Intelligent networked automobile spatio-temporal data safety monitoring system and method

Abstract

The invention discloses an intelligent networked automobile spatio-temporal data safety monitoring system and method, and relates to the technical field of spatio-temporal data safety supervision, and the system is characterized in that a vehicle end and road end platform uploads spatio-temporal data processing flow information to an enterprise platform; the enterprise platform reports the spatio-temporal data processing flow information to the attribution spatio-temporal data safety monitoring platform according to the periodic frequency, and forms rectification measures and reports for feedback according to the risk alarm information; the attribution spatio-temporal data security monitoring platform performs security risk identification on spatio-temporal data processing flow information submitted by the enterprise platform, pushes obtained risk alarm information to the enterprise platform, performs traceability tracking on the risk alarm information to obtain a traceability report, and verifies whether rectification measures and reports fed back by the enterprise platform are valid or not; and if yes, stopping pushing the risk alarm information. According to the method and the device, efficient and accurate safety supervision on the spatio-temporal data is realized.

Description

Technical Field

[0001] This application relates to the field of spatiotemporal data security supervision technology, and in particular to a spatiotemporal data security monitoring system and method for intelligent connected vehicles. Background Technology

[0002] With the continuous expansion of data scale and the increasing complexity of processing stages, the security issues of spatiotemporal data are becoming increasingly prominent. How to achieve efficient and accurate security supervision throughout the entire data lifecycle has become a core problem that urgently needs to be solved.

[0003] Currently, numerous technical bottlenecks remain in the field of spatiotemporal data security supervision. First, existing security risk identification and monitoring / early warning technologies largely rely on traditional data access control and log auditing methods, making real-time and accurate monitoring difficult and hindering effective early warning before data security incidents occur. Second, the entire lifecycle of spatiotemporal data involves multiple stakeholders and stages, with diverse data sources and massive amounts of information, posing significant challenges to data traceability and tracking. Furthermore, traditional pre-emptive supervision methods are insufficient to address the complex needs of full-process spatiotemporal data supervision, necessitating the development of intelligent and automated supervision technologies to achieve real-time monitoring and early warning of data security risks, thereby improving overall regulatory efficiency.

[0004] In conclusion, there is an urgent need to overcome the limitations of existing technologies and research more efficient and intelligent methods for spatiotemporal data security supervision in order to address the growing data security challenges. Summary of the Invention

[0005] The purpose of this application is to provide a spatiotemporal data security monitoring system and method for intelligent connected vehicles, which can achieve efficient and accurate security supervision of spatiotemporal data.

[0006] To achieve the above objectives, this application provides the following solution: In a first aspect, this application provides a spatiotemporal data security monitoring system for intelligent connected vehicles, comprising: The vehicle-side platform is used to collect spatiotemporal data processing flow information at the vehicle end and upload the spatiotemporal data processing flow information at the vehicle end to the enterprise platform; The roadside platform is used to collect spatiotemporal data processing flow information at roadside locations and upload this information to the enterprise platform. The enterprise platform is used to report the received spatiotemporal data processing flow information to the local spatiotemporal data security monitoring platform according to a preset periodic frequency, based on a unified data interface protocol. The local spatiotemporal data security monitoring platform is used for: The system identifies security risks in the spatiotemporal data processing workflow information submitted by the enterprise platform, generates risk alarm information, pushes the risk alarm information to the enterprise platform, and displays the risk alarm information in a visual interface; the risk alarm information includes security risk events and their corresponding levels. Knowledge graph technology is used to trace the source of risk alert information and obtain a source tracing report. The enterprise platform is also used to identify enterprise security risks based on the received risk alarm information, generate rectification measures and reports based on the enterprise security risks, and then feed the rectification measures and reports back to the local spatiotemporal data security monitoring platform. The local spatiotemporal data security monitoring platform is also used to verify whether the rectification measures and reports reported by the enterprise platform are effective; if so, it will stop pushing risk warning information.

[0007] Secondly, this application provides a method for spatiotemporal data security monitoring of intelligent connected vehicles, including: The vehicle-side platform collects spatiotemporal data processing flow information from the vehicle and uploads this information to the enterprise platform. The roadside platform collects spatiotemporal data processing flow information from roadside locations and uploads this information to the enterprise platform. Based on a unified data interface protocol, the enterprise platform reports the received spatiotemporal data processing flow information to the local spatiotemporal data security monitoring platform at a preset periodic frequency. The local spatiotemporal data security monitoring platform identifies security risks in the spatiotemporal data processing flow information submitted by the enterprise platform, obtains risk alarm information, pushes the risk alarm information to the enterprise platform, and displays the risk alarm information in a visual interface; the risk alarm information includes security risk events and their corresponding levels; The local spatiotemporal data security monitoring platform uses knowledge graph technology to trace the source of risk alarm information and obtain a source tracing report; The enterprise platform determines the enterprise's security risk issues based on the received risk alarm information, and formulates rectification measures and reports based on the enterprise's security risk issues. Then, it feeds back the rectification measures and reports to the local spatiotemporal data security monitoring platform. The local spatiotemporal data security monitoring platform verifies the effectiveness of the rectification measures and reports submitted by the enterprise platform; if so, it stops pushing risk warning information.

[0008] According to the specific embodiments provided in this application, the following technical effects are disclosed: This application provides a spatiotemporal data security monitoring system and method for intelligent connected vehicles. It identifies security risks in the spatiotemporal data processing flow information uploaded by enterprise platforms through a local spatiotemporal data security monitoring platform, and pushes risk alarm information to the enterprise platforms in a tiered manner. This mechanism ensures the timeliness of security risk identification and response, enabling effective early warning before security incidents occur and achieving accurate classification of security risks. Furthermore, the local spatiotemporal data security monitoring platform can trace the source of risk alarm information, achieving full lifecycle traceability of spatiotemporal data, thereby helping enterprise platforms take targeted rectification measures and improve system security. In addition, the enterprise platform takes rectification measures based on the risk alarm information fed back by the local platform and generates a rectification report. The local platform verifies the effectiveness of the rectification measures, ensuring that risks are properly handled and guaranteeing continuous system optimization and security. Attached Figure Description

[0009] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0010] Figure 1 This is a functional block diagram of a spatiotemporal data security monitoring system for intelligent connected vehicles provided in Embodiment 1 of this application; Figure 2 A schematic diagram of the overall technical architecture of the local spatiotemporal data security monitoring platform provided in Embodiment 2 of this application; Figure 3 This is a schematic diagram of the functional modules of the local spatiotemporal data security monitoring platform provided in Embodiment 2 of this application; Figure 4 This is a schematic diagram of the business architecture of the local spatiotemporal data security monitoring platform provided in Embodiment 2 of this application. Detailed Implementation

[0011] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0012] To make the above-mentioned objectives, features and advantages of this application more apparent and understandable, the application will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0013] Example 1 In one exemplary embodiment, such as Figure 1 As shown, a spatiotemporal data security monitoring system for intelligent connected vehicles is provided, comprising: The vehicle-side platform is used to collect spatiotemporal data processing flow information at the vehicle end and upload the spatiotemporal data processing flow information at the vehicle end to the enterprise platform.

[0014] The roadside platform is used to collect spatiotemporal data processing information at roadside locations and upload this information to the enterprise platform.

[0015] The enterprise platform is used to report the received spatiotemporal data processing information to the local spatiotemporal data security monitoring platform according to a preset periodic frequency, based on a unified data interface protocol.

[0016] The local spatiotemporal data security monitoring platform is used for: The system identifies security risks in the spatiotemporal data processing workflow information submitted by the enterprise platform, obtains risk alarm information, pushes the risk alarm information to the enterprise platform, and displays the risk alarm information in a visual interface; the risk alarm information includes security risk events and their corresponding levels.

[0017] Knowledge graph technology is used to trace the source of risk warning information and obtain a source tracing report.

[0018] The enterprise platform is also used to identify enterprise security risks based on the received risk alarm information, formulate rectification measures and reports based on the enterprise security risks, and then feed the rectification measures and reports back to the local spatiotemporal data security monitoring platform.

[0019] The local spatiotemporal data security monitoring platform is also used to verify whether the rectification measures and reports reported by the enterprise platform are effective; if so, it will stop pushing risk warning information.

[0020] Furthermore, to demonstrate the core business processes of the local spatiotemporal data security monitoring platform and the interactive relationship between the platform (responsible by the regulatory authorities) and the access enterprise platform (responsible by the spatiotemporal data processor), the following virtual modules are used to illustrate the concepts of pre-event, during-event, and post-event supervision: The local spatiotemporal data security monitoring platform includes a registration management module, a real-time monitoring and early warning module, a risk handling and tracing module, and a supervision and inspection module. The registration management module implements a pre-registration and risk assessment process. This module receives registration information (including enterprise registration information, vehicle registration information, and spatiotemporal data processing activity information, with key operation logs) submitted by spatiotemporal data processors to the enterprise platform. It then conducts platform pre-review or formal review, content review (compliance and security review), risk assessment, and approval decisions on the registration information, obtaining an approval result (electronic receipt) and feeding it back to the enterprise platform. Simultaneously, when the approval result is successful registration, a communication connection is established with the enterprise platform, and the registration information is stored in a relational database. The approval record of the registration information is also uploaded to the blockchain for evidence preservation.

[0021] The real-time monitoring and early warning module enables real-time monitoring and early warning processes during events. This module is used to: receive spatiotemporal data processing activity information collected by vehicle-side and roadside platforms, which is compiled, packaged, and reported by the enterprise platform according to data transmission protocols; identify safety risks in the spatiotemporal data processing activity information based on a risk identification model (built using a rule engine and machine learning algorithms); and classify safety risk events based on a quantitative risk assessment model and a pre-defined four-level early warning system, obtaining the corresponding level of each safety risk event and pushing the safety risk event and its corresponding level to the enterprise platform. The quantitative risk assessment model is a quantitative evaluation matrix built based on the degree of risk severity and the frequency of risk occurrence.

[0022] The risk handling and tracing module enables post-event risk handling and tracing processes. This module is used to: conduct assessments of risk alarm information by the competent authority, generate security risk handling work orders, and automatically dispatch security risk handling work orders to the enterprise platform; receive rectification measures and reports from the enterprise platform, verify the effectiveness of the rectification measures and reports, and if so, stop pushing risk alarm information; and upload the handling records of risk alarm information to the blockchain.

[0023] Alternatively, when security risks and events are triggered, source tracing analysis is initiated. Based on preset metadata specifications, a spatiotemporal data source tracing model based on knowledge graphs is constructed, and the risk alarm information is traced using the spatiotemporal data source tracing model to obtain a source tracing report. The source tracing includes querying related logs, tracing data lineage, and locating the responsible party.

[0024] The supervision and inspection module enables the post-event supervision and inspection process. The supervision and inspection module is used to: generate spot check tasks and upload them to the blockchain, publicize or issue the tasks, receive the problems entered during the inspection process and send them to the enterprise platform, receive the rectification feedback from the enterprise platform and review it, and publicize the review results and upload them to the blockchain for evidence storage.

[0025] This application utilizes a local spatiotemporal data security monitoring platform to identify security risks in the spatiotemporal data processing workflow information uploaded by enterprise platforms. It then pushes risk alerts to the enterprise platforms in a tiered manner. This mechanism ensures the timeliness of security risk identification and response, enabling effective early warning before security incidents occur and achieving precise classification of security risks. Furthermore, the local spatiotemporal data security monitoring platform can trace the source of security risks and incidents, achieving full lifecycle traceability of spatiotemporal data. This helps enterprise platforms take targeted corrective measures and improve system security. In addition, enterprise platforms take corrective measures based on risk alerts from the local platform and generate corrective reports. The local platform verifies the effectiveness of these corrective measures, ensuring that risks are properly addressed and guaranteeing continuous system optimization and security.

[0026] Example 2 I. Platform Overall Architecture The local spatiotemporal data security monitoring platform acquires information on the processing flow of vehicle-side and cloud-based geographic information data throughout its entire lifecycle, enabling real-time monitoring of the entire geographic information data processing activity. Enterprise platforms should transmit relevant information to the local spatiotemporal data security monitoring platform according to the platform's requirements and a unified platform interaction communication protocol. The overall reference architecture of the local spatiotemporal data security monitoring platform is as follows: Figure 2 As shown.

[0027] II. Overall Technical Architecture The platform plans to adopt a cloud-native microservice architecture, deployed on a secure and compliant cloud infrastructure. The overall architecture is designed as a three-tiered distributed physical architecture and logical coordination system: "Local Area - Enterprise - Vehicle and Roadside," as follows... Figure 3 As shown, the local spatiotemporal data security monitoring platform includes an infrastructure layer, a data resource layer, a platform service layer, an application service layer, a presentation layer, and a system security and operation and maintenance layer.

[0028] (1) Infrastructure layer (IaaS) is used to provide stable, secure and elastic computing, storage and network resources, which can be deployed based on public cloud, private cloud or hybrid cloud that meet security requirements.

[0029] (2) The Data as a Service (DaaS) layer includes a data access gateway unit, a multimodal data storage unit, and a data governance and metadata management unit.

[0030] The data access gateway unit is responsible for securely and efficiently receiving full-element regulatory data (including vehicle / enterprise registration and filing information, vehicle / cloud periodic logs, event data, statistical data, spatiotemporal data processing flow information, etc.) reported from various enterprise platforms through standard protocols (TCP / IP application layer protocols), and performing data verification, data classification, and data decryption (using national cryptographic algorithms) on the full-element regulatory data.

[0031] Multimodal data storage unit: used to build data warehouses, time-series databases, relational databases and NoSQL databases. Data warehouses (such as Doris and MinIO object storage) store raw logs and semi-structured data, relational databases (such as PostgreSQL) store filing information, user information and business process data, and GIS databases (such as PostGIS) store spatial data such as geofencing, so as to achieve petabyte-level data storage capabilities.

[0032] Data Governance and Metadata Management Unit: Used to standardize, clean, de-identify (such as geographic information confidentiality processing, including coordinate offset and accuracy control), classify and grade (such as based on risk lists and standards), perform quality verification, lifecycle management (such as cold and hot data separation, archiving and destruction), and unify metadata management of all-element regulatory data.

[0033] (3) The Platform as a Service (PaaS) layer includes a big data processing engine unit, an AI and risk analysis engine unit, a GIS service unit, an authentication service unit, an on-chain evidence storage service unit, and a basic middleware unit, which are used to provide general technical capabilities to support upper-layer applications.

[0034] The big data processing engine unit is used for real-time stream processing via the Flink / Spark stream processing engine; and for offline batch processing and complex analysis via the Spark / Hive / Presto batch processing and interactive query engines.

[0035] The AI ​​and risk analysis engine unit is used to perform real-time risk identification, compliance assessment, and situation prediction on a list of spatiotemporal data security risk items based on a rule engine and machine learning model, combined with spatiotemporal data security risk categories.

[0036] The GIS service unit provides spatially relevant services such as map visualization, geofencing management and assessment, and spatial analysis. (Third-party services: such as NavInfo) The authentication service unit provides unified identity authentication (IAM, OAuth 2.0 / OIDC, digital certificates), access control (RBAC), national cryptographic encryption and decryption services (SM2 / SM4), and digital signature verification services.

[0037] The on-chain evidence storage service unit (cloud-chain integration) utilizes blockchain services to store key logs (approvals, operations, risk events), filing information, and inspection results on the blockchain. Combined with big data coding addressing and trusted auditing technologies, it ensures immutability and traceability. (Third-party service: such as Xinghuo Chain Network) The basic middleware unit provides basic technical support for API gateways, message queues (Kafka / RabbitMQ), configuration centers, and service registration and discovery (such as Consul / Eureka).

[0038] (4) The application service layer includes core business function modules such as filing management service module, real-time monitoring service module, risk warning service module, log management service module, traceability analysis service module (data lineage), supervision and inspection service module, statistical report service module, user permission service module and system management service module.

[0039] (5) Presentation layer: The management-side web portal (i.e., the management-side user service unit) is used to provide regulatory personnel with functions such as a comprehensive situation dashboard, filing review, real-time monitoring, risk management (based on a risk list), supervision and inspection (random inspections and public disclosure), emergency tracing, statistical analysis, and system management.

[0040] The enterprise-side web portal (i.e., the enterprise-side user service unit) is used to provide spatiotemporal data processors with functions such as filing application, data reporting configuration, compliance self-inspection, risk alarm reception, work order processing, log query and resource download (policies, standards).

[0041] API interfaces are used to provide standardized RESTful API interfaces for enterprise platforms or other authorized systems to call.

[0042] (6) System security and operation and maintenance layer, which is used to run through all layers, including network security, host security, application security, data security (complying with the graded protection requirements), security audit, API security protection (WAF), monitoring and alarm (Prometheus+Grafana), automated operation and maintenance (DevOps, CI / CD) and disaster recovery, etc.

[0043] III. Key Technology Implementation Path 1. Multi-level risk identification technology system (1) Closed-loop architecture design: Based on the closed-loop concept of "perception-analysis-early warning-disposal", a technical system is built to cover the vehicle end and cloud end in all aspects of risk identification capabilities.

[0044] (2) Technology integration: Integrating rule engines and machine learning and other technologies.

[0045] (3) Hierarchical model: a) Bottom layer (data perception): Real-time collection and preprocessing of raw data such as vehicle-side device status, data processing activities, and network communication behavior.

[0046] b) Middle layer (feature extraction and analysis): Using feature engineering techniques, risk features are extracted from four key dimensions: spatiotemporal features (location, trajectory, sensitive areas), behavioral features (collection, transmission, storage, access patterns), content features (sensitive information identification), and correlation features (cross-data source relationships), and then pattern recognition and correlation analysis are performed.

[0047] c) Upper layer (risk assessment and decision-making): Using risk assessment models and decision engines, the identified risk characteristics are comprehensively analyzed to determine the risk level and trigger early warnings.

[0048] (4) Key components: a) Rule Engine: Built on the Drools framework, it has a built-in rule library covering risks such as data leakage, tampering, destruction, loss, abuse, and forgery. It supports complex event processing and achieves millisecond-level real-time risk pattern matching.

[0049] b) Machine learning detection engine: Employs machine learning algorithms to enhance the ability to detect unknown risks and improve the accuracy of identifying key risk features.

[0050] (5) Risk identification rule base: It adopts a hierarchical classification architecture (quantitative rules, behavioral rules, feature rules, and comprehensive rules) to cover the entire lifecycle of data on the vehicle and cloud. It supports dynamic updates and flexible configuration to ensure the timeliness and adaptability of the rule base.

[0051] 2. Multi-source data fusion analysis and quantitative risk assessment (1) Fusion Architecture: A four-layer architecture of "collection-cleaning-fusion-analysis" is constructed to uniformly process multi-source heterogeneous data such as activity information and event data from vehicle end and cloud end spatiotemporal data processing. Standardized interfaces support parallel processing of real-time stream and batch data, the data cleaning layer ensures quality, and the data fusion layer forms a complete event chain based on the association of timestamps and entity identifiers.

[0052] (2) Core fusion analysis algorithm: a) Time-series correlation analysis: Based on a sliding time window, identify related events within a specific time period (such as data operations immediately following a stay in a sensitive area).

[0053] b) Spatial correlation analysis: Using GIS and spatial databases, analyze the spatial distribution of data processing activities (hotspot areas, abnormal clusters).

[0054] c) Entity association analysis: Construct a graph of relationships between vehicle, enterprise, and user entities, and use graph algorithms to identify abnormal data flow paths (such as potential leakage chains).

[0055] (3) Quantitative risk assessment model: a) Risk assessment matrix: Based on the results of the fusion analysis, a quantitative assessment matrix is ​​constructed with the degree of risk (such as the scope of impact and data sensitivity) and the probability of occurrence (such as frequency and degree of abnormality) as dimensions.

[0056] b) Risk classification and assessment: Based on the matrix, the identified risk events are classified into different risk level ranges (laying the foundation for subsequent graded early warning).

[0057] c) Adaptive weight adjustment algorithm: For dynamically changing scenarios (such as business rule updates, risk weight differences in different regions / time periods), an algorithm is designed to dynamically adjust the weights of each feature dimension, association rule, and risk factor in the model to ensure that the evaluation results remain accurate in complex environments and effectively uncover potential security risks and abnormal behaviors.

[0058] 3. Intelligent hierarchical early warning and closed-loop response mechanism (1) Tiered early warning system: A four-tiered early warning system of "red-orange-yellow-blue" is adopted, and the tiers are determined based on the results of the quantitative risk assessment model. Red (Emergency): Significant security impact (such as large-scale leaks, violations in classified areas). Real-time notifications through multiple channels, automatic activation of emergency response.

[0059] Orange (Severe): Medium to high risk of regulatory violations (e.g., unauthorized cross-border transmission, collection beyond permitted scope). Generate a detailed report and require a rectification plan within a specified timeframe.

[0060] Yellow (Warning): Low to medium risk with potential compliance issues (e.g., non-standard encryption, incomplete logs). Send rectification suggestions and include in credit assessment.

[0061] Blue (hint): Anomalies that require attention but pose no direct risk (such as a sudden increase in data volume or the connection of new devices). Record the information for subsequent analysis.

[0062] (2) Intelligent response strategy: a) Adaptive response mechanism: Based on the risk type, frequency, and scope of impact, the optimal response strategy is intelligently selected (e.g., initial low-risk warning and education, followed by repeated high-risk escalation measures).

[0063] b) Intelligent matching of emergency response plans: Based on risk type and level, automatically match preset or dynamically generated emergency response plans.

[0064] c) Joint Response Mechanism: Establish cross-departmental / hierarchical coordination. In the event of significant risks, regulatory authorities will be automatically notified, and multiple parties will be coordinated to jointly address the issues, with the entire process recorded to form a response chain.

[0065] (3) Closed-loop management mechanism: to achieve a complete closed loop of "monitoring-analysis-disposal-feedback": (4) Evaluation and optimization of early warning effectiveness: a) Accuracy assessment: Regularly analyze false positive rate and false negative rate, and optimize rules and model parameters.

[0066] b) Timeliness assessment: This includes assessing the delays in monitoring risk discovery, issuing early warnings, and initiating responses to ensure real-time performance.

[0067] c) Effectiveness assessment: Track the results of the handling, evaluate the effectiveness of the response strategy, and solidify successful experiences into standard procedures.

[0068] 4. Source tracing and emergency management technologies 4.1 Unified Metadata Standards and Traceability Model Construction (1) Regulatory standard mapping: Comprehensively analyze existing regulations and standards to clarify the compliance requirements of each link in the entire life cycle of spatiotemporal data (collection, storage, transmission, processing, use, and destruction) and the types of traceability information to be recorded (such as: operation subject, operation type, operation timestamp, operation location, data identifier, processing algorithm, target object, associated system, etc.) and their specific meanings.

[0069] (2) Metadata specification formulation: Based on compliance requirements, define a unified and standardized traceability metadata specification, covering data objects (such as raw data and derived data), data processing objects (such as systems, applications, algorithms, and users), related objects (such as vehicles and enterprises) and their important attribute information (such as identifiers, types, versions, locations, permissions, etc.).

[0070] (3) Knowledge graph tracing model: Based on the above metadata specifications, a spatiotemporal data tracing model based on knowledge graphs is constructed: a) Node: Abstractly represents data entities (including attributes: ID, type, size, etc.), processing entities (including attributes: enterprise ID, user ID, role, etc.), and operation behaviors; b) Edge attributes: express the data flow relationship between nodes (e.g., being collected, being transmitted to, being stored in, being destroyed, etc.). Edge attributes include timestamps, operation types, location information (geographic coordinates), context information, etc.

[0071] c) Process paradigm definition: The graph model clearly defines the standard traceability process paradigm in the spatiotemporal data processing process, and intuitively shows the data flow path, dependencies and scope of influence.

[0072] 4.2 Lightweight Traceability Information Collection and Storage (1) Distributed acquisition architecture: a) Vehicle-side collection: Real-time collection of the smallest granularity traceability unit through embedded modules, including: data collection location, timestamp, operation type, original data identifier, etc., using standardized format encoding.

[0073] b) Enterprise-side collection: Comprehensive collection of detailed information on data reception, processing, use, storage operations (add, delete, modify, query), access records, transmission logs, and other aspects.

[0074] (2) Lightweight storage: a) Relational Database Storage: An innovative lightweight table structure is designed for efficient storage of massive amounts of structured traceability records (metadata). The table structure design fully considers query efficiency (e.g., partitioning / indexing by time, subject, and data type), ensuring low-latency, complex conditional queries are supported without impacting business performance.

[0075] b) Graph Database Storage: Utilize graph databases to store and manage knowledge graph-based data lineage networks. Attribute storage for nodes and edges supports fast relation traversal and complex graph queries.

[0076] 4.3 Intelligent Tracking and Analysis Technology (1) Automated kinship construction: a) Multi-source metadata collection: Automated integration of information from various channels such as data processing logs, system call records, database transaction logs, and collection modules.

[0077] b) Rule matching and pattern recognition: Using a rule engine and pattern recognition algorithm, the upstream and downstream relationships, dependencies and influence relationships between data are automatically analyzed, and the kinship edges in the graph are constructed and continuously updated.

[0078] c) Manual supplementation mechanism: Supports manual annotation and relationship supplementation for complex or automated processes that cannot be fully captured, ensuring lineage integrity and accuracy.

[0079] (2) Efficient source tracing query: Supports multi-hop relationship query and complex condition filtering (such as time range, operation type, geographical location). Through the optimization of graph database and graph algorithm design, it can locate target information in seconds in a graph with tens of thousands of nodes.

[0080] IV. Platform Business Architecture, such as Figure 4 As shown, it includes the filing management domain, monitoring and perception domain, analysis and evaluation domain, early warning and handling domain, service support domain, and management and operation domain.

[0081] 1. Filing Management Domain Responsible for managing the access qualifications of all entities, objects, and behaviors involved in the spatiotemporal data processing activities of intelligent connected vehicles, and ensuring that all activities are conducted within a compliant framework.

[0082] Enterprise registration services: Manage basic information, surveying and mapping qualifications, security protection measures (management system + technical list), and safety responsibility information of data processors (platform operators, map service providers, automobile companies, and intelligent driving solution providers, etc.). Supports online application, review, query, and information maintenance.

[0083] Vehicle registration service: Manages information on intelligent connected vehicles within the regulatory scope, including vehicle identification number (VIN), vehicle model, sensor configuration list, data security processing capabilities (such as encryption and desensitization), and autonomous driving level. Supports single-vehicle registration and batch import.

[0084] Data processing activity filing business: manage specific spatiotemporal data processing activities, and clarify the activity type (such as data aggregation and de-identification processing, navigation electronic map production and scene dataset production and service, etc.), purpose, scope (geographic area, time period), data types involved (point cloud, image, mapping, inertial navigation and trajectory, etc.), processing methods (collection, storage, transmission, use, destruction, export, etc.), security risk assessment report and control measures.

[0085] Registration Modification and Cancellation Services: Supports online application and review for changes to registered information (such as updates to company information, changes to vehicle status, and adjustments to activity scope), as well as management of cancellation processes under specific conditions (such as vehicle scrapping or activity termination). All registration and modification records are subject to auditing and (critical nodes) blockchain notarization.

[0086] 2. Monitoring Sensing Domain The core function of the monitoring platform is to provide real-time and comprehensive perception of the safety status and behavior of vehicles, the cloud, and data processing activities, and to provide a data foundation for risk identification and situation assessment.

[0087] Vehicle-side data monitoring services: In accordance with filing requirements and standards, monitor the spatiotemporal data collection behavior (type, frequency, range, accuracy), data storage security (encryption, access control), data transmission behavior (destination, protocol, encryption), local processing behavior (de-identification, aggregation), and the reporting of related operation logs of vehicle terminals. Pay particular attention to whether there are any behaviors such as collecting data beyond the permitted scope, unauthorized storage, or abnormal transmission.

[0088] Enterprise cloud platform monitoring services: Monitoring the behavior of enterprise cloud platforms in receiving, storing, processing, transmitting, using, and destroying spatiotemporal data. This includes data aggregation, storage security measures (encryption, backup), access control policies, cross-border data flow (if required), data sharing / public disclosure, and the reporting of related operation logs.

[0089] Data processing activity monitoring: Based on registration information, monitor in real time whether actual data processing activities comply with registration requirements, such as whether vehicles are operating within the registered area, whether the data types collected are consistent with the registration, and whether the data processing methods are compliant. Utilize GIS technology for real-time geofencing assessment.

[0090] Data flow tracking service: By correlating and analyzing vehicle logs, cloud logs, and platform logs, we construct a view of the flow path of key data, track the entire process of data from collection, transmission, processing to use, and identify potential data leakage risks and unauthorized flow behaviors.

[0091] 3. Analysis and Evaluation Domain We conduct in-depth analysis and intelligent assessment of the massive amounts of monitored data to transform raw data into information on security risks, compliance status, and overall situation.

[0092] Spatiotemporal data security analysis service: Based on a custom spatiotemporal data security risk identification rule base and combined with machine learning models, it performs real-time / near real-time analysis on monitoring data and automatically identifies various known and unknown security risks, such as unauthorized collection of high-precision geographic information, data leakage in sensitive areas, and abnormal data aggregation.

[0093] Risk assessment services: Quantitatively assess identified security risks and determine their risk level (high, medium, low). Combine historical risk records, registration compliance, credit scores, and other factors to comprehensively assess the security risk level of a specific entity or activity. Regularly generate enterprise / regional risk assessment reports.

[0094] Compliance Audit Services: We automatically or semi-automatically audit a company's data processing activities and log records against relevant laws, regulations, standards, and filing requirements to assess their compliance. For example, we audit the effectiveness of data anonymization measures, the completeness and accuracy of log records, and whether data destruction complies with regulations. We generate compliance inspection reports.

[0095] Situational Awareness Business: Integrates multi-dimensional information such as filing information, real-time monitoring data, risk analysis results, and compliance audit conclusions, and uses visualization dashboards, statistical charts, risk maps, etc., to macroscopically display the overall spatiotemporal data security situation, major risk distribution, and risk evolution trends of a region / industry, providing a global view for regulatory decision-making.

[0096] 4. Early warning and response domain Responsible for translating the results of analysis and assessment into actual regulatory actions, achieving timely risk warnings, effective incident handling, and closed-loop process management.

[0097] Risk warning service: Based on risk assessment results and preset thresholds, automatically trigger risk warnings of different levels (such as SMS, email, platform messages, pop-up notifications). Accurately push warning information to relevant regulatory personnel and enterprise security managers.

[0098] Incident Handling Operations: For risk events that reach the handling threshold, automatically or manually generate handling work orders, clearly specifying incident details, responsible parties, handling requirements, and time limits. Supports the dispatch, circulation, tracking, and management of work orders.

[0099] Collaborative Response Operations: Establish collaborative response mechanisms within the relevant government departments and between the departments and enterprises. Support online communication, instruction issuance, information sharing, and emergency plan activation to ensure rapid and effective collaborative handling of major security incidents.

[0100] Tracking and Feedback Process: After receiving a work order, companies submit rectification measures and supporting documents online. Regulatory personnel review and confirm the rectification results. The platform records the entire process, forming a closed-loop management system, and incorporates the results into the company's credit assessment and subsequent regulatory priorities. Key information at each stage of the process is stored on the blockchain as evidence.

[0101] 5. Service Support Domain Provide necessary services and support to participating enterprises to help them understand compliance requirements, improve security capabilities, reduce compliance risks, and promote positive interaction between government and enterprises.

[0102] Enterprise compliance services: We provide resources such as policy and regulation databases, standard and specification searches, best practice case sharing, and compliance self-inspection tools or guidelines to help enterprises understand and implement data security compliance requirements.

[0103] Risk reporting service: (optional) Provides enterprises with a channel to proactively report security risks or incidents they discover internally, encouraging enterprise self-discipline and transparency.

[0104] 6. Management and Operation Domain Ensuring the platform's stable, secure, and efficient operation is fundamental, encompassing backend support work such as system management, operation and maintenance monitoring, data governance, and security protection.

[0105] System management functions include basic management functions such as user account management, role-based access control (RBAC), organizational structure management, geofencing management, system parameter configuration, and dictionary management.

[0106] Platform Operations and Maintenance: Responsible for the daily monitoring (performance, availability, logs), alarm handling, fault diagnosis, version release, scaling up and down, backup and recovery, disaster recovery drills and other operations and maintenance work of the platform to ensure stable operation of the platform 24 / 7.

[0107] Data Management: Responsible for the governance of data within the platform, including data quality monitoring, metadata maintenance, data lifecycle management (storage, archiving, destruction), and execution of data backup and recovery strategies.

[0108] Security Assurance Services: Responsible for the platform's own security protection, including network security (firewall, WAF, IPS / IDS), host security, application security (vulnerability scanning, security hardening), data security (encryption, desensitization, leakage prevention), security auditing, situational awareness, and incident response, ensuring that the platform meets the relevant requirements of network security level protection.

[0109] This application utilizes multi-source data fusion analysis, correlation analysis, and other technologies to establish a spatiotemporal data quantitative risk assessment model, construct a risk assessment matrix and risk classification and evaluation method based on the degree of harm and probability of occurrence of data security risks; establishes an adaptive weight adjustment algorithm to improve the adaptability of the risk assessment model to dynamic scenarios and accurately uncover potential security risks and abnormal behaviors; at the same time, it constructs a "monitoring-analysis-handling-feedback" early warning response and handling mechanism to realize automated graded early warning of risk events and intelligent matching of handling plans, thereby improving the timeliness and effectiveness of risk response.

[0110] This application, based on existing regulations and standards, comprehensively analyzes the compliance requirements of each stage of the spatiotemporal data lifecycle, clarifies the types and meanings of traceability information, and establishes a unified metadata specification. It structures the important attribute information contained in data objects, data processing objects, and their related objects, constructs a knowledge graph-based spatiotemporal data traceability model, and clarifies the traceability process paradigm in spatiotemporal data processing. Utilizing relational data storage and other technologies, it designs a lightweight data table structure, establishes a spatiotemporal data lifecycle traceability information database, and achieves efficient storage and low-latency querying of massive traceability data. This breaks through the limitations of traditional traceability methods, improves the accuracy and efficiency of traceability, and enables efficient storage and low-latency querying of massive traceability data.

[0111] Based on the main links and actors in the entire life cycle of spatiotemporal data, this application innovates management systems such as classification and grading, security risk assessment, and monitoring and early warning mechanisms, optimizes risk prevention and control processes, and for the first time clarifies the prevention and control requirements and management responsibilities of industry authorities and spatiotemporal data processors. It innovatively constructs a spatiotemporal data security risk prevention and control system covering local and enterprise terminals, breaks through the limitations of previous single-entity prevention and control, and forms a new pattern of all-round and multi-level collaborative prevention and control.

[0112] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0113] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0114] This document uses specific examples to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. Furthermore, those skilled in the art will recognize that, based on the ideas of this application, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. An intelligent networked vehicle space-time data security monitoring system, characterized in that, The intelligent networked vehicle space-time data security monitoring system comprises: a vehicle-end platform configured to collect space-time data processing flow information at the vehicle-end and upload the space-time data processing flow information at the vehicle-end to an enterprise platform; a road-end platform configured to collect space-time data processing flow information at the road-end and upload the space-time data processing flow information at the road-end to the enterprise platform; the enterprise platform configured to report the received space-time data processing flow information to a local space-time data security monitoring platform according to a preset cycle frequency based on a unified data interface protocol; the local space-time data security monitoring platform configured to: identify security risks of the space-time data processing flow information submitted by the enterprise platform to obtain risk warning information, and push the risk warning information to the enterprise platform, and display the risk warning information on a visual interface; the risk warning information comprises a security risk event and a corresponding level; trace the risk warning information using a knowledge graph technology to obtain a traceability report; the enterprise platform is further configured to determine an enterprise security risk problem according to the received risk warning information, and form rectification measures and a report according to the enterprise security risk problem, and then feed back the rectification measures and the report to the local space-time data security monitoring platform; the local space-time data security monitoring platform is further configured to verify whether the rectification measures and the report fed back by the enterprise platform are effective; if so, stop pushing the risk warning information. 2.The intelligent networked vehicle space-time data security monitoring system of claim 1, wherein, The local space-time data security monitoring platform comprises a record management module, which is configured to: perform form review, content review and risk assessment on the obtained registration record information of the enterprise platform to obtain an approval result; the registration record information comprises enterprise record information and vehicle record information; when the approval result is registration record success, establish a communication connection with the enterprise platform, store the registration record information in a relational database, and upload the approval record of the registration record information to a block chain for storage. 3.The intelligent networked vehicle space-time data security monitoring system of claim 1, wherein, The local space-time data security monitoring platform comprises a real-time monitoring and early warning module, which is configured to: real-time receive space-time data processing activity information collected by the vehicle-end platform and the road-end platform and reported by the enterprise platform; identify security risks of the space-time data processing activity information based on a risk identification model to obtain a security risk event; the risk identification model is constructed based on a rule engine and a machine learning algorithm; based on a quantitative risk assessment model and a preset four-level early warning system, the security risk event is processed in a hierarchical manner to obtain a corresponding level of the security risk event, and the security risk event and the corresponding level are pushed to the enterprise platform; the quantitative risk assessment model is a quantitative evaluation matrix constructed based on risk hazard degree and risk occurrence frequency. 4.The intelligent networked vehicle space-time data security monitoring system of claim 1, wherein, The local space-time data security monitoring platform comprises a risk disposal and traceability module, which is configured to: make a judgment on the risk warning information by a competent department, generate a security risk disposal work order, and automatically distribute the security risk disposal work order to the enterprise platform; Receive the rectification measures and reports of the enterprise platform feedback, and verify whether the rectification measures and reports are effective. If so, stop pushing the risk warning information, and upload the risk warning information disposal record to the blockchain; Based on the preset metadata specification, a knowledge graph-based spatio-temporal data traceability model is constructed, and the spatio-temporal data traceability model is used for traceability tracking of the risk warning information to obtain a traceability report; the traceability tracking includes querying associated logs and locating responsible subjects. 5.The intelligent networked vehicle space-time data security monitoring system of claim 1, wherein, The attribute space-time data security monitoring platform adopts a three-level distributed physical architecture and a logical coordination system. The three-level distributed physical architecture is composed of attributes, enterprises, and vehicle and road ends. The attribute space-time data security monitoring platform includes an infrastructure layer, a data resource layer, a platform service layer, an application service layer, a presentation layer, and a system security and operation and maintenance layer. 6.The intelligent networked vehicle space-time data safety monitoring system of claim 5, wherein, The data resource layer includes a data access gateway unit, a multi-modal data storage unit, and a data governance and metadata management unit. The data access gateway unit is configured to receive full-element supervision data reported by the enterprise platform, and perform data signature verification, data classification, and data decryption on the full-element supervision data. The full-element supervision data includes registration and record information and spatio-temporal data processing flow information. The multi-modal data storage unit is configured to construct a data warehouse, a time series library, a relational database, and a NoSQL database. The data governance and metadata management unit is configured to standardize, classify, and grade the full-element supervision data, perform quality verification, life cycle management, and unified metadata management. 7.The intelligent vehicle space-time data security monitoring system of claim 5, wherein, The platform service layer includes a big data processing engine unit, an AI and risk analysis engine unit, a GIS service unit, an authentication service unit, a chain storage service unit, and a basic middleware unit. The big data processing engine unit is configured to perform real-time stream processing, offline batch processing, and complex analysis. The AI and risk analysis engine unit is configured to perform real-time risk identification, compliance judgment, and situation prediction on the spatio-temporal data security risk item list based on a rule engine and a machine learning model. The GIS service unit is configured to provide spatial related services. The spatial related services include map visualization, geographic fence management and judgment, and spatial analysis. The authentication service unit is configured to provide unified identity authentication, permission management, national encryption and decryption services, and digital signature verification services. The chain storage service unit is configured to store key logs, registration and record information, and approval results on the chain. The basic middleware unit is configured to provide basic technical support, including API gateway, message queue, configuration center, and service registration and discovery. 8.The intelligent networked vehicle space-time data security monitoring system of claim 5, wherein, The application service layer includes a record management service module, a real-time monitoring service module, a risk early warning service module, a log management service module, a traceability analysis service module, a supervision and inspection service module, a statistical report service module, a user permission service module, and a system management service module. 9.The intelligent vehicle space-time data security monitoring system of claim 5, wherein, The presentation layer includes a management end user service unit, an enterprise end user service unit, and an API interface. The management end user service unit is configured to provide comprehensive situation large screens, record review, real-time monitoring, risk management, supervision and inspection, emergency traceability, statistical analysis, and system management functions for supervisors. The enterprise end-user service unit is configured to provide functions of filing application, data reporting configuration, compliance self-check, risk warning receiving, work order processing, log query and resource download for the spatio-temporal data processor; The API interface is configured to provide a standardized RESTful API interface to the enterprise platform.

10. A smart connected vehicle space-time data security monitoring method, characterized in that, The intelligent connected vehicle spatio-temporal data security monitoring method comprises: The vehicle end platform collects spatio-temporal data processing flow information at the vehicle end and uploads the spatio-temporal data processing flow information at the vehicle end to the enterprise platform; The road end platform collects spatio-temporal data processing flow information at the road end and uploads the spatio-temporal data processing flow information at the road end to the enterprise platform; The enterprise platform reports the received spatio-temporal data processing flow information to the local spatio-temporal data security monitoring platform according to a preset cycle frequency based on a unified data interface protocol; The local spatio-temporal data security monitoring platform identifies security risks from the spatio-temporal data processing flow information submitted by the enterprise platform, obtains risk warning information, and pushes the risk warning information to the enterprise platform and displays the risk warning information on a visual interface; the risk warning information includes security risk events and corresponding levels; The local spatio-temporal data security monitoring platform traces the risk warning information using knowledge graph technology to obtain a traceability report; The enterprise platform determines enterprise security risk problems according to the received risk warning information, forms rectification measures and reports according to the enterprise security risk problems, and then feeds back the rectification measures and reports to the local spatio-temporal data security monitoring platform; The local spatio-temporal data security monitoring platform verifies whether the rectification measures and reports fed back by the enterprise platform are effective; if so, the pushing of the risk warning information is stopped.

Images