable instructions are executed by a processor, they are used to implement the method provided in the foregoing embodiments.

[0190] To implement the above embodiments, the present application also proposes a computer program product including a computer program, and when the computer program is executed by a processor, it implements the method provided in the foregoing embodiments.

[0191] The collection, storage, use, processing, transmission, provision, and disclosure of the user's personal information involved in the present application and other processes all comply with the provisions of relevant laws and regulations and do not violate public order and good customs.

[0192] It should be noted that personal information from users should be collected for legal and reasonable purposes and should not be shared or sold outside of such legal uses. Additionally, such collection / sharing should be carried out after obtaining the informed consent of the users, including but not limited to notifying the users to read the user agreement / user notice and sign an agreement / authorization covering the authorization of relevant user information before the users use the function. Moreover, any necessary steps should be taken to safeguard and protect access to such personal information data and ensure that others with access to the personal information data comply with their privacy policies and procedures.

[0193] This application is expected to provide embodiments where users can selectively block the use or access to personal information data. That is, the present disclosure is expected to provide hardware and / or software to prevent or block access to such personal information data. Once the personal information data is no longer needed, the risks can be minimized by restricting data collection and deleting the data. Additionally, when applicable, personal identifiers are removed from such personal information to protect the privacy of the users.

[0194] In the description of the foregoing embodiments, the descriptions referring to terms such as "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. mean that the specific features, structures, materials, or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials, or characteristics described can be combined in a suitable manner in any one or more embodiments or examples. Additionally, without contradiction, those skilled in the art can combine and combine the different embodiments or examples described in this specification and the features of different embodiments or examples.

[0195] Furthermore, the terms "first" and "second" are only used for descriptive purposes and cannot be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, the features defined with "first" and "second" can explicitly or implicitly include at least one of such features. In the description of the present application, "a plurality" means at least two, such as two, three, etc., unless otherwise specifically and clearly defined.

[0196] Any process or method description shown in a flowchart or described in other ways herein can be understood as representing a module, segment, or part of code including one or more executable instructions for implementing a customized logical function or process, and the scope of the preferred embodiments of the present application includes additional implementations where the functions can be executed not in the order shown or discussed, including in a substantially simultaneous manner according to the involved functions or in a reverse order, which should be understood by those skilled in the art to which the embodiments of the present application pertain.

[0197] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a definable sequence list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other systems that can fetch instructions from the instruction execution system, apparatus, or device and execute the instructions), or used in combination with these instruction execution systems, apparatus, or devices. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transmit a program for use by an instruction execution system, apparatus, or device or in combination with these instruction execution systems, apparatus, or devices. More specific examples (non-exhaustive list) of computer-readable media include the following: electrical connection parts with one or more wirings (electronic devices), portable computer disk cartridges (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber devices, and portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other media, followed by editing, interpretation, or other suitable processing when necessary, and then stored in a computer memory.

[0198] It should be understood that various parts of the present application can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one or a combination of the following techniques well known in the art can be used: discrete logic circuits having logic gate circuits for implementing logical functions on data signals, application-specific integrated circuits having suitable combinational logic gate circuits, programmable gate arrays (PGA), field-programmable gate arrays (FPGA), etc.

[0199] Those of ordinary skill in the art of this technology can understand that all or part of the steps carried by the methods of the above-described embodiments can be completed by instructing relevant hardware through a program, and the program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.

[0200] In addition, each functional unit in various embodiments of the present application may be integrated into a processing module, or each unit may exist physically alone, or two or more units may be integrated into one module. The above-mentioned integrated module may be implemented in the form of hardware or in the form of a software functional module. When the integrated module is implemented in the form of a software functional module and sold or used as an independent product, it may also be stored in a computer-readable storage medium.

[0201] The above-mentioned storage medium may be a read-only memory, a magnetic disk or an optical disc, etc. Although the embodiments of the present application have been shown and described above, it can be understood that the above embodiments are exemplary and should not be construed as limiting the present application. Those of ordinary skill in the art can make changes, modifications, substitutions and variations to the above embodiments within the scope of the present application.

[0202] It should be understood that various forms of the processes shown above can be used, steps can be reordered, added or deleted. For example, the steps described in the present application can be executed in parallel, sequentially or in a different order, as long as the desired results of the technical solution of the present application can be achieved, and no limitation is imposed herein.

[0203] The above specific implementation manners do not constitute a limitation on the protection scope of the present application. Those skilled in the art should understand that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions and improvements made within the spirit and principle of the present application shall be included within the protection scope of the present application.

Claims

1. A data privacy measurement method for intelligent connected vehicles, characterized in that: The following steps are involved: A personalized dynamic privacy measurement model integrating user privacy preferences is constructed. The privacy attribute weights are calculated by analytic hierarchy process and modified in combination with user privacy preferences to generate personalized privacy weights. Based on the personalized privacy weight, the personalized privacy risk of the user is calculated by weighted information entropy, and the personalized privacy risk is periodically updated by a sliding time window mechanism; Construct a dynamic privacy measurement model that is sensitive to time and space, use the gamma distribution to calculate the probability distribution of privacy leakage in the time and space dimensions, generate the time and space privacy risks through joint calculation, and use the sliding time window mechanism to periodically update the time and space privacy risks; The personalized privacy risk and the spatiotemporal privacy risk are integrated to generate a comprehensive privacy risk value through weighted average, and the accuracy of the risk measurement result is verified in combination with the privacy assessment parameters.

2. The method according to claim 1, characterized in that The personalized dynamic privacy measurement model integrating user privacy preferences is constructed, and the privacy attribute weights are calculated by the hierarchical analysis method and corrected in combination with the user privacy preferences to generate personalized privacy weights, including: The vehicle node defines a privacy attribute set S = {AT1, AT2, AT3, …, AT n }, using non-negative numerical mapping function to structure the collected data into a privacy matrix G m*n , where m is the number of samples and n is the number of privacy attributes; Combined with the expert evaluation opinions, the n privacy attributes of the collected data are compared pairwise to construct the judgment matrix M n*n =[b ij ] n*n , where b ij Indicates the relative importance of the i-th privacy attribute to the j-th privacy attribute; Divide each column in the judgment matrix by the sum of all elements in the column to obtain a normalized matrix M' n*n , and perform consistency check on the judgment matrix to ensure that its consistency ratio CR≤0.1, where: In the formula, λ max is the maximum eigenvalue of the judgment matrix, n is the number of privacy attributes, and RI is the random consistency index; For the normalized matrix M′ that meets the conditions n*n Sum and average the elements of each row of to obtain the initial privacy attribute weight w of each privacy attribute; By user privacy preference weight W pref The initial privacy attribute weight w is modified to obtain a personalized privacy weight w with the user's privacy preference final , the formula is: w final =θ1w+θ2w pref ,θ1+θ2=1 In the formula, Co(w,w pref ) represents the correction function, whose function value satisfies the normalization condition; θ1 and θ2 are proportional coefficients.

3. The method according to claim 2, characterized in that The method of calculating the user's personalized privacy risk based on the personalized privacy weight by weighted information entropy, and periodically updating the personalized privacy risk by a sliding time window mechanism includes: Based on the personalized privacy weight and privacy matrix, the weighted information entropy H p (w final ,G) Calculate the personalized privacy risk of the current window t The formula is: In the formula, is the personalized privacy weight of the ith privacy attribute, p(x j ) is the probability distribution of the jth sample; The sliding time window mechanism is used to divide the private data into time windows of fixed lengths T1, T2, T3, ...T m-1 ,T m , and the privacy risk weight in each time window is controlled by the time decay function, which is expressed as: If the privacy amount in each time slot is S = {s 1 ,s 2 ,…,s m }, then the total personalized privacy risk at time t is: Where λ is the attenuation factor, t k is the deadline of the kth time slot, s k represents the privacy amount in the kth time slot.

4. The method according to claim 3, characterized in that The constructed time-space sensitive dynamic privacy measurement model uses the gamma distribution to calculate the privacy leakage probability distribution in the time and space dimensions, and generates the time-space privacy risk through joint calculation, including: Define vehicle communication radius R, allowed tracking time T′, allowed tracking distance D′, maximum time T max and the maximum distance D max ; Based on the gamma distribution function, the privacy leakage of user location privacy in the time dimension and space dimension is described from a probability perspective. The gamma distribution parameter formulas of the time dimension and space dimension are: The above distribution parameter β t , β t , α d , β d Substitute them into the gamma distribution function respectively to obtain the privacy leakage probability distribution function of the time dimension and the space dimension. The formula is: In the formula, f t (t,α t ,β t ) is the privacy leakage probability distribution function in the time dimension, f d (d,α d ,β d ) is the privacy leakage probability distribution function in the spatial dimension; Combining the privacy leakage probability distribution functions of the time dimension and the space dimension, the spatiotemporal privacy risk is calculated, and the formula is: Among them, T and D are the upper limits of the time dimension and space dimension respectively.

5. The method according to claim 4, characterized in that The integrating the personalized privacy risk and the spatiotemporal privacy risk to generate a comprehensive privacy risk value by weighted average includes: The personalized privacy risk H is integrated by weighted average p and spatiotemporal privacy risk L p , the calculation formula of the comprehensive privacy risk value is: P metric =μ1H p +μ2L p Among them, P metric is the comprehensive privacy risk value, μ1,μ2 are weighting factors, and μ1,μ2∈[0,1].

6. The method according to claim 5, characterized in that Verifying the accuracy of the risk measurement results by combining the privacy assessment parameters includes: The privacy information evaluation parameter ρ is introduced to evaluate the accuracy of data privacy measurement, ΔH p It represents the difference between the last privacy measurement result and the last privacy measurement result. The accuracy of the privacy measurement result is guaranteed by stipulating that the difference between the two is within the controllable range of ε. The calculation formula is: Combining the KL divergence of temporal and spatial privacy leakage distributions, the difference or distance between the two probability distributions is calculated, and the formula is: In the formula, f t (i) and f d (i) Temporal and spatial privacy leakage distribution functions, respectively.

7. A data privacy measurement device for intelligent connected vehicles, characterized in that: include: The personalized privacy weight generation module is used to build a personalized dynamic privacy measurement model that integrates user privacy preferences. The privacy attribute weights are calculated through the hierarchical analysis method and modified in combination with user privacy preferences to generate personalized privacy weights. A personalized privacy risk generation and update module, used to calculate the personalized privacy risk of the user through weighted information entropy based on the personalized privacy weight, and periodically update the personalized privacy risk through a sliding time window mechanism; The spatiotemporal sensitive dynamic privacy measurement module is used to build a spatiotemporal sensitive dynamic privacy measurement model, calculate the privacy leakage probability distribution in the time and space dimensions using the gamma distribution, generate spatiotemporal privacy risks through joint calculation, and periodically update the spatiotemporal privacy risks using the sliding time window mechanism; The comprehensive privacy risk generation and verification module is used to integrate the personalized privacy risk and the spatiotemporal privacy risk, generate a comprehensive privacy risk value by weighted average, and verify the accuracy of the risk measurement result in combination with the privacy assessment parameters.

8. An electronic device, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-executable instructions, which are used to implement the method according to any one of claims 1 to 6 when executed by a processor.

10. A computer program product, characterized in that The invention comprises a computer program, which implements the method according to any one of claims 1 to 6 when being executed by a processor.

Images