Distributed intelligent accompanying method and system with controllable data privacy

Abstract

The invention provides a distributed intelligent accompanying method and system with controllable data privacy. The method comprises the following steps: a user data grading processing step: dividing user interaction data into multiple grades according to data types and sensitive grades; a multi-center distributed storage step: storing the data to local, edge or credible center nodes in a dispersed manner according to data sensitivity and privacy configuration; a local priority intelligent processing step, wherein reasoning and feature analysis are completed locally or at an edge terminal preferentially; a federated learning cooperative training step: participating in global model training based on disturbance parameters to ensure that the data is not out of the local; a privacy protection level configuration step: dynamically adjusting a protection strategy in combination with user preference and a context scene; a differentiated authority control step: adjusting data calling authority based on the user identity, the behavior characteristics and the cognitive state; the method has high safety, interpretability and personalized privacy protection capability, and is suitable for various scenes such as family accompanying, elderly nursing and remote education.

Description

Technical Field

[0001] This invention relates to the field of intelligent companionship system technology, and in particular to a distributed intelligent companionship method and system with controllable data privacy. Background Technology

[0002] With the development of artificial intelligence, the Internet of Things, and big data technologies, intelligent companion systems are increasingly being used in areas such as home care, emotional support, remote education, and health monitoring. Existing intelligent companion systems mostly adopt a centralized data processing architecture, where all user data (such as voice, images, physiological signals, and behavioral records) is uploaded to a cloud server for storage and analysis. While this approach enhances system intelligence, it also introduces serious risks of data privacy breaches and a lack of user control.

[0003] First, users inevitably generate a large amount of sensitive information during use, such as identity authentication information, facial images, behavioral habits, and even health status. Once this data is collected, stored, and accessed centrally, it is highly susceptible to becoming a target for hacker attacks and data abuse. Traditional access control systems mostly adopt static access control models, which cannot be flexibly adjusted according to factors such as user relationships, data sensitivity, and real-time status, resulting in coarse and insufficiently detailed permission division.

[0004] Secondly, traditional intelligent companion systems typically treat users as static recipients, neglecting the impact of changes in the user's cognitive state on system interaction. When users are under high cognitive load (e.g., emotional anxiety, inattention), the system may still push them to perform critical authorizations or high-risk operations, increasing the risk of misoperation or privacy breaches. Since existing systems have not universally incorporated mechanisms to perceive and regulate the "user's cognitive state," we propose a distributed intelligent companion method and system with controllable data privacy. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing technologies by providing a distributed intelligent companionship method with controllable data privacy. By constructing a multi-dimensional data sensitivity analysis mechanism, user data is classified according to dimensions such as content, scenario, and source. Combined with user-defined preferences, a differentiated protection strategy for different types of data is achieved, thereby effectively preventing the leakage of highly sensitive data in unintentional scenarios and improving the user trust level of the system.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] A data privacy-controlled distributed intelligent companionship method includes the following steps:

[0008] S1. User data classification processing: User-generated data is classified into sensitivity levels based on data type, generation source, and usage context, into identity level, behavior level, content level, and derived level.

[0009] S2. Multi-center distributed storage: Based on the data sensitivity level, identity-level data is stored on local devices, behavior-level data is stored on edge nodes, and content-level and derived-level data is stored on cloud servers. Distributed mapping rules are used for data binding and location guidance.

[0010] S3, Local Priority Intelligent Processing: Sensitive data is encrypted, de-identified, or feature-extracted locally from the user device to prevent the original data from being leaked.

[0011] S4. Federated Learning Collaborative Training: Independent model training is performed on local data, and the model parameters are processed through differential privacy perturbation and homomorphic cryptographic signature before being uploaded. The global model is updated based on a weighted aggregation mechanism.

[0012] S5. Privacy protection level configuration: Set three privacy modes: basic protection, enhanced protection and highest protection. Users can actively select according to their needs or the system can automatically switch according to the behavior prediction model.

[0013] S6. Differentiated Access Control: Construct an access graph among users and set differentiated data access permissions for family members based on user relationship type, interaction frequency, and data sensitivity attributes.

[0014] S7. Cognitive Load Monitoring and Control Steps:

[0015] Data on user speech tone, speech rate and rhythm, visual gaze characteristics, mouse touch trajectory, and response latency are collected using multimodal sensors.

[0016] The behavioral data is input into the trained cognitive load estimation model to determine the user's current cognitive load level, which includes three levels: low, medium, and high.

[0017] When the cognitive load level is high, the system suspends the outgoing transmission of sensitive data, locks high-risk sharing interfaces, and transfers sharing requests to a buffer. The authorization confirmation prompt will pop up again after the user's cognitive state recovers to a medium or low level.

[0018] Preferably, in step S1, multi-source data generated by the user is collected, and a multi-factor sensitivity scoring function is constructed based on four dimensions: data type, usage scenario context, source device trustworthiness, and historical access patterns.

[0019] Based on the scoring results, the data is divided into five levels: extremely high sensitivity, high sensitivity, medium sensitivity, low sensitivity, and non-sensitive data. The classification results are then mapped to the access control layer, transmission encryption layer, and sharing policy layer in the multi-center storage structure, forming a data security classification and control link that runs through the entire process.

[0020] Preferably, step S2 includes the following steps:

[0021] S210. Construct a data lifecycle map and define the storage state transition path for each type of data, and automatically adjust the storage location accordingly;

[0022] S220. Utilize a trusted execution environment to build a data-controlled execution sandbox in local and edge nodes to prevent plaintext data leakage.

[0023] S230 introduces an elastic data migration mechanism, which triggers encrypted data migration between nodes when storage node resource pressure fluctuates or privacy levels switch, and records the data transfer path and authorization record through blockchain or multi-signature mechanism to ensure traceability.

[0024] Preferably, in step S3, a lightweight inference network based on multi-task distillation is introduced for local desensitization feature extraction, and a dynamic resource-aware strategy scheduler is constructed to determine in real time whether to perform local processing, edge collaboration, or delayed upload operations based on device status and task priority.

[0025] Furthermore, in step S4, a federated participation scheduling strategy based on user behavior profiles and cognitive load status is constructed, the perturbation intensity of the model parameters is adjusted using a sensitivity weight vector, and a differential privacy mechanism is used to add Laplace noise to the model update parameters.

[0026] Furthermore, in step S5, a task context level matching table is constructed, and a mapping function is introduced.

[0027] Preferably, step S6 specifically includes: constructing a permission graph among users, performing differentiated access control, and configuring differentiated permissions for family members.

[0028] A distributed intelligent companion system with controllable data privacy, comprising:

[0029] The user data collection module is used to perform multi-dimensional sensitivity assessment and classification processing of user data based on user interaction, physiological and behavioral data.

[0030] A multi-center distributed storage module is used to distribute user data across local terminals, home edge devices, and cloud servers according to data sensitivity levels.

[0031] The local priority processing module is used to prioritize the processing of sensitive data on the device side, generate user characteristics, and complete some decision-making logic locally;

[0032] The federated learning collaborative training module is used to collaboratively train task models across multiple devices without sharing the original data, and dynamically optimize the model weights.

[0033] The privacy protection level configuration module is used to configure data usage level policies based on task context, user status, and permission risk calculation results.

[0034] The differentiated access control module is used to determine permissions based on data field-level access identifiers, valid access time intervals, and cognitive state thresholds.

[0035] The cognitive load monitoring and control module is used to assess the user's cognitive load level in real time. When the load exceeds the threshold, it automatically pauses model calls and reconstructs the content presentation strategy to protect the user's state.

[0036] The task dynamic driving module is used to generate personalized recommended content based on task objectives, permission levels, and cognitive status, and supports dynamic adjustment of task progress paths.

[0037] The beneficial effects of this invention are as follows:

[0038] 1. This invention constructs a multi-dimensional data sensitivity analysis mechanism to classify user data according to dimensions such as content, scenario, and source. Combined with user-defined preferences, it realizes differentiated protection strategies for different types of data, thereby effectively preventing the leakage of highly sensitive data in unintentional scenarios and improving the user trust level of the system.

[0039] 2. Compared to traditional cloud-based processing methods, this invention completes most of the basic model inference and data processing locally on the terminal or at edge nodes, and only uploads features or perturbed parameters when necessary. This significantly reduces the risk of data exposure, while also reducing network latency and bandwidth pressure, and improving response speed and user experience.

[0040] 3. This invention introduces multi-center trusted storage nodes at the system layer, which intelligently select data storage locations based on user-defined privacy levels and scenario weights, avoiding single points of failure and centralized privacy leakage issues, and enhancing the system's scalability and data disaster recovery capabilities.

[0041] 4. This invention utilizes federated learning algorithms to collaboratively train personalized models across multiple terminals, and combines a parameter-level differential privacy perturbation strategy to adaptively adjust the perturbation intensity according to sensitivity, thereby ensuring the convergence performance of the global model while effectively preventing the risk of reconstruction and leakage of the original data.

[0042] 5. This invention is the first to incorporate the user's cognitive load state (such as attention, fatigue, anxiety, etc.) into the permission management model. When the system detects that the user's cognitive load is in a high-intensity state, it automatically suspends sensitive data operations and postpones authorization requests. The interactive prompt is initiated only after the user's state recovers, which significantly reduces the risk of misauthorization and operation, and has extremely high practical value and social adaptability.

[0043] 6. By constructing a permission graph and dynamic access control policies, the system can dynamically configure access permissions based on factors such as family member identity, usage frequency, and data category, thereby implementing a tiered sharing strategy for children, the elderly, or visitors, which improves the system's adaptability to family scenarios and the user-friendliness of human-computer interaction.

[0044] 7. The design of this invention is compatible with existing mobile terminals, smart speakers, health monitoring devices and other carriers, supports the access and expansion of heterogeneous data, and can be introduced into existing family companionship systems through incremental deployment, thus possessing strong potential for industrialization and productization applications. Attached Figure Description

[0045] Figure 1 This is a schematic diagram of the overall process of the present invention. Detailed Implementation

[0046] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0047] Example 1: As Figure 1 As shown, this embodiment provides a distributed intelligent companionship method with controllable data privacy, including the following steps:

[0048] S1. User data classification processing steps: Classify user-generated data according to sensitivity level. Based on data type, generation source and usage context, divide the data into four categories: identity level, behavior level, content level and derived level.

[0049] S2, Multi-center Distributed Storage Steps: Based on the data sensitivity level, identity-level data is stored on local devices, behavior-level data is stored on edge nodes, and content-level and derived-level data is stored on cloud servers. Distributed mapping rules are used for data binding and location guidance.

[0050] S3, Local Priority Intelligent Processing Steps: Sensitive data is first encrypted, desensitized, or feature extracted locally on the user device side to avoid leakage of the original data. Feature summaries or encrypted identifiers are only uploaded when the privacy level allows.

[0051] S4. Federated Learning Collaborative Training Steps: Each terminal independently trains a model on local data, processes the model parameters through differential privacy perturbation, homomorphic encryption signature, etc., and then uploads the model. The server updates the global model based on a weighted aggregation mechanism to achieve intelligent collaboration with data not leaving the device.

[0052] S5. Privacy protection level configuration steps: Set three privacy modes: basic protection, enhanced protection and highest protection. Users can actively select according to their needs or the system can automatically switch according to the behavior prediction model. The privacy level will affect the data processing granularity, upload channel and access permissions.

[0053] S6. Differentiated access control steps: Construct an access graph among users, and set differentiated data access permissions for family members based on user relationship type, interaction frequency, and data sensitivity attributes; support read-only + authorization audit for children's accounts, and temporary access authorization and expiration revocation for visitor accounts.

[0054] S7. Cognitive Load Monitoring and Control Steps: Collect user behavioral data such as speech tone, speech rate and rhythm, visual gaze characteristics, mouse / touchscreen trajectory, and response latency through multimodal sensors. Input this behavioral data into a trained cognitive load estimation model to determine the user's current cognitive load level, which includes three levels: low, medium, and high. When the cognitive load level is high, the system suspends the outgoing transmission of sensitive data, locks high-risk sharing interfaces, and transfers sharing requests to a buffer. After the user's cognitive state recovers to a medium or low level, the authorization confirmation prompt will pop up again.

[0055] Preferably, in step S1, in order to achieve efficient protection and intelligent hierarchical management of user data, an adaptive hierarchical processing method for user data is proposed. Its core is to conduct quantitative sensitivity assessment of each type of data through multi-dimensional sensitivity modeling and weight calculation formula, and dynamically match access and transmission control strategies based on this.

[0056] The specific S1 steps include the following:

[0057] S110. Data Dimension Definition and Collection Method;

[0058] The system automatically collects the following four types of sensitive influencing factors from the user interaction process:

[0059] Data type T (Type): such as physiological data, behavioral records, text corpora, social interactions, voice and video, etc.;

[0060] Context C: such as the current task scenario, device activity mode, spatial location, semantic context, etc.

[0061] Device Trust (D): such as the authentication level, encryption capabilities, and tampering risk of data acquisition devices;

[0062] History Access Pattern H: such as the access frequency of this data field, the scope of historical sharing, user authorization records, etc.

[0063] S120, Construction of Sensitivity Scoring Function

[0064] The above factors are modeled using linear weighting to calculate the overall sensitivity score S for each data item. sensitive The calculation formula is as follows:

[0065] S sensitive =α·f T +β·f C +γ·f D +δ·f H ;

[0066] Where f T f C f D f H These are numerical quantization functions for four sensitive factors; the coefficients α, β, γ, δ ∈ [0, 1], which can be preset or dynamically adjusted according to user preferences or system strategies. Optionally, the system introduces reinforcement learning to adaptively adjust the weights and construct a user-level personalized sensitivity model.

[0067] S130. Sensitivity Level Classification and Control Strategy Matching: Based on the comprehensive sensitivity score S sensitive The system automatically categorizes data into five types: extremely sensitive (e.g., real-time physiological signals); highly sensitive (e.g., user social chat logs, behavioral habits); moderately sensitive (e.g., click records, page navigation paths); low sensitive (e.g., general statistical logs); and non-sensitive (e.g., anonymous recommendation tags).

[0068] Then, based on the sensitivity level, the system automatically matches the following three layers of control policies: Access control policy layer: defines who, when, and where can access the data; Transmission encryption and de-identification policy layer: determines whether encryption / de-identification processing is required; Multi-level sharing and authorized propagation control layer: controls whether the data can be used by the cloud model or shared across devices.

[0069] In step S2: Based on the data sensitivity level score output in step S1, combined with the user device computing power level, real-time network conditions, security policy level, and current cognitive load level, the data is allocated to local, edge, or cloud storage nodes through a dynamic mapping strategy, and the following sub-steps are specifically executed:

[0070] S210. Construct a data lifecycle map, define the storage state transition path of "active period - dormant period - obsolescence period" for each type of data, and automatically adjust the storage location accordingly (e.g., highly active sensitive data is stored locally / TEE, and long-term dormant data is archived to cold storage cloud service).

[0071] S220. Utilize a Trusted Execution Environment (TEE) to build a controlled execution sandbox for data in local and edge nodes to prevent plaintext data leakage.

[0072] S230. An elastic data migration mechanism is introduced. When storage node resource pressure fluctuates or privacy levels switch, encrypted data migration between nodes is triggered. The data transfer path and authorization records are recorded through blockchain or multi-signature mechanisms to ensure traceability. Specific supplementary explanations are as follows:

[0073] I. Lifecycle-Aware Storage Scheduling Mechanism

[0074] The data lifecycle is divided into four phases: active phase (data is being used frequently, such as real-time behavior analysis and physiological feedback); idle phase (data has not been used recently but may be retrieved later); expired phase (data has exceeded its authorized time limit or usage value); and archive phase (critical historical data that is retained for a long time, such as raw data for model training). The system automatically identifies the current lifecycle phase based on timestamps, access frequency, and authorization status.

[0075] II. Linkage between Data Sensitivity and Storage Strategy

[0076] According to the output S1 sensitive The system uses the following strategy to dynamically distribute stored data based on the scoring: if the sensitivity is high and the data is active, it is preferentially allocated to local terminals or edge trusted execution environments (TEEs) to avoid remote transmission; if the sensitivity is moderate or the data enters a dormant period, it is transferred to edge cold storage nodes, such as local encrypted hard drives or private edge clouds; if the sensitivity is low or the data enters an obsolescence period, it can be migrated to encrypted archive cloud nodes or a deletion process can be triggered.

[0077] III. Measures to Ensure a Trusted Execution Environment

[0078] In the S210, the system introduces a TEE environment for edge or local devices. The TEE includes a data "behavior sandbox" module with the following functions: auditing, logging, and access pattern modeling of data access behavior; performing dual authentication (e.g., biometrics + behavioral password) for access to sensitive data; and automatically triggering encryption locking or de-identification replacement for data whose authorization information has expired. This mechanism significantly improves the device's ability to prevent side-channel attacks, reverse engineering, and data leakage.

[0079] IV. Data Scheduling and Privacy Tracing Mechanism

[0080] To ensure that data is transferable but not abused, this embodiment proposes the following traceability design: each data node migration record is written into a blockchain-style permission ledger, including: migration reason, initiation time, migration path, and signature verification; during inter-node migration or replica adjustment, all transmission records are encrypted with hash signatures; each node is configured with a data call log auditing module to ensure that data access operations are traceable and reproducible.

[0081] In the local-first intelligent processing step, a lightweight inference network based on multi-task distillation is introduced for local de-identification feature extraction, and a dynamic resource-aware strategy scheduler is constructed to determine in real time whether to perform local processing, edge collaboration, or delayed upload operations based on device status and task priority. Specifically, this includes:

[0082] S310, Dynamic Decision-Making Mechanism (Terminal Status + Environmental Context Collaboration)

[0083] The system collects the following indicators in real time to evaluate the device's processing capacity and environmental reliability: Device-side indicators: battery level, estimated battery life, CPU temperature, and remaining memory capacity;

[0084] Context: Whether the user is on a secure network, connected to a trusted device, or in a secure environment such as home / office;

[0085] Privacy level label: output from S1 above, combined with data sensitivity weight;

[0086] ε local =f(E power M temp M mem ,ρ context ,S sensitive );

[0087] Based on whether the evaluation value is higher than the threshold θ local Determine whether to process locally or delay the upload;

[0088] Variable symbol Meaning Explanation <![CDATA[E power ]]> The device's current battery percentage (if <30%, consider energy-saving upload). <![CDATA[M temp ]]> Equipment temperature, to prevent high temperatures from affecting processing reliability <![CDATA[M mem ]]> The current available memory size is used to assess whether the local machine has the capability to run AI models. <![CDATA[ρ context ]]> Use context-based risk scoring (such as whether the network is stable, whether the user is in a public place, etc.). <![CDATA[S sensitive ]]> Data sensitivity score (output from step S1 above, based on the characteristics of the data itself).

[0089] The system will calculate the result ε local With a preset threshold θ local Compare, if ε local Greater than θ local This indicates that the current device state is not suitable for local processing, and instead, the upload will be delayed or a cloud processing path will be selected.

[0090] If ε local Less than or equal to θ localData can be extracted, de-identified, or used for model prediction locally, preventing sensitive data from being leaked.

[0091] S320 Local Priority Processing Strategy (Speech Transcription, Image Blur, Quantization Operation)

[0092] The system performs "light privacy" local transformations on highly sensitive data that meets the processing criteria. The transformation methods include:

[0093] Voice data: Transcribed locally to text; only keyword summaries are uploaded.

[0094] Image data: Perform blur mosaic, background segmentation, and identity region masking;

[0095] Content data: Employs word vector abstraction to represent irreversible content features uploaded;

[0096] This method significantly reduces the privacy risks associated with direct data uploads.

[0097] S330, Sensitivity Level Modeler Guided by User Profile

[0098] To build a user-personalized model component, the system incorporates a long-term user data learning module and automatically adjusts the following strategies:

[0099] Constructing an individualized risk curve R user (t), predicting the current upload risk level;

[0100] Constructing an individualized model of preference P safe (x) distinguishes which data should be processed first and which should be sent with a delay;

[0101] The historical feedback (whether it was re-identified or misused) was used as a penalty factor in the training and optimization.

[0102] S340, Delayed Window Strategy and Upload Priority Scheduling

[0103] To avoid the conflict between "privacy leakage vs. instant response", this embodiment designs a delayed upload strategy: data at a high risk level is cached in a local encrypted cache before the secure upload window;

[0104] The upload queue is set with a priority factor that satisfies the following condition: the lower the sensitivity and the lower the risk prediction, the higher the priority for upload.

[0105] Use the following priority function for scheduling:

[0106]

[0107] The specific information regarding the priority function is as follows:

[0108]

[0109] Data acquisition phase: For each data point i generated by the terminal system, its sensitivity score S is calculated. sensitive (i), and call the user profile module to obtain R user (i);

[0110] Priority determination stage: Calculate P using the above formula. upload (i);

[0111] Upload scheduling mechanism: Based on system bandwidth and center load, P is selected first. upload (i) Data with larger values ​​is uploaded, while the rest is delayed or cached;

[0112] S4. Federated Learning Collaborative Training: The aim is to model sensitive data on the user terminal side while ensuring the privacy and security of model parameters. Based on this, a federated learning mechanism is used to aggregate and optimize models from multiple terminals, including the following steps:

[0113] S410, Local Model Training and Parameter Reporting

[0114] The user terminal first trains a model using locally collected data (such as behavioral images, speech, operation trajectories, gaze patterns, etc.). The trained model parameters are not transmitted directly in plaintext, but are instead processed with noise through a differential privacy perturbation mechanism to mitigate the risk of the server retrieving the original data from the parameters;

[0115] S420, Sensitivity Weight Adjustment

[0116] The system sets a sensitivity weight vector ω based on the importance of the feature represented by each model parameter in the sensitive data dimension. i This is used to adjust the perturbation strength. The higher the sensitivity of the parameter, the stronger the corresponding perturbation. This mechanism ensures that more privacy-sensitive data receives stronger protection.

[0117] For example:

[0118] If a parameter is involved in user emotion recognition (such as facial expression tension classification), set ω i A value of 10 indicates that it is a highly sensitive parameter;

[0119] If the parameter involves low-sensitivity data such as click frequency, ω can be set. i The value is 1, indicating a low level of disturbance.

[0120] S430, Differential Privacy Perturbation Mechanism

[0121] For each model parameter θ obtained from local training i The system is perturbed using the Laplace mechanism, and the perturbation formula is as follows:

[0122]

[0123] in: These are the perturbed model parameters;

[0124] θ i These are the original model parameters;

[0125] ω i : parameter θ i The sensitivity weight of the feature dimension (the larger the weight, the more sensitive the parameter is, and the stronger the noise needs to be added);

[0126] λ: Privacy budget hyperparameter, which can take values ​​such as 0.5, 1.0, etc., to adjust the overall perturbation intensity;

[0127] Lap(·) denotes the Laplace distribution random perturbation function;

[0128] S440, Model Aggregation and Update Mechanism: Perturbation model parameters uploaded by all terminals will be weighted and aggregated in the cloud (or trusted edge nodes) to construct a globally updated model. Since each user only exposes the perturbed information, the system achieves federal-level protection of user privacy data while ensuring overall learning performance.

[0129] S5, the privacy protection level configuration steps, aim to dynamically set the privacy protection level based on individual user privacy preferences and data sensitivity needs, thereby controlling data upload paths, access permissions, and processing methods. Its core content includes the following aspects:

[0130] Three-tier privacy system

[0131] The system has three preset privacy levels: Basic Protection Mode: Applicable to non-sensitive data processing, such as daily click behavior and UI interaction frequency; allows local processing results to be uploaded to the server, but does not contain the original behavior sequence.

[0132] Enhanced Protection Mode: Applicable to medium-sensitivity data (such as voice commands, camera eye tracking, etc.); restricts plaintext uploads, uses a perturbation mechanism to process parameters or feature extraction results; data access requires authorization prompts for confirmation.

[0133] Highest protection mode: Applicable to highly sensitive information (such as psychological state, health behavior analysis, etc.); prohibits uploading data or any behavioral characteristics in plaintext; the system only allows local models to participate in training with strong user authorization.

[0134] User selection mechanism

[0135] Users can manually select the desired privacy level in the system privacy settings center; at the same time, the system has built-in behavior prediction models (such as decision tree models, LSTM sequence predictors, etc.) that can dynamically switch privacy levels based on the user's current behavior patterns, interaction frequency, and request type; behavior prediction factors include, but are not limited to: mouse click speed, eye movement trajectory fluctuations, dwell time, and changes in language tone.

[0136] Data processing path adjustment

[0137] Different privacy levels will directly affect: Data upload channel: For example, the basic mode can use HTTP upload, while the intermediate and advanced modes require TLS / TEE encrypted channels; Access permission level: In the basic mode, the system can automatically call the model for feedback, while in the advanced mode, the user needs to confirm each item; Caching and destruction strategy: At the highest protection level, sensitive data is not stored locally or in the cloud, but is destroyed only after instant processing.

[0138] Technical Feasibility Statement

[0139] This mechanism is highly flexible and can adapt to different users' desires for data control, while taking into account both security and system response efficiency. The solution achieves: personalized and proactive data protection strategies; differentiated data access authorization system; and easy integration into existing federated learning / intelligent companion system architectures.

[0140] Step S6 dynamically allocates differentiated access permissions based on the semantics of the relationships between users and data-sensitive attributes, thereby improving the system's fine-grained control capabilities and privacy protection flexibility;

[0141] Permission graph construction mechanism

[0142] The system first constructs a permission graph among users, which consists of the following elements: Nodes: Family members (such as parents, children, elderly, caregivers, etc.); Edges (relationships): Relationship types between users (such as parent-child, spouse, friend, etc.), which can be weighted; Tag attributes: Relationship type: such as "parent-child", "sibling", "guardian-ward", etc.; Interaction frequency: Communication density calculated based on communication, location overlap, and shared records; Trust level: Calculated based on historical behavior records; Data sensitivity level: Sensitive attribute labels marked from the data generation end, such as "health", "behavioral trajectory", "voice", etc. This graph is updated in real time and used as a reference for permission rules in access control.

[0143] Differentiated access control logic

[0144] Based on the data in the permission graph above, the system executes a differentiated control strategy when an access request is received. The main logic is as follows: permission decision function:

[0145]

[0146] R(u i ,u j ): Represents user u i With data ownership u j Relationship types;

[0147] S data : Indicates a request to access data d j Sensitivity level;

[0148] θ1, θ2, θ3: These are the trust-sensitivity control thresholds set for the system.

[0149] Example of differentiated permission configuration for family members

[0150] For example, for home users, the system can be configured with the following differences.

[0151]

[0152] The above permission policies can be configured and viewed through a visual permission graph interface, enhancing auditability and user trust.

[0153] Step S7 primarily addresses the following issue: preventing users from making erroneous operations or sensitive decisions under conditions of cognitive inefficiency during peak cognitive load periods, thereby improving the security and controllability of system data transmission. This mainly includes:

[0154] S710, Multimodal Cognitive Load Behavioral Data Acquisition Mechanism

[0155] The system's sensor devices and behavior tracking modules deployed on the terminal side will collect the following five types of user behavior characteristics:

[0156]

[0157] Cognitive load estimation model

[0158] The five types of behavioral features collected will be used as the input feature vector X. t The input is fed into a pre-trained cognitive load estimation model (which can be SVM, LSTM, Transformer, or a fusion-based lightweight model), and the model structure satisfies the following mapping relationship:

[0159]

[0160] Where: C load (t): Represents the system's judgment on the user's cognitive load level at time t; This is a pre-trained cognitive state recognition model; the output can be further refined into sub-labels such as attention-dispersed load and high-pressure concentrated load based on task complexity (for subsequent strategy optimization).

[0161] When the system determines that the user's cognitive load level is "high", the following actions are performed to ensure caution in sensitive operations:

[0162] External transmission suspension mechanism: Suspend all data transmission tasks involving highly sensitive data, such as location, camera, and health information; lock highly sensitive shared content or high-risk external transmission interfaces (such as sharing to the cloud or releasing APIs).

[0163] Authorization Delay and Buffer Strategy: Transfer current sharing / authorization request information (such as requester, time, content summary) to the buffer pool queue; Set up an intelligent polling judgment mechanism to proactively pop up an "authorization confirmation prompt" again when the user's cognitive state recovers to "medium" or "low"; If the user's cognitive state does not recover within the set time, the request expires and the behavior log is automatically recorded.

[0164] Example 2: This example provides a distributed intelligent companion system with controllable data privacy, including:

[0165] The user data collection module is used to perform multi-dimensional sensitivity assessment and classification processing of user data based on user interaction, physiological and behavioral data.

[0166] A multi-center distributed storage module is used to distribute user data across local terminals, home edge devices, and cloud servers according to data sensitivity levels.

[0167] The local priority processing module is used to prioritize the processing of sensitive data on the device side, generate user characteristics, and complete some decision-making logic locally;

[0168] The federated learning collaborative training module is used to collaboratively train task models across multiple devices without sharing the original data, and dynamically optimize the model weights.

[0169] The privacy protection level configuration module is used to configure data usage level policies based on task context, user status, and permission risk calculation results.

[0170] The differentiated access control module is used to determine permissions based on data field-level access identifiers, valid access time intervals, and cognitive state thresholds. The permission determination includes "allow", "delay", or "deny".

[0171] The cognitive load monitoring and control module is used to assess the user's cognitive load level in real time. When the load exceeds the threshold, it automatically pauses model calls and reconstructs the content presentation strategy to protect the user's state.

[0172] The task dynamic driving module is used to generate personalized recommended content based on task objectives, permission levels, and cognitive status, and supports dynamic adjustment of task progress paths.

[0173] It has the following advantages:

[0174] 1. By constructing a multi-dimensional data sensitivity analysis mechanism, user data is classified according to dimensions such as content, scenario, and source. Combined with user-defined preferences, differentiated protection strategies for different types of data are implemented, thereby effectively preventing the leakage of highly sensitive data in unintentional scenarios and improving the user trust level of the system.

[0175] 2. Compared to traditional cloud-based processing methods, most basic model inference and data processing are completed locally on the terminal or at edge nodes. Features or perturbed parameters are only uploaded when necessary, which significantly reduces the risk of data exposure, while reducing network latency and bandwidth pressure, and improving response speed and user experience.

[0176] 3. By introducing multi-center trusted storage nodes at the system level, the system intelligently selects data storage locations based on user-defined privacy levels and scenario weights, avoiding single points of failure and centralized privacy leaks, and enhancing the system's scalability and data disaster recovery capabilities.

[0177] 4. By using federated learning algorithms to collaboratively train personalized models across multiple terminals, and combining them with parameter-level differential privacy perturbation strategies, the perturbation intensity is adaptively adjusted according to sensitivity, thereby ensuring the convergence performance of the global model while effectively preventing the risk of reconstruction and leakage of the original data.

[0178] 5. For the first time, the system incorporates the user's cognitive load status (such as attention, fatigue, anxiety, etc.) into the access control model. When the system detects that the user's cognitive load is in a high-intensity state, it automatically suspends sensitive data operations and postpones authorization requests. The system will initiate interactive prompts after the user's state recovers, which significantly reduces the risk of misauthorization and operation, and has extremely high practical value and social adaptability.

[0179] 6. By constructing a permission graph and dynamic access control policies, the system can dynamically configure access permissions based on factors such as family member identity, usage frequency, and data category, thereby implementing a tiered sharing strategy for children, the elderly, or visitors, which improves the system's adaptability to family scenarios and the user-friendliness of human-computer interaction.

[0180] 7. It is compatible with existing mobile terminals, smart speakers, health monitoring devices and other carriers, supports the access and expansion of heterogeneous data, and can be introduced into existing family companionship systems through incremental deployment, with strong potential for industrialization and productization applications.

[0181] The above formulas are all dimensionless calculations. The formulas are derived from software simulations based on a large amount of collected data to obtain the most recent real-world results. The preset parameters and thresholds in the formulas are set by those skilled in the art according to the actual situation.

[0182] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium. A semiconductor medium can be a solid-state drive.

[0183] Those skilled in the art will recognize that the modules and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0184] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and modules described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0185] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or modules may be electrical, mechanical, or other forms.

[0186] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical modules; they may be located in one place or distributed across multiple network modules. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0187] In addition, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module.

[0188] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0189] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in this application should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

[0190] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A distributed intelligent companionship method with controllable data privacy, characterized in that, Includes the following steps: S1. User data classification processing: User-generated data is classified into sensitivity levels based on data type, generation source, and usage context, into identity level, behavior level, content level, and derived level. S2. Multi-center distributed storage: Based on the data sensitivity level, identity-level data is stored on local devices, behavior-level data is stored on edge nodes, and content-level and derived-level data is stored on cloud servers. Distributed mapping rules are used for data binding and location guidance. S3, Local Priority Intelligent Processing: Sensitive data is encrypted, de-identified, or feature-extracted locally from the user device to prevent the original data from being leaked. S4. Federated Learning Collaborative Training: Independent model training is performed on local data, and the model parameters are processed through differential privacy perturbation and homomorphic cryptographic signature before being uploaded. The global model is updated based on a weighted aggregation mechanism. S5. Privacy protection level configuration: Set three privacy modes: basic protection, enhanced protection and highest protection. Users can actively select according to their needs or the system can automatically switch according to the behavior prediction model. S6. Differentiated Access Control: Construct an access graph among users and set differentiated data access permissions for family members based on user relationship type, interaction frequency, and data sensitivity attributes.

2. The distributed intelligent companionship method with controllable data privacy according to claim 1, characterized in that, It also includes S7, cognitive load monitoring and control steps: Data on user speech tone, speech rate and rhythm, visual gaze characteristics, mouse touch trajectory, and response latency are collected using multimodal sensors. The behavioral data is input into the trained cognitive load estimation model to determine the user's current cognitive load level, which includes three levels: low, medium, and high. When the cognitive load level is high, the system suspends the outgoing transmission of sensitive data, locks high-risk sharing interfaces, and transfers sharing requests to a buffer. The authorization confirmation prompt will pop up again after the user's cognitive state recovers to a medium or low level.

3. The distributed intelligent companionship method with controllable data privacy according to claim 2, characterized in that, In step S1, multi-source data generated by users is collected, and a multi-factor sensitivity scoring function is constructed based on four dimensions: data type, usage scenario context, source device trustworthiness, and historical access patterns. Based on the scoring results, the data is divided into five levels: extremely high sensitivity, high sensitivity, medium sensitivity, low sensitivity, and non-sensitive data. The classification results are then mapped to the access control layer, transmission encryption layer, and sharing policy layer in the multi-center storage structure, forming a data security classification and control link that runs through the entire process.

4. The distributed intelligent companionship method with controllable data privacy according to claim 3, characterized in that, Step S2 includes the following steps: S210. Construct a data lifecycle map and define the storage state transition path for each type of data, and automatically adjust the storage location accordingly; S220. Utilize a trusted execution environment to build a data-controlled execution sandbox in local and edge nodes to prevent plaintext data leakage. S230 introduces an elastic data migration mechanism, which triggers encrypted data migration between nodes when storage node resource pressure fluctuates or privacy levels switch, and records the data transfer path and authorization record through blockchain or multi-signature mechanism to ensure traceability.

5. The distributed intelligent companionship method with controllable data privacy according to claim 4, characterized in that, In step S3, a lightweight inference network based on multi-task distillation is introduced for local desensitization feature extraction, and a dynamic resource-aware strategy scheduler is constructed to determine in real time whether to perform local processing, edge collaboration, or delayed upload operations based on device status and task priority.

6. The distributed intelligent companionship method with controllable data privacy according to claim 5, characterized in that, In step S4, a federated participation scheduling strategy based on user behavior profiles and cognitive load status is constructed. The model parameters are adjusted for perturbation intensity using a sensitivity weight vector, and a differential privacy mechanism is used to add Laplace noise to the model update parameters.

7. A distributed intelligent companionship method with controllable data privacy according to claim 6, characterized in that, In step S5, a task context level matching table is constructed, and a mapping function is introduced.

8. The distributed intelligent companionship method with controllable data privacy according to claim 7, characterized in that, Step S6 specifically includes: constructing a permission graph among users, implementing differentiated access control, and configuring differentiated permissions for family members.

9. A distributed intelligent companion system with controllable data privacy, used to implement the distributed intelligent companion method with controllable data privacy as described in any one of claims 1-8, characterized in that, include: The user data collection module is used to perform multi-dimensional sensitivity assessment and classification processing of user data based on user interaction, physiological and behavioral data. A multi-center distributed storage module is used to distribute user data across local terminals, home edge devices, and cloud servers according to data sensitivity levels. The local priority processing module is used to prioritize the processing of sensitive data on the device side, generate user characteristics, and complete some decision-making logic locally; The federated learning collaborative training module is used to collaboratively train task models across multiple devices without sharing the original data, and dynamically optimize the model weights. The privacy protection level configuration module is used to configure data usage level policies based on task context, user status, and permission risk calculation results. The differentiated access control module is used to determine permissions based on data field-level access identifiers, valid access time intervals, and cognitive state thresholds. The cognitive load monitoring and control module is used to assess the user's cognitive load level in real time. When the load exceeds the threshold, it automatically pauses model calls and reconstructs the content presentation strategy to protect the user's state. The task dynamic driving module is used to generate personalized recommended content based on task objectives, permission levels, and cognitive status, and supports dynamic adjustment of task progress paths.

Images