Market regulation data asset management method and system based on compliance and privacy protection

Abstract

The application discloses a market supervision data asset management method and system based on compliance and privacy protection, and relates to the technical field of data asset management.According to the application, a privacy compliance strategy is generated according to a metadata label, and is encapsulated as a data capsule to realize the binding of data and the compliance strategy; a privacy compliance knowledge graph is constructed, and semantic matching and compliance verification are performed in combination with a large language model to improve the semantic consistency and matching degree between the privacy compliance strategy and the supervision regulations and reduce manual intervention; a privacy protection processing mechanism is called according to the compliance verification result, appropriate data protection technology is dynamically applied, and the data leakage risk is reduced; before data is released to the outside, anonymization processing parameters are optimized, data distortion processing is implemented, the privacy leakage risk is effectively controlled on the premise of guaranteeing the data availability; a data asset value dynamic evaluation model is constructed to evaluate the comprehensive value and risk level of data and support fine and differentiated management of data assets.

Description

Technical Field

[0001] This invention relates to the field of data asset management technology, specifically to a method and system for managing market regulatory data assets based on compliance and privacy protection. Background Technology

[0002] With the acceleration of digital governance, the market supervision field has gradually accumulated a large amount of heterogeneous and multi-source data resources. These data resources are of great value in serving regulatory decision-making, assisting in risk early warning, and promoting the improvement of governance effectiveness. However, regulatory data often involves sensitive information such as business operations, individual behavior, and others. How to achieve efficient use of data while ensuring data security and protecting personal privacy has become an important issue that urgently needs to be addressed.

[0003] Current technologies for managing regulatory data primarily focus on static classification, grading, and access control, lacking dynamic data governance methods that adapt to complex regulatory scenarios. Meanwhile, increasingly stringent privacy compliance requirements and differences in laws and regulations across countries and regions pose significant compliance risks to cross-domain data use and sharing. Furthermore, the inherent tension between privacy protection and data availability, coupled with a lack of a unified mechanism for coordinating and optimizing these two aspects, often hinders the effective realization of data value.

[0004] On the other hand, although data asset management has become a trend, the data asset valuation mechanism in the regulatory field is still imperfect, lacking the comprehensive judgment ability on data quality, risk level, and use scenarios. This not only affects the scientific allocation of data resources but also restricts the development of data-driven intelligent regulatory methods. Therefore, there is an urgent need for a data asset management method that can balance privacy protection, compliance requirements, and data value realization to support the modernization of the market regulatory system. Summary of the Invention

[0005] To address the above issues, this invention proposes a market supervision data asset management method and system based on compliance and privacy protection, aiming to achieve efficient management and value utilization of heterogeneous data resources in the market supervision field while meeting privacy protection and compliance requirements.

[0006] The present invention achieves the above objectives through the following technical solutions:

[0007] A market regulatory data asset management method based on compliance and privacy protection, the method comprising:

[0008] Collect, clean, and abstract the heterogeneous data resources of the regulated objects to form data assets with metadata tags;

[0009] A privacy compliance policy is generated based on the metadata tags, and the privacy compliance policy and data assets are encapsulated into a data capsule;

[0010] Construct a privacy compliance knowledge graph and use a large language model to achieve semantic matching and compliance verification between the privacy compliance strategy within the data capsule and the privacy compliance knowledge graph;

[0011] Based on the compliance verification results, at least one privacy protection mechanism is invoked to perform compliance processing on the data assets. The privacy protection mechanism includes differential privacy perturbation mechanism, homomorphic encryption, and secure multi-party computation.

[0012] Before the data is released to the public, the anonymization parameters are determined through optimized calculations, and data distortion is processed.

[0013] Build a dynamic assessment model for data asset value to evaluate the comprehensive value and risk level of data assets in real time, so as to guide the differentiated management of data assets.

[0014] As a preferred embodiment of the present invention, the metadata tags of the data assets include at least data ownership, sensitivity level, processing method, scope of use, integrity, update frequency, accuracy, and relevance.

[0015] As a preferred embodiment of the present invention, the encapsulation of the data capsule includes: binding and storing data asset content, privacy compliance policies and data processing context information in a unified structure, and using a machine-readable formal policy language within the data capsule to achieve consistent management and automatic execution of privacy compliance policies and the data asset lifecycle;

[0016] The privacy compliance strategy is optimized through a feedback reinforcement learning algorithm, including:

[0017] Build a mapping library between historical privacy compliance policies and compliance verification results;

[0018] Define the policy optimization reward function R(π) as follows:

[0019] R(π)=α·C(π,R)+β·P(π,D)-γ·L(π,V);

[0020] In the formula, C(π,R) represents the matching score between strategy π and regulatory requirement R, P(π,D) represents the data protection effect index after the implementation of the strategy, L(π,V) represents the data value loss caused by the strategy; α, β, and γ are weight coefficients, and satisfy α+β+γ=1;

[0021] Based on the aforementioned strategy, the reward function is optimized, and the strategy version is further optimized using the strategy gradient or Q-learning method to improve the regulatory compliance and data usability of the privacy compliance strategy.

[0022] As a preferred embodiment of the present invention, the method for constructing a privacy-compliant knowledge graph includes:

[0023] Collect laws, regulations, policies and industry standards related to privacy protection, and construct a privacy compliance knowledge graph with legal provisions, terminology and logical relationships as nodes and edges;

[0024] A graph embedding algorithm is used to generate low-dimensional semantic feature vectors for knowledge graph nodes;

[0025] The knowledge graph content is updated automatically on a regular basis to reflect the latest regulatory changes and the update history is recorded to provide audit backtracking support.

[0026] As a preferred embodiment of the present invention, the method for implementing semantic matching and compliance verification includes:

[0027] A retrieval-enhanced generation mechanism is employed, and a large language model is invoked to perform semantic parsing on the privacy compliance policy clauses in the data capsule, extracting key semantic features.

[0028] Based on the aforementioned key semantic features, relevant legal clause nodes are retrieved from the privacy compliance knowledge graph;

[0029] The retrieved regulatory clause nodes and privacy compliance policy clauses are represented as low-dimensional semantic vectors using graph embedding algorithms, and the semantic matching degree between policy clauses and regulatory nodes is quantified by similarity calculation methods.

[0030] Based on the quantitative results of the semantic matching degree, output the compliance matching score of each privacy compliance policy clause, and automatically identify policy clauses that are inconsistent with or insufficiently covered by current regulations.

[0031] For policy clauses that do not comply, the system generates correction suggestions based on the semantics of the regulatory clauses and provides data inputs for policy optimization learning.

[0032] As a preferred embodiment of the present invention, the differential privacy perturbation mechanism is applicable to a multi-layered data processing network architecture, which includes edge devices, intermediate nodes and a central server.

[0033] The differential privacy perturbation mechanism is based on the trust model of each node in the multi-layer network. It constructs and executes a differential privacy injection optimization model to dynamically determine the injection level and injection method of differential privacy noise, so as to optimize the model training performance while satisfying the privacy budget constraint. Specifically, it includes:

[0034] 1) Obtain network structure parameters, including the number of layers in the processing system, the set of nodes in each layer, and their connection relationships;

[0035] 2) Establish a node trust model, evaluate the trustworthiness of intermediate nodes, and generate trust labels or trust probability values ​​for each node to distinguish differential privacy processing paths.

[0036] 3) Set differential privacy budget parameters, including the overall privacy budget (∈,δ) and the upper limit of budget allocation for each training round;

[0037] 4) Construct a joint optimization objective function, with model training error, privacy risk, and resource cost as the optimization objectives, expressed as:

[0038]

[0039] In the formula, l t For noise injection levels, σ t Noise intensity; L model R represents the upper bound of the model training error. privacy Indicates the cumulative privacy budget consumption, C resource λ1, λ2, and λ3 represent the cost of communication and computing resources; λ1, λ2, and λ3 are weighting coefficients.

[0040] 5) Set optimization variables and constraints. Optimization variables include noise injection level, noise intensity, and the proportion of participating devices; constraints include privacy budget limits, system resource limits, and the effectiveness requirements of differential privacy mechanisms.

[0041] 6) Solve the above model using reinforcement learning, dynamic programming or gradient-based optimization algorithms to generate a differential privacy injection strategy and determine the injection nodes and corresponding noise intensity parameters for each training round.

[0042] 7) Implement the injection strategy, which includes: injecting calibration noise into trusted intermediate nodes, pre-injecting protective noise into child nodes in untrusted paths, and dynamically adjusting to meet the optimal synergy between privacy protection and model performance;

[0043] The differential privacy perturbation parameter is dynamically adjusted based on the current privacy risk level and policy implementation effectiveness using an adaptive algorithm, as shown in the formula:

[0044]

[0045] In the formula, ∈ t For the real-time adjusted differential privacy budget, ∈0 is the baseline budget value, R t θ represents the current estimated risk of privacy breach, η represents the set risk threshold, and η represents the adjustment coefficient.

[0046] As a preferred embodiment of the present invention, the method for determining the anonymization processing parameters through optimization calculation includes:

[0047] Construct a convex optimization model for data distortion that quantifies privacy leakage risks using mutual information, expressed as:

[0048] min I(S;Y),stD(X,Y)≤δ;

[0049] In the formula, I(S;Y) represents the mutual information between sensitive data S and published data Y, which is used to quantify the risk of privacy leakage when the data is published; D(X,Y) is the degree of data distortion between the original data X and the published data Y, and δ is the preset data distortion constraint threshold.

[0050] The data distortion convex optimization model is solved by a convex optimization algorithm, which automatically determines the optimal anonymization parameters for privacy protection while meeting data availability requirements.

[0051] As a preferred embodiment of the present invention, the data asset value dynamic evaluation model is constructed based on a reinforcement learning algorithm, using the integrity, accuracy, update frequency, relevance and risk level of the data asset as state space inputs, to predict the current comprehensive value score and future value trend of the data asset.

[0052] The reinforcement learning algorithm uses value prediction error and risk assessment as a joint reward function. Through continuous training, it optimizes the accuracy of value assessment and enables dynamic management support for different data assets under different regulatory scenarios.

[0053] As a preferred embodiment of the present invention, the method further includes: when data assets are processed to generate derived data, automatically generating a residual privacy policy applicable to the derived data based on static analysis and causal inference mechanisms, and binding and storing the residual privacy policy with the derived data to achieve the continuation and tracking management of privacy compliance policies during data use, specifically including:

[0054] Establish a directed graph model of the data processing process to clarify the impact path of each processing stage on privacy attributes;

[0055] Static analysis was used to determine the impact of data processing steps on the original privacy compliance strategy, and causal inference analysis was used to clarify the policy constraints applicable to derived data.

[0056] The generated residual privacy policy is stored in the form of metadata bound to the derived data;

[0057] Based on the results of compliance verification and value assessment, a reinforcement learning algorithm is used to dynamically optimize the privacy compliance strategy.

[0058] The entire process of data processing and strategy optimization is audited and logged. Unalterable storage technology is used to ensure the security of audit data, and full-process audit tracking and backtracking analysis functions are provided.

[0059] A market regulatory data asset management system based on compliance and privacy protection, applied to the market regulatory data asset management method based on compliance and privacy protection as described above, wherein the system includes:

[0060] The data asset modeling module is used to collect, clean, and abstract the heterogeneous data resources of the regulated objects to form data assets with metadata tags;

[0061] The data capsule generation module is used to generate a privacy compliance policy based on metadata tags and encapsulate the privacy compliance policy and data assets into a data capsule.

[0062] The knowledge graph and semantic matching module is used to construct a privacy compliance knowledge graph and to use a large language model to perform semantic matching and compliance verification between privacy compliance strategies within the data capsule and the privacy compliance knowledge graph.

[0063] The privacy protection processing module is used to invoke the privacy protection processing mechanism to perform compliant processing on data assets based on the compliance verification results;

[0064] The anonymization and publishing module is used to determine the anonymization parameters through optimization calculations and to implement data distortion processing before the data is published to the public.

[0065] The value assessment module is used to build a dynamic value assessment model for data assets and to assess the comprehensive value and risk level of data assets in real time.

[0066] The management decision-making module is used to implement differentiated management strategies for data assets based on the evaluation results;

[0067] The audit trail module is used to optimize and adjust privacy compliance strategies, record audit logs, and provide full-process audit trail and retrospective analysis.

[0068] The beneficial effects of this invention are as follows: By collecting, cleaning, and abstracting heterogeneous data resources, data assets with metadata tags are formed, enabling structured and standardized processing of heterogeneous data of regulated objects, improving the identifiability, manageability, and traceability of data assets, and laying the foundation for subsequent compliance strategy generation and processing; privacy compliance strategies are generated based on metadata tags and encapsulated as data capsules, achieving data-compliance strategy binding, ensuring privacy protection requirements throughout the data lifecycle, and enhancing the compliance and controllability of data use; by constructing a privacy compliance knowledge graph and combining it with a large language model for semantic matching and compliance verification, the linguistic relationship between privacy compliance strategies and regulatory regulations is improved. To ensure consistency and matching of data, improve the intelligence and automation of compliance audits and reduce manual intervention; invoke privacy protection mechanisms based on compliance verification results to ensure that data processing complies with privacy regulations, dynamically apply appropriate data protection technologies, and reduce the risk of data leakage; optimize anonymization parameters and implement data distortion processing before data is released externally, effectively controlling the risk of privacy leakage while ensuring data availability, and achieving security and compliance in external data release; construct a dynamic data asset value assessment model to evaluate the comprehensive value and risk level of data, support refined and differentiated management of data assets, and achieve value-driven compliant operation and strategy optimization. Attached Figure Description

[0069] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0070] in:

[0071] Figure 1 This is a flowchart of the method of the present invention;

[0072] Figure 2 This is a schematic diagram of the modular structure of the system of the present invention. Detailed Implementation

[0073] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the described embodiments of the present invention are within the scope of protection of the present invention.

[0074] like Figure 1As shown, this is an embodiment of the present invention, which provides a market regulatory data asset management method based on compliance and privacy protection, including the following:

[0075] S1: Collect, clean, and abstract the heterogeneous data resources of the regulated objects to form data assets with metadata tags.

[0076] Data collected from regulated objects from different sources needs to be cleaned to remove erroneous or duplicate information, then a unified model needs to be established, and tags describing their attributes (metadata tags) need to be added. The metadata tags of data assets should include at least the following information:

[0077] Data ownership: The owner or source of the data;

[0078] Sensitivity level: The degree of sensitivity of the data, such as public, internal, confidential, etc.;

[0079] Processing methods: How should the data be processed, such as encryption, anonymization, etc.?

[0080] Scope of application: In which purposes or fields can the data be used?

[0081] Completeness: Is the data complete, and are there any missing data?

[0082] Update frequency: The period in which data is updated, such as daily, weekly, etc.;

[0083] Accuracy: The degree of accuracy of the data;

[0084] Relevance: The degree to which data is related to a specific task or domain.

[0085] S2: Generate a privacy compliance policy based on metadata tags, and encapsulate the privacy compliance policy and data assets into a data capsule.

[0086] During the encapsulation process of the data capsule, the data asset content, privacy compliance policy and data processing context information are bound and stored in a unified structure, and a machine-readable formal policy language is used within the data capsule to achieve consistent management and automatic execution of privacy compliance policy and data asset lifecycle.

[0087] Privacy compliance strategies are optimized through feedback reinforcement learning algorithms, including:

[0088] Build a mapping library between historical privacy compliance policies and compliance verification results, recording past privacy compliance policies and their corresponding compliance verification results;

[0089] Define a strategy optimization reward function R(π), which comprehensively considers the matching degree between the strategy and regulatory requirements, the data protection effect after the strategy is implemented, and the data value loss caused by the strategy. The expression is:

[0090] R(π)=α·C(π,R)+β·P(π,D)-γ·L(π,V);

[0091] In the formula, C(π,R) represents the matching score between strategy π and regulatory requirement R, P(π,D) represents the data protection effect index after the implementation of the strategy, L(π,V) represents the data value loss caused by the strategy; α, β, and γ are weight coefficients, and satisfy α+β+γ=1;

[0092] Based on the policy optimization reward function, the policy version is optimized using policy gradient or Q-learning methods to improve the regulatory compliance and data usability of privacy compliance policies.

[0093] S3: Construct a privacy compliance knowledge graph and use a large language model to achieve semantic matching and compliance verification between the privacy compliance strategy within the data capsule and the privacy compliance knowledge graph.

[0094] In one embodiment, the method for constructing a privacy compliance knowledge graph includes:

[0095] Collect laws, regulations, policies and industry standards related to privacy protection, and construct a privacy compliance knowledge graph with legal provisions, terminology and logical relationships as nodes and edges;

[0096] A graph embedding algorithm is used to generate low-dimensional semantic feature vectors for knowledge graph nodes, which is easier for computers to process.

[0097] The knowledge graph content is updated automatically on a regular basis to reflect the latest regulatory changes and the update history is recorded to provide audit backtracking support.

[0098] The implementation methods for semantic matching and compliance verification include:

[0099] A retrieval-enhanced generation mechanism is adopted, and a large language model is invoked to perform semantic parsing on the privacy compliance policy clauses in the data capsule, extracting key semantic features (which can reflect the intent, scope of application, target, operational restrictions and obligations of the privacy compliance policy clauses, etc.).

[0100] For example, the privacy compliance policy stipulates that users' location information should only be used for navigation services after obtaining their explicit consent, and should not be stored for more than 24 hours.

[0101] The key semantic features extracted after semantic parsing may include:

[0102] Data type: Location information;

[0103] Operational actions: collecting, using, and saving;

[0104] Prerequisite: Express consent;

[0105] Usage limitation: Navigation service;

[0106] Time limit: No more than 24 hours;

[0107] Restriction clause: It may not be used for other purposes.

[0108] Based on key semantic features, relevant legal clause nodes (such as "processing of personal information requires authorization" and "location data is sensitive information") are retrieved in the privacy compliance knowledge graph;

[0109] The retrieved regulatory clause nodes and privacy compliance policy clauses are represented as low-dimensional semantic vectors using graph embedding algorithms. The semantic matching degree between policy clauses and regulatory nodes is quantified by similarity calculation methods (such as cosine similarity).

[0110] Based on the quantitative results of semantic matching, the compliance matching score of each privacy compliance policy clause is output, and policy clauses that are inconsistent with or insufficiently covered by current regulations are automatically identified.

[0111] For policy clauses that do not comply, the system generates correction suggestions based on the semantics of the regulatory clauses and provides data inputs for policy optimization learning.

[0112] S4: Based on the compliance verification results, invoke at least one privacy protection mechanism (differential privacy perturbation mechanism, homomorphic encryption, secure multi-party computation, etc.) to perform compliance processing on data assets.

[0113] Differential privacy perturbation: This prevents individual information from being identified by adding random noise to the data. For example, when analyzing the age distribution of users, a tiny random value is added to each age data point to ensure that the specific age cannot be determined.

[0114] Among them, the differential privacy perturbation mechanism is applicable to a multi-layered data processing network architecture, which includes edge devices, intermediate nodes and central servers;

[0115] The differential privacy perturbation mechanism is based on the trust model of each node in a multi-layer network. It constructs and executes a differential privacy injection optimization model to dynamically determine the injection level and method of differential privacy noise, thereby optimizing model training performance while satisfying privacy budget constraints. Specifically, this includes:

[0116] 1) Obtain network structure parameters, including the number of layers in the processing system, the set of nodes in each layer, and their connection relationships;

[0117] 2) Establish a node trust model, evaluate the trustworthiness of intermediate nodes, and generate trust labels or trust probability values ​​for each node to distinguish differential privacy processing paths.

[0118] 3) Set differential privacy budget parameters, including the overall privacy budget (∈,δ) and the upper limit of budget allocation for each training round;

[0119] 4) Construct a joint optimization objective function, with model training error, privacy risk, and resource cost as the optimization objectives, expressed as:

[0120]

[0121] In the formula, l t For noise injection levels, σ t Noise intensity; L model R represents the upper bound of the model training error. privacy Indicates the cumulative privacy budget consumption, C resource λ1, λ2, and λ3 represent the cost of communication and computing resources; λ1, λ2, and λ3 are weighting coefficients.

[0122] 5) Set optimization variables and constraints. Optimization variables include noise injection level, noise intensity, and the proportion of participating devices; constraints include privacy budget limits, system resource limits, and the effectiveness requirements of differential privacy mechanisms.

[0123] 6) Solve the above model using reinforcement learning, dynamic programming or gradient-based optimization algorithms to generate a differential privacy injection strategy and determine the injection nodes and corresponding noise intensity parameters for each training round.

[0124] 7) Implement the injection strategy, which includes: injecting calibration noise into trusted intermediate nodes, pre-injecting protective noise into child nodes in untrusted paths, and dynamically adjusting to meet the optimal synergy between privacy protection and model performance;

[0125] The differential privacy perturbation parameter is dynamically adjusted based on the current privacy risk level and policy implementation effectiveness using an adaptive algorithm, as shown in the formula:

[0126]

[0127] In the formula, ∈ t For the real-time adjusted differential privacy budget, ∈0 is the baseline budget value, R t Here, θ represents the currently estimated risk value of privacy breach, η represents the set risk threshold, and η represents the adjustment coefficient.

[0128] This mechanism achieves the goal of minimizing model performance loss and system resource consumption while ensuring privacy compliance by jointly optimizing differential privacy configuration and training performance.

[0129] Homomorphic encryption allows computations to be performed on data while it is encrypted, ensuring that the data remains encrypted throughout the processing. Example: Summing encrypted financial data yields a result that is also encrypted, and only authorized parties can decrypt and view it.

[0130] Secure multi-party computation: Multiple parties collaborate to complete a computational task without disclosing their individual data. Example: Multiple hospitals jointly calculate the total number of patients with a certain disease, but do not share their individual patient lists.

[0131] S5: Before the data is released to the public, the anonymization parameters are determined through optimization calculations, and data distortion is processed.

[0132] Specifically, methods for determining anonymization parameters through optimized calculations include:

[0133] Construct a convex optimization model for data distortion that quantifies privacy leakage risks using mutual information, expressed as:

[0134]

[0135] In the formula, I(S;Y) represents the mutual information between sensitive data S and published data Y, which is used to quantify the risk of privacy leakage when the data is published; D(X,Y) is the degree of data distortion between the original data X and the published data Y, and δ is the preset data distortion constraint threshold.

[0136] The data distortion convex optimization model is solved by a convex optimization algorithm, which automatically determines the optimal anonymization parameters for privacy protection while meeting data availability requirements.

[0137] S6: Construct a dynamic assessment model for data asset value to evaluate the comprehensive value and risk level of data assets in real time, so as to guide the differentiated management of data assets.

[0138] Furthermore, the dynamic valuation model for data assets is built based on reinforcement learning algorithms. It uses the completeness, accuracy, update frequency, relevance, and risk level of data assets as inputs to the state space to predict the current comprehensive value score and future value trend of data assets.

[0139] The reinforcement learning algorithm uses value prediction error and risk assessment as a joint reward function. Through continuous training, it optimizes the accuracy of value assessment and enables dynamic management support for different data assets under different regulatory scenarios.

[0140] In a preferred embodiment of the method of the present invention, the following is also included:

[0141] When data assets generate derived data through processing, a residual privacy policy applicable to the derived data is automatically generated based on static analysis and causal inference mechanisms. This residual privacy policy is then bound and stored with the derived data to achieve the continuity and tracking management of privacy compliance policies during data use. Specifically, this includes:

[0142] Establish a directed graph model of the data processing process to clarify the impact path of each processing stage on privacy attributes;

[0143] Static analysis was used to determine the impact of data processing steps on the original privacy compliance strategy, and causal inference analysis was used to clarify the policy constraints applicable to derived data.

[0144] The generated residual privacy policy is stored in the form of metadata bound to the derived data;

[0145] Based on the results of compliance verification and value assessment, a reinforcement learning algorithm is used to dynamically optimize the privacy compliance strategy.

[0146] The entire process of data processing and strategy optimization is audited and logged. Unalterable storage technology is used to ensure the security of audit data, and full-process audit tracking and backtracking analysis functions are provided.

[0147] By employing the methods described above, data assets can be effectively managed in market supervision, ensuring data compliance and privacy protection, while simultaneously enhancing data value and utilization efficiency.

[0148] like Figure 2 As shown, another embodiment of the present invention provides a market supervision data asset management system based on compliance and privacy protection, applied to the market supervision data asset management method based on compliance and privacy protection as described above, including:

[0149] The data asset modeling module is used to collect, clean, and abstract the heterogeneous data resources of the regulated objects to form data assets with metadata tags;

[0150] The data capsule generation module is used to generate privacy compliance policies based on metadata tags and encapsulate the privacy compliance policies and data assets into data capsules.

[0151] The knowledge graph and semantic matching module is used to construct a privacy compliance knowledge graph and to use a large language model to perform semantic matching and compliance verification between privacy compliance strategies within the data capsule and the privacy compliance knowledge graph.

[0152] The privacy protection processing module is used to invoke the privacy protection processing mechanism to perform compliant processing on data assets based on the compliance verification results;

[0153] The anonymization and publishing module is used to determine the anonymization parameters through optimization calculations and to implement data distortion processing before the data is published to the public.

[0154] The value assessment module is used to build a dynamic value assessment model for data assets and to assess the comprehensive value and risk level of data assets in real time.

[0155] The management decision-making module is used to implement differentiated management strategies for data assets based on the evaluation results;

[0156] The audit trail module is used to optimize and adjust privacy compliance strategies, record audit logs, and provide full-process audit trail and retrospective analysis.

[0157] The heterogeneous raw data of the regulated objects (such as transaction data, equipment logs, declaration records, etc.) is called through the data acquisition interface and input into the data asset modeling module for cleaning (filling in missing values, standardizing the format) and abstract modeling (forming a structured data representation). Metadata tags (such as ownership, sensitivity level, etc.) are generated and the structured data asset + metadata tags are output as input to the data capsule generation module.

[0158] The data capsule generation module calls the privacy compliance policy library / rule engine to generate an initial privacy compliance policy based on the tags. It binds the data, policy and context to form a "data capsule" object (a structured container) and outputs a standardized data capsule (including data subject + compliance policy + metadata) for semantic verification and subsequent privacy protection processing modules to call.

[0159] The knowledge graph and semantic matching module constructs / updates the privacy regulations knowledge graph, calls the large language model to perform semantic parsing of the policies, matches the corresponding regulatory nodes in the knowledge graph, calculates the compliance matching degree, and outputs: verification results (compliant / inconsistent / not covered), correction suggestions or prompts, and feeds back the semantic verification log to the audit trail module, provides the policy verification results to the privacy protection processing module, and determines whether the protection mechanism needs to be implemented.

[0160] The privacy protection processing module receives the compliance verification results and the raw data capsule (including data ontology and policy), selects mechanisms such as differential privacy perturbation, homomorphic encryption or SMPC according to the inconsistency clauses, and outputs the compliant intermediate data assets for further processing by the anonymization and release processing module.

[0161] The anonymization and publishing module constructs a distortion optimization model (such as mutual information constraints), solves for the optimal anonymization parameters (such as k value, ε, etc.), applies data distortion transformation, and outputs a version of the data to be published (which has satisfied the trade-off between anonymity and usability); this data flows to the publishing channel, and its value feedback is tracked by the value assessment module.

[0162] The value assessment module assesses the current value of data based on metadata and risk level assessment data, uses reinforcement learning algorithms to predict future value trends, outputs a comprehensive value score and risk-value mapping, and feeds it back to the management decision-making module as a basis for decision-making.

[0163] The management decision-making module formulates differentiated opening, storage, scheduling, or sharing strategies for different data assets, updates the data asset lifecycle management plan, and outputs strategy suggestions or instructions, which may affect the input configuration in the data asset modeling stage.

[0164] The audit trail module spans multiple stages, constructing audit logs stored in an immutable block structure; outputting trace reports and providing a backtracking analysis interface.

[0165] In summary, this invention achieves a structured and standardized representation of data assets by collecting, cleaning, and abstracting modeling heterogeneous data resources of regulated objects, and classifying and managing them using metadata tags. This enhances the unified management capabilities and controllability of data assets. The invention introduces a privacy compliance strategy and data asset encapsulation mechanism, namely the "data capsule" technology. It utilizes a large language model for semantic parsing and compliance verification, and combines this with a privacy compliance knowledge graph to achieve automatic compliance review of the data usage process, significantly improving the automation level of privacy compliance management. By constructing a strategy optimization reward function and dynamically optimizing the privacy compliance strategy using reinforcement learning methods, the invention not only improves the regulatory adaptability of the strategy but also maximizes the preservation of data usability, achieving a balance between privacy protection and data usability.

[0166] This invention employs a convex optimization model based on mutual information to dynamically determine data anonymization parameters, effectively reducing the risk of privacy leaks. It also ensures data security during sharing and publishing through mechanisms such as differential privacy and adaptive encryption. By constructing a reinforcement learning-driven dynamic evaluation model for data assets, it assesses the comprehensive value and risk level of data assets in real time, providing a scientific basis for differentiated management and usage decisions of data assets under different regulatory scenarios.

[0167] This invention supports the generation and binding of privacy policies for derived data residues, and, combined with an immutable audit log mechanism, provides end-to-end compliance tracking and traceability capabilities, enhancing the transparency and compliance assurance of data usage. The proposed system solution integrates multiple functions such as data modeling, compliance policy generation, privacy processing, value assessment, management decision-making, and audit tracking in the form of functional modules, forming a closed-loop data asset compliance management system with good scalability and adaptability.

[0168] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any other combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product, which includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions according to this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transferred from one computer-readable storage medium to another.

[0169] Furthermore, the functional units in the various embodiments of this application can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium. This storage medium can be a read-only memory, a disk, or an optical disk, etc.

[0170] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any person skilled in the art can easily conceive of various variations or substitutions within the technical scope disclosed in this application, and these should all be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A market regulatory data asset management method based on compliance and privacy protection, characterized in that: The method includes: Collect, clean, and abstract the heterogeneous data resources of the regulated objects to form data assets with metadata tags; A privacy compliance policy is generated based on the metadata tags, and the privacy compliance policy and data assets are encapsulated into a data capsule. The encapsulation of the data capsule includes binding and storing the data asset content, privacy compliance policy and data processing context information in a unified structure, and using a machine-readable formal policy language within the data capsule to achieve consistent management and automatic execution of the privacy compliance policy and data asset lifecycle. The privacy compliance strategy is optimized through a feedback reinforcement learning algorithm, including: Build a mapping library between historical privacy compliance policies and compliance verification results; Define the policy optimization reward function R(π) as follows: R(π)=α·C(π,R)+β·P(π,D)-γ·L(π,V); In the formula, C(π,R) represents the matching score between strategy π and regulatory requirement R, P(π,D) represents the data protection effect index after strategy implementation, and L(π,V) represents the data value loss caused by the strategy; α, β, and γ are weight coefficients, and satisfy α+β+γ=1; based on the strategy, optimize the reward function, and use the strategy gradient or Q-learning method to optimize the strategy version, thereby improving the regulatory adaptability and data usability of the privacy compliance strategy; Construct a privacy compliance knowledge graph and use a large language model to achieve semantic matching and compliance verification between the privacy compliance strategy within the data capsule and the privacy compliance knowledge graph; Based on the compliance verification results, at least one privacy protection mechanism is invoked to perform compliance processing on the data assets. The privacy protection mechanism includes differential privacy perturbation mechanism, homomorphic encryption, and secure multi-party computation. Before the data is released to the public, anonymization parameters are determined through optimization calculations, and data distortion processing is performed; the method for determining the anonymization parameters through optimization calculations includes: Construct a convex optimization model for data distortion that quantifies privacy leakage risks using mutual information, expressed as: min I(S;Y),stD(X,Y)≤δ; In the formula, I(S;Y) represents the mutual information between sensitive data S and published data Y, which is used to quantify the risk of privacy leakage when the data is published; D(X,Y) is the degree of data distortion between the original data X and the published data Y, and δ is the preset data distortion constraint threshold. The data distortion convex optimization model is solved by a convex optimization algorithm, and the optimal anonymization parameters for privacy protection are automatically determined while meeting data availability requirements. Build a dynamic assessment model for data asset value to evaluate the comprehensive value and risk level of data assets in real time, so as to guide the differentiated management of data assets.

2. The market regulatory data asset management method based on compliance and privacy protection according to claim 1, characterized in that, The metadata tags of the data assets shall include at least the data ownership, sensitivity level, processing method, scope of use, integrity, update frequency, accuracy and relevance.

3. The market regulatory data asset management method based on compliance and privacy protection according to claim 1, characterized in that, The method for constructing the privacy compliance knowledge graph includes: Collect laws, regulations, policies and industry standards related to privacy protection, and construct a privacy compliance knowledge graph with legal provisions, terminology and logical relationships as nodes and edges; A graph embedding algorithm is used to generate low-dimensional semantic feature vectors for knowledge graph nodes; The knowledge graph content is updated automatically on a regular basis to reflect the latest regulatory changes and the update history is recorded to provide audit backtracking support.

4. The market regulatory data asset management method based on compliance and privacy protection according to claim 1, characterized in that, The implementation methods for semantic matching and compliance verification include: A retrieval-enhanced generation mechanism is employed, and a large language model is invoked to perform semantic parsing on the privacy compliance policy clauses in the data capsule, extracting key semantic features. Based on the aforementioned key semantic features, relevant legal clause nodes are retrieved from the privacy compliance knowledge graph; The retrieved regulatory clause nodes and privacy compliance policy clauses are represented as low-dimensional semantic vectors using graph embedding algorithms, and the semantic matching degree between policy clauses and regulatory nodes is quantified by similarity calculation methods. Based on the quantitative results of the semantic matching degree, output the compliance matching score of each privacy compliance policy clause, and automatically identify policy clauses that are inconsistent with or insufficiently covered by current regulations. For policy clauses that do not comply, the system generates correction suggestions based on the semantics of the regulatory clauses and provides data inputs for policy optimization learning.

5. The market regulatory data asset management method based on compliance and privacy protection according to claim 1, characterized in that, The differential privacy perturbation mechanism is applicable to a multi-layered data processing network architecture, which includes edge devices, intermediate nodes, and a central server. The differential privacy perturbation mechanism is based on the trust model of each node in the multi-layer network. It constructs and executes a differential privacy injection optimization model to dynamically determine the injection level and injection method of differential privacy noise, so as to optimize the model training performance while satisfying the privacy budget constraint. Specifically, it includes: 1) Obtain network structure parameters, including the number of layers in the processing system, the set of nodes in each layer, and their connection relationships; 2) Establish a node trust model, evaluate the trustworthiness of intermediate nodes, and generate trust labels or trust probability values ​​for each node to distinguish differential privacy processing paths. 3) Set differential privacy budget parameters, including the overall privacy budget (∈,δ) and the upper limit of budget allocation for each training round; 4) Construct a joint optimization objective function, with model training error, privacy risk, and resource cost as the optimization objectives, expressed as: In the formula, l t For noise injection levels, σ t Noise intensity; L model R represents the upper bound of the model training error. privacy Indicates the cumulative privacy budget consumption, C resource λ1, λ2, and λ3 represent the cost of communication and computing resources; λ1, λ2, and λ3 are weighting coefficients. 5) Set optimization variables and constraints. Optimization variables include noise injection level, noise intensity, and the proportion of participating devices; constraints include privacy budget limits, system resource limits, and the effectiveness requirements of differential privacy mechanisms. 6) Solve the above model using reinforcement learning, dynamic programming or gradient-based optimization algorithms to generate a differential privacy injection strategy and determine the injection nodes and corresponding noise intensity parameters for each training round. 7) Implement the injection strategy, which includes: injecting calibration noise into trusted intermediate nodes, pre-injecting protective noise into child nodes in untrusted paths, and dynamically adjusting to meet the optimal synergy between privacy protection and model performance; The differential privacy perturbation parameter is dynamically adjusted based on the current privacy risk level and policy implementation effectiveness using an adaptive algorithm, as shown in the formula: In the formula, ∈ t For the real-time adjusted differential privacy budget, ∈0 is the baseline budget value, R t θ represents the current estimated risk of privacy breach, η represents the set risk threshold, and η represents the adjustment coefficient.

6. The market regulatory data asset management method based on compliance and privacy protection according to claim 1, characterized in that, The dynamic evaluation model for data asset value is built on a reinforcement learning algorithm. It uses the completeness, accuracy, update frequency, relevance, and risk level of data assets as inputs to the state space to predict the current comprehensive value score and future value trend of data assets. The reinforcement learning algorithm uses value prediction error and risk assessment as a joint reward function, and continuously trains to optimize the accuracy of value assessment, thereby enabling dynamic management support for different data assets under different regulatory scenarios.

7. The market regulatory data asset management method based on compliance and privacy protection according to claim 1, characterized in that, The method further includes: when data assets generate derived data through processing, automatically generating a residual privacy policy applicable to the derived data based on static analysis and causal inference mechanisms, and binding and storing the residual privacy policy with the derived data to achieve the continuation and tracking management of privacy compliance policies during data use, specifically including: Establish a directed graph model of the data processing process to clarify the impact path of each processing stage on privacy attributes; Static analysis was used to determine the impact of data processing steps on the original privacy compliance strategy, and causal inference analysis was used to clarify the policy constraints applicable to derived data. The generated residual privacy policy is stored in the form of metadata bound to the derived data; Based on the results of compliance verification and value assessment, a reinforcement learning algorithm is used to dynamically optimize the privacy compliance strategy. The entire process of data processing and strategy optimization is audited and logged. Unalterable storage technology is used to ensure the security of audit data, and full-process audit tracking and backtracking analysis functions are provided.

8. A market regulatory data asset management system based on compliance and privacy protection, applied to the market regulatory data asset management method based on compliance and privacy protection as described in any one of claims 1-7, characterized in that, The system includes: The data asset modeling module is used to collect, clean, and abstract the heterogeneous data resources of the regulated objects to form data assets with metadata tags; The data capsule generation module is used to generate a privacy compliance policy based on metadata tags and encapsulate the privacy compliance policy and data assets into a data capsule. The knowledge graph and semantic matching module is used to construct a privacy compliance knowledge graph and to use a large language model to perform semantic matching and compliance verification between privacy compliance strategies within the data capsule and the privacy compliance knowledge graph. The privacy protection processing module is used to invoke the privacy protection processing mechanism to perform compliant processing on data assets based on the compliance verification results; The anonymization and publishing module is used to determine the anonymization parameters through optimization calculations and to implement data distortion processing before the data is published to the public. The value assessment module is used to build a dynamic value assessment model for data assets and to assess the comprehensive value and risk level of data assets in real time. The management decision-making module is used to implement differentiated management strategies for data assets based on the evaluation results; The audit trail module is used to optimize and adjust privacy compliance strategies, record audit logs, and provide full-process audit trail and retrospective analysis.

Images