Artificial intelligence-based vehicle networking data cross-border compliance management method

Abstract

The present application relates to the field of data security and cross-border data transmission compliance of Internet of Vehicles, and particularly relates to a cross-border compliance management method for Internet of Vehicles data based on artificial intelligence.Under the condition of not relying on gateway to restore global space-time context, a closed-loop management of end-side perception, cloud-side desensitization and boundary interception is formed, which avoids both the missed judgment caused by static rules on the gateway side due to context fault and the impact on normal cross-border Internet of Vehicles business caused by one-size-fits-all blocking.

Description

Technical Field

[0001] This application relates to the field of vehicle-to-everything (V2X) data security and cross-border data transmission compliance, specifically to an artificial intelligence-based method for cross-border compliance management of V2X data. Background Technology

[0002] With the rapid development of the intelligent connected vehicle industry, vehicles continuously generate a large amount of location coordinates, driving trajectories, and vehicle operating condition data through onboard sensors and telematics terminals. This data inevitably needs to be transmitted across borders in the global business collaboration of multinational automakers. While vehicle-to-everything (V2X) data exhibits strong spatiotemporal continuity when generated at the vehicle end, and single-frame location coordinates or single-transaction operating condition signals are not sensitive in a discrete state, the cumulative effect of consecutive frames in time and space may cause the aggregated data to cross the regulatory boundaries of personal information protection and geospatial data security.

[0003] However, during the flow of vehicle-to-everything (V2X) data through public mobile communication networks to cross-border gateways, it is segmented into discrete message packets or interface requests. The reviewing end can only see these discrete slices at the gateway, losing the global spatiotemporal context of the generating end. In existing technologies, cross-border compliance control largely relies on static rules or data type blacklists on the gateway side. The reviewing end cannot recover the cumulative effect of continuous trajectories within sensitive areas from the discrete slices, leading to missed detections. Furthermore, blocking all outbound data carrying location attributes would severely impact normal cross-border V2X business operations. Therefore, there is an urgent need for a technical solution that can achieve refined cross-border compliance control of V2X data without relying on gateways to recover the global spatiotemporal context. Summary of the Invention

[0004] The main purpose of this application is to provide an AI-based method for cross-border compliance management of vehicle network data, so as to at least solve the problems in the prior art where sensitivity transitions are difficult to identify due to spatiotemporal context breaks during cross-border transmission of vehicle network data, static rules on the gateway side are prone to being missed, and one-size-fits-all blocking affects normal cross-border business.

[0005] To achieve the above objectives, according to one aspect of this application, a method for cross-border compliance management of vehicle network data based on artificial intelligence is provided, comprising the following steps:

[0006] The machine learning model extracts spatiotemporal continuity features and operating condition combination features from the vehicle's raw data. The spatiotemporal continuity features include trajectory features to calculate the sensitivity transition risk index within the current time window. Based on the sensitivity transition risk index, the vehicle's raw data is dynamically mapped to the corresponding compliance level to generate a data stream with dynamic compliance level labels and a context feature vector.

[0007] Based on the dynamic compliance level label, an intelligent routing strategy is triggered for the data stream; when the compliance level indicator is general business data, the data stream is encrypted and transferred; when the compliance level indicator is personal sensitive and geospatial data, the data stream is routed to a localized data center, and the trajectory features are generalized using the context feature vector to generate a pseudonymous data stream with decoupled identity mapping, while calculating the identity trajectory decoupling confidence.

[0008] At the cross-border gateway, the confidence level of the identity trajectory decoupling in the pseudonymous data stream about to leave the country is extracted; the confidence level of the identity trajectory decoupling is cross-validated with a security threshold; when the confidence level of the identity trajectory decoupling is lower than the security threshold, an interception command is issued to block the pseudonymous data stream from leaving the country.

[0009] Optionally, the step of extracting spatiotemporal continuity features and operating condition combination features from the original vehicle data using a machine learning model to calculate the sensitivity transition risk index within the current time window, and dynamically mapping the original vehicle data to the corresponding compliance level, includes:

[0010] Obtain the original vehicle data, including location coordinates, timestamps, and vehicle operating conditions, from the vehicle terminal;

[0011] The raw vehicle data is input into the pre-trained machine learning model to extract trajectory curvature and speed change features, and the probability of touching the regulatory boundary after data aggregation within the current time window is calculated and used as the sensitivity transition risk index.

[0012] Determine whether the sensitivity transition risk index is greater than the risk threshold;

[0013] When the sensitivity transition risk index is greater than the risk threshold, the original vehicle data is mapped to the compliance level corresponding to the personal sensitivity and geospatial data.

[0014] When the sensitivity transition risk index is not greater than the risk threshold, the original vehicle data is mapped to the compliance level corresponding to the general business data to obtain the data stream with dynamic compliance level label and the context feature vector.

[0015] Optionally, the steps of routing the data stream to a localized data center, generalizing the trajectory features using the context feature vector to generate a pseudonymous data stream with decoupled identity mapping, and simultaneously calculating the identity trajectory decoupling confidence include:

[0016] The dynamic compliance level label is parsed, and the data stream mapped to the compliance level corresponding to the personal sensitive data and geospatial data is routed to the de-identification engine of the localized data center;

[0017] The trajectory features are generalized to a spatial grid using the context feature vector, and a one-time random identifier is generated to replace the real vehicle identity, thereby generating the pseudonymous data stream of the decoupled identity mapping;

[0018] The pseudonymous data stream is subjected to reverse re-identification test by a discriminator model in an adversarial generative network. The probability of failing to reverse-engineer the real vehicle identity is used as the confidence level of the identity trajectory decoupling, and the confidence level of the identity trajectory decoupling is added to the pseudonymous data stream.

[0019] Optionally, the steps of extracting the identity trajectory decoupling confidence level from the pseudonymous data stream about to exit the country at the cross-border gateway, cross-validating the identity trajectory decoupling confidence level with a security threshold, and executing the operation of issuing an interception command include:

[0020] The exit request is intercepted at the cross-border gateway, and the identity trajectory decoupling confidence score attached to the pseudonymous data stream is extracted.

[0021] The confidence level of the decoupled identity trajectory is compared and verified with a security threshold.

[0022] When the confidence level of the identity trajectory decoupling is lower than the security threshold, the operation of issuing the interception command is executed to reject the outbound request and record the interception log.

[0023] When the confidence level of the identity trajectory decoupling is not lower than the security threshold, the pseudonymous data is allowed to flow out of the country.

[0024] By applying the technical solution of this application, the system extracts spatiotemporal continuity features and operating condition combination features from the vehicle's original data using a temporal machine learning model at the vehicle end and calculates the sensitivity transition risk index. This brings compliance awareness forward to the data generation end, allowing the sensitivity transition risk caused by spatiotemporal accumulation to be captured before the data leaves the vehicle. Intelligent routing and deep desensitization are performed in the localized data center based on dynamic compliance level labels. Trajectory generalization and identity decoupling are completed for personal sensitive data and geospatial data within the localized boundary. The probability of reverse re-identification of the desensitized data is quantified using a discriminator in an adversarial generative network. Cross-validation is performed at the cross-border gateway using the identity trajectory decoupling confidence level as a lightweight criterion and the security threshold of the target locality's regulations. When the confidence level is insufficient, an interception command is issued. This forms a closed-loop control system of end-side perception, cloud-side desensitization, and boundary interception without relying on the gateway to restore the global spatiotemporal context. This avoids missed judgments caused by context gaps in the static rules at the gateway side and avoids the impact of a one-size-fits-all approach on normal cross-border vehicle networking services. Attached Figure Description

[0025] The accompanying drawings, which form part of this application, are used to provide a further understanding of this application. The illustrative embodiments and descriptions of this application are used to explain this application and do not constitute an undue limitation of this application. In the drawings:

[0026] Figure 1 A hardware structure block diagram of an electronic device for implementing an AI-based cross-border compliance management method for connected vehicle data is shown in an embodiment of this application.

[0027] Figure 2 A flowchart illustrating a cross-border compliance management method for vehicle network data based on artificial intelligence, according to an embodiment of this application, is shown.

[0028] The above figures include the following reference numerals:

[0029] 102. Processor; 104. Memory; 106. Transmission device; 108. Input / output device. Detailed Implementation

[0030] It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other. This application will now be described in detail with reference to the accompanying drawings and embodiments.

[0031] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0032] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate for the embodiments of this application described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0033] For ease of description, the following explains some of the nouns or terms used in the embodiments of this application:

[0034] Vehicle-to-everything (V2X) data: data collected and transmitted by vehicles through onboard telematics terminals, autonomous driving domain controllers, and onboard sensors, including at least location coordinates, timestamps, vehicle operating conditions, and identification information associated with the vehicle's identity;

[0035] Sensitivity transition: Vehicle data is not sensitive in a discrete state in a single frame, but after spatiotemporal aggregation within a time window, it touches the boundary of personal information protection or geospatial data security regulations.

[0036] Pseudonymization: a processing method that makes it impossible to attribute data to a specific data subject without additional information. In this application, it specifically refers to reducing trajectory accuracy through spatial grid generalization and replacing the real vehicle identity with a one-time random identifier.

[0037] Identity-trajectory decoupling confidence: The probability that the pseudonymous data stream after anonymization fails to reverse the identification of the real vehicle in the reverse re-identification test of the adversarial generative network discriminator, which is used to quantify the degree of decoupling between identity and trajectory;

[0038] Localized data center: A data center deployed within the country or region where the data was generated, responsible for storing and de-identifying the original plaintext data. The original plaintext data does not leave the localized boundary during the entire processing.

[0039] Cross-border compliance gateway: A network node deployed in series or in a bypass manner on the outbound link, with deep packet inspection or application programming interface gateway interception capabilities, responsible for verifying and intercepting outbound data in accordance with the laws and regulations of the target country;

[0040] Generative Adversarial Networks: A generative network architecture consisting of a generator and a discriminator. In this application, the generator performs trajectory generalization and identity replacement, while the discriminator simulates the attacker's perspective and attempts to infer the real vehicle identity based on the pseudonymous trajectory.

[0041] As described in the background section, existing technologies for cross-border transmission of vehicle network data suffer from problems such as difficulty in identifying sensitivity transitions due to spatiotemporal context breaks, easy omissions in static rules on the gateway side, and one-size-fits-all blocking that affects normal cross-border business. To solve these problems, embodiments of this application provide an artificial intelligence-based method for cross-border compliance management of vehicle network data.

[0042] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0043] The methods and embodiments provided in this application can be executed in vehicle-side edge computing modules, localized data center servers, cross-border gateways, or similar computing devices. Taking running on an electronic device as an example... Figure 1 This is a hardware structure block diagram of an electronic device that implements an AI-based cross-border compliance management method for vehicle network data, according to an embodiment of the present invention. Figure 1 As shown, an electronic device may include one or more ( Figure 1 Only one is shown in the image. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The electronic device may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the electronic device described above. For example, the electronic device may also include components that are more... Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown are as follows. In the cross-border data transmission architecture of the Internet of Vehicles in this application, the vehicle-side edge computing module is the processor and memory in the vehicle-mounted telematics terminal or the autonomous driving domain controller, the localized data center includes a server cluster, an encrypted database and key management services, and the cross-border gateway includes network devices with deep packet inspection capabilities. The above parts work together to execute the method of this application.

[0044] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the AI-based cross-border compliance management method for vehicle network data in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the electronic device via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The transmission device 106 is used to receive or send data via a network. Specific examples of the aforementioned networks may include wireless networks provided by the communication provider of the electronic device. In one example, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0045] This embodiment provides an AI-based method for cross-border compliance management of vehicle network data, which runs on an on-vehicle edge computing module, a localized data center server, a cross-border gateway, or a similar computing device. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Also, although the logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0046] Figure 2 This is a flowchart of an AI-based cross-border compliance management method for vehicle network data, according to an embodiment of this application. Figure 2 As shown, the method includes the following steps:

[0047] The specific embodiments of this application will be further described in detail below, based on the cross-border data transmission architecture of the Internet of Vehicles upon which this application is based and the technical solutions defined in the claims. It should be understood that the specific embodiments described herein are only for explaining this application and are not intended to limit this application.

[0048] The hardware and network links used in this application objectively include four parts: the vehicle-side, the localized data center, the cross-border compliance gateway, and the overseas data center. The vehicle-side obtains vehicle status messages via the in-vehicle remote information processing terminal or autonomous driving domain controller through the in-vehicle controller local area network bus, and obtains location coordinates and timestamps through the global navigation satellite system module. An encrypted channel is established between the vehicle-side and the localized data center via a public mobile communication network. Cross-border interactions between the localized data center and the overseas data center inevitably pass through cross-border nodes with deep packet inspection or application programming interface (API) gateway interception capabilities. The method flow of this application is executed collaboratively by computer programs deployed on the vehicle-side edge computing module, the localized data center server, and the cross-border gateway. Data and control commands are transmitted between these parts through message queues or APIs. The vehicle-side generates continuous time-series data, but during transmission, it is segmented into discrete message packets or interface requests. The reviewing end can only see discrete slices at the gateway and loses the global spatiotemporal context of the generating end. The processing flow of this application revolves around this contextually fragmented structure.

[0049] Step S201: Extract the spatiotemporal continuity features and working condition combination features from the original vehicle data using a machine learning model, calculate the sensitivity transition risk index within the current time window, and dynamically map the original vehicle data to the corresponding compliance level based on the sensitivity transition risk index, generating a data stream with dynamic compliance level labels and a context feature vector.

[0050] Specifically, this step is executed by a computer program deployed on the vehicle-side edge computing module. During vehicle operation, time-series data containing location and operating conditions is continuously generated. The vehicle-side edge computing module segments the collected raw vehicle data according to fixed time windows, extracting spatiotemporal continuity features and operating condition combination features from the data within each window. The spatiotemporal continuity features are constructed around trajectory features to characterize the vehicle's spatial movement pattern within the time window; the operating condition combination features are constructed around the vehicle's operating state to reflect changing patterns of driving behavior. The machine learning model calculates a sensitivity transition risk index within the current time window based on these features. This index represents the degree of risk that the vehicle data will encounter regulatory boundaries after spatiotemporal aggregation. The vehicle-side edge computing module dynamically maps the raw vehicle data to different compliance levels according to the sensitivity transition risk index, and writes the classification results into the metadata field of the data stream in the form of dynamic compliance level labels. Simultaneously, the context feature vector generated during feature extraction is passed along with the data stream for use in subsequent stages.

[0051] Step S202: Based on the dynamic compliance level label, trigger an intelligent routing strategy for the data stream, perform encrypted transfer on general business data, route sensitive personal data and geospatial data to the localized data center for trajectory generalization and identity replacement, generate a pseudonymous data stream with decoupled identity mapping and calculate the confidence level of identity trajectory decoupling.

[0052] Specifically, this step is executed collaboratively by the routing gateway and processing components within the localized data center. After a data stream with a dynamic compliance level label enters the localized data center, the routing gateway parses the label and triggers different routing strategies based on the compliance level indicated by the label. For data streams with a compliance level indicating general business data, the routing gateway sends them to the regular outbound queue and performs encrypted transfer, ensuring the data is transmitted overseas under encrypted protection. For data streams with a compliance level indicating sensitive personal data or geospatial data, the routing gateway routes them to the localized data center for desensitization processing. It then uses the context feature vector passed in the previous step to generalize the trajectory features, reducing the spatial precision of the trajectory so that the overseas side cannot reconstruct the vehicle's precise location. Simultaneously, identity information is replaced, generating a pseudonymous data stream where identity and trajectory are decoupled. After completing trajectory generalization and identity decoupling, the confidence level of identity-trajectory decoupling is calculated. This confidence level quantifies the degree of decoupling between identity and trajectory in the pseudonymous data stream and is sent to the cross-border gateway along with the pseudonymous data stream.

[0053] Step S203: Extract the identity trajectory decoupling confidence level from the pseudonymous data stream about to leave the country at the cross-border gateway, cross-validate it with the security threshold, and issue an interception command to block the pseudonymous data stream from leaving the country when the identity trajectory decoupling confidence level is lower than the security threshold.

[0054] Specifically, this step is executed by a computer program deployed on a cross-border gateway. The cross-border gateway is deployed at the physical boundary of the outbound link. When a pseudonymous data stream arrives at the gateway and is about to exit the country, the gateway extracts the identity trajectory decoupling confidence level from the data stream. Simultaneously, the gateway obtains the dynamic matching rules of the target jurisdiction's regulations. These rules are stored in a structured manner and can be dynamically synchronized as regulations are updated. The rules contain the security thresholds required by the target jurisdiction for the corresponding data types. The gateway cross-validates the extracted identity trajectory decoupling confidence level with the security thresholds. When the confidence level is lower than the security threshold, it is determined that the decoupling degree of the pseudonymous data stream does not meet the requirements of the target jurisdiction's regulations. The gateway then issues an interception command, blocking the pseudonymous data stream from exiting the country.

[0055] This embodiment moves compliance actions forward to the data generation end, using a time-series machine learning model to calculate a sensitivity transition risk index on the vehicle side, enabling risks arising from spatiotemporal accumulation to be captured before the data leaves the vehicle. Subsequently, based on the dynamic classification results, physical isolation and deep anonymization are completed in the localized data center. Trajectory accuracy is reduced through trajectory generalization, identity association is severed through identity replacement, and the probability of the anonymized data being reverse-recognized is quantified. Finally, regulatory verification is completed at the cross-border gateway using this probability value as a lightweight criterion. These three links are sequentially connected, forming a closed loop of end-side perception, cloud-side anonymization, and boundary interception. This achieves refined compliance management of cross-border vehicle network data without relying on the gateway to restore the global context, avoiding both the omission of static rules and the impact of a one-size-fits-all approach to blocking normal cross-border business.

[0056] From the perspective of the overall technology chain, the design principle of this solution is as follows: Vehicle-to-everything (V2X) data has a strong spatiotemporal context when generated at the vehicle end, but it is broken down into discrete data packets when flowing to the cross-border gateway. As a result, the review end loses the global perspective needed to identify sensitivity transitions. If only static rules are added at the gateway side, the review end cannot recover the cumulative effect of continuous trajectories in sensitive areas from discrete slices, leading to missed detections. If all outbound data is blocked, it will affect normal cross-border business. This application moves compliance actions forward to the data generation end. First, a temporal machine learning model is used to calculate the sensitivity transition risk index at the vehicle end, so that the risk caused by spatiotemporal accumulation is captured before the data leaves the vehicle. Then, based on the dynamic classification results, physical isolation and deep desensitization are completed in the localized data center. Spatial grid generalization reduces trajectory accuracy, one-time random identifiers sever identity associations, and the discriminator of the adversarial generative network quantifies the probability of the desensitized data being reverse-re-identified. Finally, this probability value is used as a lightweight criterion to complete regulatory verification at the cross-border gateway. The three stages are interconnected. The dynamic compliance level label output by the previous stage determines the routing direction; the context feature vector restored after routing supports trajectory generalization; and the identity trajectory decoupling confidence score added after anonymization becomes the numerical basis for gateway verification. Thus, a closed loop of edge-side awareness, cloud-side anonymization, and boundary interception is formed without relying on the gateway to restore the global context. There are clear transmission relationships between the parameters in this closed loop: risk threshold... The grid side length in the data masking strategy determines whether data enters the data masking engine. With noise scale The success rate of re-identification measured by the discriminator affects the confidence level. The value, while the safety threshold given by the regulations of the target territory. The final decision is made on whether the data packet is allowed to pass. By jointly optimizing the de-identification parameters and discriminator in a localized cloud environment, it is possible to meet the following requirements. Maximize under constraints To ensure accuracy and data availability, and to avoid excessive anonymization that could prevent overseas business operations from taking place.

[0057] In some embodiments, the step of extracting spatiotemporal continuity features and operating condition combination features from the vehicle's raw data based on a machine learning model to calculate a sensitivity transition risk index within the current time window, and dynamically mapping the vehicle's raw data to the corresponding compliance level, includes: obtaining the vehicle's raw data containing location coordinates, timestamps, and vehicle operating conditions from the vehicle; inputting the vehicle's raw data into the pre-trained machine learning model to extract trajectory curvature and speed change features, and calculating the probability of data aggregation within the current time window touching regulatory boundaries, using this as the sensitivity transition risk index; determining whether the sensitivity transition risk index is greater than a risk threshold; when the sensitivity transition risk index is greater than the risk threshold, mapping the vehicle's raw data to the compliance level corresponding to the personal sensitivity and geospatial data; when the sensitivity transition risk index is not greater than the risk threshold, mapping the vehicle's raw data to the compliance level corresponding to the general business data, thereby obtaining the data stream with dynamic compliance level labels and the context feature vector. This embodiment directly acquires multi-source raw data from the vehicle and calculates the probability of touching regulatory boundaries after data aggregation using trajectory curvature and speed change characteristics. This enables the risk index to accurately reflect the spatiotemporal cumulative effect. Furthermore, it achieves dynamic data classification through a binary judgment of risk thresholds, solving the problem that single-frame data cannot identify sensitivity transitions. The specific technical details of this embodiment are described below.

[0058] After the data enters the vehicle-side edge computing module, the first step is to acquire the vehicle's raw data and unify the time base. The raw vehicle data collected by the vehicle-side module includes at least three types of fields: location coordinates, timestamp, and vehicle operating condition. Location coordinates are represented by longitude and latitude, denoted as... Before participating in geometric calculations, the coordinates are first converted to plane coordinates using Mercator projection or universal transverse Mercator projection. To avoid dimensional bias caused by latitude and longitude directly participating in distance calculations; the timestamp is recorded as The time is derived from satellite timing or a unified clock on the vehicle, and all calculations are based on this unified time reference; vehicle operating condition fields include vehicle speed. Turning angle or heading angle And other state variables on the Controller Area Network (CLAN) bus. Because CLAN messages and satellite positioning messages originate from different sources and have different sampling frequencies, they need to be aligned using timestamps as the key before being concatenated into a unified sequence. For missing fields within a certain period, data from the previous valid period is used to fill in the gaps, and the filling operation is recorded in the data quality flag so that subsequent models assign lower weights to that frame during inference. For outliers that significantly exceed the physical range, such as negative vehicle speed or coordinate jumps exceeding the vehicle's maximum feasible displacement, the frame is marked as invalid and replaced by the previous valid frame. The aligned sequence is then processed according to a fixed length. A sliding window segmentation method is used, where adjacent windows can overlap by a certain number of frames to prevent risk events at trajectory boundaries from being truncated. The window slides forward as the acquisition progresses, and feature extraction and risk index calculation are triggered once a complete window is formed. The number of consecutive frames participating in a single risk index calculation is denoted as... Its value is determined by both the sampling frequency and the business scenario: a smaller value is taken when the sampling frequency is high. When the sampling frequency is low or when it is necessary to observe the long-term spatiotemporal cumulative effect, a larger value should be taken. In engineering practice, this is usually determined through historical sample statistics or calibration experiments and then issued to the vehicle as a system configuration item.

[0059] After unifying the time base and handling outliers, the vehicle-side edge computing module extracts spatiotemporal continuity features and operating condition combination features from the original sequence within the window. The spatiotemporal continuity features are constructed around the trajectory features. The coordinate offset between adjacent frames is denoted as... The calculation method is as follows:

[0060] ;

[0061] This quantity reflects the spatial displacement of the vehicle between adjacent sampling times and is the basis for determining whether the vehicle is in a continuous driving state. The trajectory curvature is denoted as... This is used to characterize the degree of curvature of the trajectory locally. One feasible calculation method is to use three consecutive location points. , , The area and side lengths of the triangle formed are obtained as follows:

[0062] ;

[0063] in Let be the directed area of ​​the triangle formed by the three points. for and The distance between them, with curvature measured in units of the reciprocal of length, indicates a more pronounced local turn due to its larger absolute value. The operating condition combination features are constructed around speed variation characteristics, including the average vehicle speed within the window. Vehicle speed variance and the rate of change of heading angle ,in:

[0064] ;

[0065] Vehicle speed variance characterizes the degree of fluctuation in vehicle speed within a window, while the rate of change of heading angle reflects the severity of steering maneuvers. To identify the cumulative effect of data within specific areas, distance features associated with sensitive geofences are also constructed. That is, the set of sensitive areas from the current location. Distance to the nearest boundary in the middle:

[0066] ;

[0067] and the traversal entropy of the trajectory within the window on the discrete grid Used to characterize whether the trajectory presents a grid-like traversal mode:

[0068] ;

[0069] in For the position point within the window to fall into the first The proportion of each grid cell. The above features are concatenated in chronological order to form a sequence of context feature vectors. The feature vector of each frame It includes at least coordinate offset, trajectory curvature, vehicle speed, vehicle speed variance, heading angle change rate, sensitive area distance, grid traversal entropy, and data quality flags. Coordinate offset and trajectory curvature together describe the geometry of the trajectory; vehicle speed variance and heading angle change rate reflect the degree of abnormality in driving behavior; and sensitive area distance and grid traversal entropy directly characterize the likelihood of data touching sensitive boundaries in space. These features, from different dimensions, represent the potential patterns of sensitivity shifts in discrete data after aggregation. Each feature is standardized according to training set statistics before being input into the model.

[0070] ;

[0071] in and The first The mean and standard deviation of the dimensional features on the training set, along with the standardized parameters, are sent to the vehicle along with the model weights. The context feature vector sequence is then input into a pre-trained machine learning model to calculate the sensitivity transition risk index within the current time window. This machine learning model structurally employs a long short-term memory network or a self-attention-based encoder, and its input dimension is... The dimensions are consistent, and the output is connected to a binary classification probability head. Taking a Long Short-Term Memory (LSTM) network as an example, the encoder consists of several layers of recurrent units stacked together. A dropout rate is set between layers to suppress overfitting, and the last layer is in the first... The hidden state of the frame output is mapped to a scalar logit through a fully connected layer. Taking a self-attention encoder as an example, the input sequence is first linearly projected to obtain query, key, and value vectors. Then, inter-frame dependencies are modeled through a multi-head attention mechanism, and the output is taken at the last position after passing through a feedforward network and residual connections. Let the learnable parameters of the model be... The encoder in the first The hidden state of the frame output is The sensitivity transition risk index It is given by the following formula:

[0072] ;

[0073] in For the sigmoid function, and These are the weight vector and bias of the output layer, respectively. The range of values ​​is Its physical meaning is the probability that vehicle data within the current time window will touch the regulatory boundary after spatiotemporal aggregation: when the data exhibits patterns such as gridded traversal within a specific area, long-term low-speed detours, or high overlap with known sensitive geofences, Approaching When the data shows a normal passage status, Approaching The reason for using a temporal model instead of frame-by-frame classification is that single-frame position coordinates or single braking signals are not sensitive in a discrete state. The risk comes from the cumulative effect of consecutive frames in time and space. The hidden state of the temporal encoder can retain the accumulated information within the window, thereby identifying the sensitivity transitions masked by the spatiotemporal context discontinuity.

[0074] After obtaining the sensitivity transition risk index, the vehicle-side edge computing module compares it with a pre-configured risk threshold. Compare. Risk threshold. This is not a fixed constant, but a system configuration item determined through calibration experiments based on local regulations, business type, and historical misjudgment rates. One feasible method involves plotting a receiver operating characteristic (ROC) curve based on manually labeled historical samples, and using the cutoff value corresponding to the maximum Youden index as the initial threshold.

[0075] ;

[0076] in and These are the true positive rate and the false positive rate, respectively. In scenarios with stricter compliance requirements, the values ​​are appropriately increased from the initial threshold to reduce the probability of missed detections; in scenarios where business connectivity needs to be considered, the values ​​are appropriately decreased to reduce false positives. When the current time window's original vehicle data is mapped to the compliance level corresponding to personal sensitive and geospatial data; when At that time, the compliance level is mapped to the corresponding compliance level of general business data. The classification result is written to the metadata field of the data packet in the form of a dynamic compliance level label. At the same time, the context feature vector sequence is compressed and passed along with the data packet for use in the subsequent de-identification process. If the vehicle-side computing power is overloaded or the model fails to load, a fault safety mechanism is triggered, and all data carrying location attributes is marked by default with the compliance level corresponding to personal sensitive data and geospatial data to avoid missed judgments when the model is unavailable. This downgrade event is also recorded in the vehicle-side log and reported to the local data center after the network is restored. The dynamic compliance level label is represented by a hierarchical code, which includes both the level category and the triggering reason. The triggering reason is used to distinguish between high-level data triggered by exceeding the risk index limit and high-level data triggered by the fault safety mechanism, so that the local side can take different review strategies for the two types of data.

[0077] For example, the vehicle-side edge computing module obtains vehicle speed and heading angle messages from the vehicle controller local area network bus, and obtains latitude, longitude and timestamp from the global navigation satellite system module. After time alignment and sliding window segmentation, the data is input into the long short-term memory network encoder. The sensitivity transition risk index output by the model is 0.82, while the risk threshold configured in this business scenario is 0.65. Since the risk index is greater than the risk threshold, the current window data is mapped to the compliance level corresponding to personal sensitivity and geospatial data. The dynamic compliance level label is sent to the localized data center along with the data packet.

[0078] In some embodiments, the steps of routing the data stream to a localized data center and generalizing the trajectory features using the context feature vector to generate a pseudonymous data stream with decoupled identity mapping, while calculating the identity trajectory decoupling confidence, include: parsing the dynamic compliance level label, routing the data stream mapped to the compliance level corresponding to the personal sensitivity and geospatial data to the desensitization engine of the localized data center; generalizing the trajectory features using the context feature vector to a spatial grid, and generating a one-time random identifier to replace the real vehicle identity, generating the pseudonymous data stream with decoupled identity mapping; performing a reverse re-identification test on the pseudonymous data stream using a discriminator model in an adversarial generative network, using the probability of failing to reverse-engineer the real vehicle identity as the identity trajectory decoupling confidence, and appending the identity trajectory decoupling confidence to the pseudonymous data stream. This embodiment reduces trajectory spatial accuracy through spatial grid generalization and severs cross-session identity association through a one-time random identifier, making it impossible for the overseas side to reconstruct the vehicle's precise location and true identity. Simultaneously, it decouples the degree of decoupling through reverse re-identification testing of the discriminator, providing comparable numerical evidence for regulatory verification on the gateway side and solving the problem of the inability to quantitatively evaluate the desensitization effect. The specific technical details of this embodiment are described below.

[0079] Data streams with dynamic compliance level tags enter the access layer of the localized data center after leaving the vehicle. The routing gateway parses the tags and triggers intelligent routing policies. These intelligent routing policies use dynamic compliance level tags as the basis for traffic allocation, and the routing rules are maintained in the configuration center and support hot updates. For data streams marked as general business data, such as multimedia playback records or vehicle diagnostic status codes that do not contain location or identity information, the routing gateway directly sends them to the regular outbound queue. Encryption is performed via transport layer security protocols before the data is transferred to the overseas data center. The session key used for encryption is negotiated and periodically rotated through the existing key management system. For data streams marked as sensitive personal data or geospatial data, the routing gateway routes them to the de-identification engine within the localized data center. The original plaintext data does not leave the localized boundary during the entire processing. After processing, the original plaintext is persistently written to the localized encrypted database. Only the de-identified pseudonymous data stream is submitted to the outbound queue. During routing, data packets are transmitted between the access gateway and the de-identification engine in the form of a message queue. The queue consumer pulls messages according to the processing capacity of the de-identification engine to avoid engine overload caused by sudden traffic surges. Data packets that fail to complete de-identification within the specified time limit will be returned and re-queued. Consecutive failed retries will trigger an alarm and maintain the original data's localized storage. When parsing tags, the access gateway simultaneously verifies the integrity and timeliness of the tags. Data packets with missing tags, failed tag signature verification, or timestamps exceeding the valid window are all processed according to the compliance level corresponding to personal sensitivity and geospatial data to prevent tags from being tampered with or forged to bypass the routing policy.

[0080] After receiving the data stream corresponding to personal sensitive data and geospatial data, the de-identification engine first reconstructs the context feature vector sequence from the data packet metadata, and then performs spatial grid generalization on the trajectory features based on this. The basic idea of ​​spatial grid generalization is to map continuous coordinates to a grid with a side length of... In a discrete grid, one feasible mapping method is as follows:

[0081] ;

[0082] in Indicates rounding down. and The generalized planar coordinates, grid side length The accuracy requirement is determined based on the regulations of the target location; the stricter the regulations, the higher the accuracy. The larger the value, the better. In another alternative implementation, differential privacy noise is superimposed on the mesh generalization:

[0083] ;

[0084] in The position parameter is Scale parameters are The Laplace distribution, The value of is related to the privacy budget, and the latitudinal direction is processed in the same way. Spatial grid generalization reduces the spatial accuracy of the trajectory while preserving the macroscopic shape of the trajectory, allowing statistical operations such as traffic flow analysis to be performed on the overseas side, but it cannot reconstruct the precise road topology of vehicles in sensitive areas. Grid side length With noise scale All parameters are stored in the configuration center as desensitization strategy parameters, and different values ​​can be applied to different target locations. When determining the grid side length, a balance needs to be struck between location accuracy and re-identification risk: if the grid is too small, the trajectory may still match the public map and restore the road topology; if the grid is too large, overseas operations will not be able to obtain effective location services. Preferably, the minimum grid side length that satisfies the constraint that the re-identification success rate of the discriminator at the current grid scale does not exceed the upper limit allowed by the target location is selected, so as to maximize data availability under the premise of compliance.

[0085] While generalizing the trajectory, the de-identification engine replaces the vehicle's identity with its real identity. In vehicle-to-everything (V2X) data, vehicle identity typically appears as fields such as Vehicle Identification Number (VIN) or Account Identifier, denoted as... The de-identification engine generates a one-time random identifier for each cross-border session. Its generation method is as follows:

[0086] ;

[0087] in For cryptographic hash functions, The salt value is stored in the localized key management service. Random numbers generated for each session This indicates byte string concatenation. Because... Used only once, the alias for the same vehicle differs across sessions, and the overseas side cannot trace multiple aliases back to the same real vehicle through cross-session association. Salt value. With random numbers None of the data leaves the localized data center. The mapping table between real identity and pseudonym is only stored in the localized encrypted database for reverse lookup during domestic compliance audits. The mapping table has independent access permissions and audit logs, and any query operation records the caller, time, and purpose. The one-time random identifier becomes invalid from the outbound side after the session ends, and replay or cross-session splicing requests cannot restore the identity association. Except for the vehicle identification number, fields in the data packet that may indirectly associate with identity, such as account identifier, device international mobile device identification code, and vehicle media access control address, are all replaced with independent one-time random identifiers in the same way. Different fields use different salt values ​​and random numbers to prevent joint re-identification through correlation between fields.

[0088] After trajectory generalization and identity replacement, a pseudonymous data stream with decoupled identity mapping is obtained. This data stream needs to undergo reverse re-identification testing through the discriminator model in the Generative Adversarial Network (GAN) to quantify the degree of decoupling between identity and trajectory. The GAN consists of two parts: a generator and a discriminator. The generator performs the trajectory generalization and identity replacement process as described above, and its output is the pseudonymous data stream. The discriminator simulates the attacker's perspective, attempting to infer the real vehicle identity from the pseudonymous trajectory. Structurally, the discriminator uses a sequence coding network and an identity classification head, with the generalized trajectory sequence as input. The sequence coding network consists of bidirectional recurrent layers or self-attention layers. The aggregated output representation, after being normalized by a fully connected layer and softmax, yields the posterior probability distribution of the trajectory belonging to each candidate identity. The discriminator's training data includes both anonymized trajectories of real vehicles and adversarial examples generated online by the generator, enabling it to approximate the strongest re-identification capability of an attacker with auxiliary information. Let the discriminator handle pseudonymous trajectories... It is inferred that this is their true identity. The probability is Then the discriminator is in The re-identification success rate on each test sample is:

[0089] ;

[0090] in For the discriminator to the first The identity inferred from a sample To determine the true identity of this sample, For indicator functions. Identity trajectory decoupling confidence. Defined as the probability of failing to reverse-engineer the real vehicle's identity, that is:

[0091] ;

[0092] The range of values ​​is , The closer This indicates that the lower the probability of pseudonymous data streams being reverse-engineered and re-identified overseas, the more fully the decoupling between identity and trajectory is achieved. In scenarios with limited sample size or where it is necessary to examine high-confidence errors, top-down analysis can also be used. The re-identification success rate serves as a supplementary metric, meaning the true identity falls among the top candidates with the highest probability output by the discriminator. The proportion of candidates, and the corresponding confidence level is defined as follows: Subtract that percentage.

[0093] The discriminator model and the desensitization engine are jointly trained adversarially within a localized data center. The discriminator aims to minimize identity classification errors, and its loss function uses classification cross-entropy.

[0094] ;

[0095] The generator aims to maximize the discriminator's re-identification failure rate while constraining the generalized trajectory to maintain necessary statistical usability. Its loss function is:

[0096] ;

[0097] in The difference between the generalized trajectory and the original trajectory in macroscopic statistics (such as grid-level flow distribution and origin-destination pair distribution) is measured. A coefficient to balance privacy protection and data availability.

[0098] In one feasible approach, the utility loss is calculated by comparing the statistical distribution differences between the original set of trajectories and the generalized set of trajectories on a discrete grid. For a batch... For each trajectory sample, the original trajectory and the generalized trajectory are projected onto the same discrete grid for statistical analysis. Let the frequency distribution of the original trajectory on the grid set be denoted as... The access frequency distribution of the generalized trajectory is as follows ,in , , and The original trajectory and the generalized trajectory fall into the grid cells respectively. The number of trajectory points, Let be the total number of trajectory points within the batch. Similarly, let the distribution of the origin and destination pairs of the original trajectory be denoted as . The distribution of the origin and destination pairs of the generalized trajectory is as follows: ,in , , and The starting grids in the original trajectory and the generalized trajectory are respectively: The endpoint grid is The number of trajectories. Then the utility loss is defined as:

[0099]

[0100] in Let KL divergence be the KL divergence. The weighting coefficients for the origin-destination distribution term relative to the grid flow distribution term are, in one implementation, taken as... When overseas operations only require grid-level traffic statistics and do not need origin-destination analysis, the following can be adopted: To avoid KL divergence in or A singular value occurs when the result is zero; this needs to be considered before calculation. and Apply Laplacian smoothing to each component, i.e. ,in The total number of grid cells. The smoothing constant (can be taken as...) (magnitude) Process in the same manner. In another alternative implementation, use JS divergence. (in To replace KL divergence, a bounded and symmetric divergence metric is obtained, improving gradient stability during adversarial training.

[0101] coefficient Used to balance the relative weights of privacy protection and utility preservation terms in generator loss, its value directly affects the balance between desensitization strength and data availability. The range of values ​​is In engineering, it is usually in Select from the range. It is not a fixed constant, but is determined through calibration experiments based on the upper limit requirements for the re-identification rate stipulated by the regulations of the target jurisdiction. The specific calibration method is as follows:

[0102] The maximum re-identification success rate allowed by the regulations of the target jurisdiction is [not specified]. (For example In one offline calibration method, a set of candidate values ​​is first selected on a logarithmic scale, for example... For each candidate value, after the generator and discriminator are trained adversarially on the training set until convergence, the re-identification success rate is calculated on the validation set. With utility loss ; in all satisfied From the candidate values, select the one that makes The smallest candidate value is used as the final configuration, that is:

[0103]

[0104] The physical meaning of this selection method is: under the premise of satisfying local privacy protection constraints, to make the macroscopic statistical distribution of the generalized trajectory as close as possible to the original trajectory, thereby maximizing the data availability of the overseas business side. When the granularity of the candidate value does not meet the accuracy requirements, a binary search can be performed to further refine the range near the optimal candidate value.

[0105] In another online adaptive implementation, Dynamic adjustments are made during training: after each training round, the current performance is evaluated on the validation set. ;when At that time, according to a fixed attenuation coefficient (such as...) Decrease To reduce the weight of utility constraints and enhance the strength of privacy protection; when At that time, according to a fixed growth factor (such as...) Increase To moderately improve data availability when privacy constraints are sufficient; when hour, It remains unchanged. The initial value can be taken as follows: Alternatively, the gradient magnitudes of the adversarial loss term and the utility loss term can be set according to the ratio of their gradient magnitudes at the start of training, ensuring that the two terms have similar gradient scales in the early stages of training. Through this calibration, when the generator is jointly optimized with the discriminator in a localized cloud environment, it can maximize the statistical availability of trajectory data while meeting the target locality security threshold constraints, thus avoiding excessive anonymization that could prevent overseas operations from being conducted.

[0106] During training, the generator and discriminator iterate alternately, employing an adaptive moment estimation optimizer. The learning rate and batch size are set as training hyperparameters in the configuration. The number of training epochs is determined by the convergence of the re-identification success rate on the validation set, and an early stopping strategy is used to prevent overfitting. Training samples are derived from manually labeled vehicle-to-everything (V2X) data from historical compliance audit logs, divided into training, validation, and test sets. Labels are assigned by compliance personnel based on whether the data violates regulatory boundaries after spatiotemporal aggregation. After training, the re-identification success rate calculated by the discriminator on the independent test set is used as the calibration benchmark to determine the confidence level. The calculated identity trajectory decoupling confidence level is then used. The data is appended to the request header or metadata field of the pseudonymous data stream and sent to the cross-border gateway along with the outbound request. The model version number and calculation timestamp are also written to the header and metadata field for the gateway to verify data freshness. Before appending the data, the confidence level is signed by the local data center using an internal key using a message authentication code. The cross-border gateway verifies the signature using a pre-set public key to ensure that the confidence level value has not been tampered with during transmission. Requests that fail signature verification are treated as having insufficient confidence and are blocked.

[0107] During implementation, the de-identification engine and discriminator model are deployed on a localized data center computing cluster. The discriminator performs confidence calculations on pseudonymous data streams asynchronously in batch processing to avoid blocking the main outbound link. For services with high real-time requirements, a pre-computation and caching strategy is adopted: within a period when the model version and de-identification parameters remain unchanged, the most recent confidence calculation result is reused for data packets with similar trajectory feature distributions, and the model version number and calculation timestamp are marked in the metadata; when the model weights are updated through periodic retraining, the cache is automatically invalidated and recalculated. The periodic retraining of the vehicle-side machine learning model is also performed in a localized cloud environment. Training samples are continuously accumulated from historical compliance audit logs and manually labeled violation data packets. The labels are assigned by compliance personnel based on whether the data violates regulatory boundaries after spatiotemporal aggregation. During training, samples are divided into training, validation, and test sets based on time to prevent information leakage caused by different windows of the same trajectory falling into both sets simultaneously. A binary cross-entropy loss function is used, and class weights or focus loss are introduced for imbalanced positive and negative samples. The optimizer employs adaptive moment estimation, and the learning rate, batch size, and number of training epochs are determined as hyperparameters through validation set tuning. The optimization stops early when the true positive rate and false positive rate on the validation set no longer improve. Evaluation metrics on the test set include the area under the receiver operating characteristic (ROC) curve, true positive rate, and false positive rate; models are only released after these metrics are met. The retraining frequency is configured based on the frequency of regulatory changes and data distribution drift. Updated weight parameters are downloaded to the vehicle via an over-the-air (OTA) download channel, accompanied by a version number and verification information. The vehicle performs integrity verification before loading new weights; if verification fails, it reverts to the previous stable version and reports an anomaly. The vehicle-side system also maintains the model version number, which is uploaded along with the data packet metadata. This enables the localized data center and the cross-border gateway to distinguish the risk index and confidence level output by different version models, and maintain the consistency of the verification logic during version switching.

[0108] For example, the desensitization engine maps the original planar coordinates to a discrete grid with a side length of 500 meters, and generates a one-time random identifier based on a cryptographic hash function and salt value for this cross-border session to replace the vehicle identification number; the discriminator attempts to reverse the real identity based on the generalized trajectory on 1000 test samples, and the re-identification success rate is 0.07, then the identity trajectory decoupling confidence is 0.93, and this confidence is attached to the request header of the pseudonymous data stream after being signed by the message authentication code and sent to the cross-border gateway.

[0109] In some embodiments, the steps of extracting the identity trajectory decoupling confidence level from the pseudonymous data stream about to exit the country at the cross-border gateway, cross-validating the identity trajectory decoupling confidence level with the security threshold in the dynamic matching degree rules of the target country's regulations, and executing the operation of issuing an interception command include: intercepting the exit request at the cross-border gateway and extracting the identity trajectory decoupling confidence level attached to the pseudonymous data stream; acquiring the dynamic matching degree rules of the target country's regulations in real time and extracting the security threshold from them; comparing and verifying the identity trajectory decoupling confidence level with the security threshold; when the identity trajectory decoupling confidence level is lower than the security threshold, executing the operation of issuing the interception command, rejecting the exit request and recording the interception log; when the identity trajectory decoupling confidence level is not lower than the security threshold, allowing the pseudonymous data stream to exit the country. This embodiment synchronizes the dynamic matching rules of the target country's regulations in real time at the cross-border gateway and compares the confidence level with the security threshold. This allows regulatory updates to take effect without modifying the gateway code. Furthermore, when the confidence level is insufficient, exit is denied and an audit log is recorded that only adds to the rules without modification, ensuring the traceability of control decisions and solving the problem that static rules cannot adapt to dynamic changes in regulations. The specific technical details of this embodiment are described below.

[0110] Once the pseudonymous data stream reaches the cross-border gateway, the gateway performs dynamic verification according to the target country's regulations at the physical boundary. The cross-border gateway is deployed in series on the outbound link, intercepting all application programming interface (API) requests destined for overseas data centers and extracting identity traces and decoupling confidence levels from request headers or metadata. Meanwhile, the gateway obtains dynamic matching rules of the target jurisdiction's regulations in real time through the compliance knowledge graph interface. These dynamic matching rules are stored in a structured manner within the compliance knowledge graph. Graph nodes include country or region, data type, export conditions, and security thresholds. The relationships between nodes represent the confidence requirements of a region for a certain type of data. The content includes the export conditions of the target country or region for vehicle location data, personal information, and important data, as well as the security thresholds required for the corresponding data types. When local data security regulations are updated, compliance personnel update the knowledge graph nodes and relationships in the background. The gateway automatically synchronizes the latest rules and refreshes the local cache through a subscription mechanism, completing the threshold update without modifying the gateway code. The synchronized rules carry version numbers and effective times, and the gateway records the rule version used for each verification in the log, ensuring that the applicable threshold can be traced back during audits. If the local cache is unavailable or the knowledge graph interface times out, the gateway degrades to using the most recently successfully synchronized rule version and logs this degradation state. If the local cache is also missing, it fault-safely rejects all outbound requests corresponding to personally sensitive and geospatial data until the rules become available again.

[0111] The gateway decouples the extracted identity trajectory confidence level. Safety threshold in dynamic matching degree rules Perform cross-validation. The cross-validation logic is as follows: when... When the decoupling degree of the pseudonymous data stream is determined to be insufficient to meet the regulatory requirements of the target jurisdiction, the gateway issues an interception command, rejects the outbound request, returns a prohibited access status code to the requester, and records the interception log. Upon successful verification, the pseudonymous data stream is allowed to exit the country. The interception log includes at least the request time, source address, destination location, data type, confidence level, applicable security threshold, and rule version number. This information is appended to an audit log for post-event verification by domestic regulatory agencies. In addition to confidence level comparison, the gateway performs lightweight feature sampling on the pseudonymous data stream. It matches the contextual feature vectors carried in the data packets with known sensitivity transition patterns. If high-risk trajectory features are detected, interception is triggered even if the confidence level meets the threshold, compensating for any omissions in the desensitization process. Feature sampling combines rule matching with a lightweight classifier: rule matching checks whether metrics such as the trajectory's dwell time within sensitive geofences and grid traversal entropy exceed the alarm limits configured in the bypass configuration. The lightweight classifier reuses a compressed version of the vehicle-side model for rapid re-evaluation of the feature vectors. For requests lacking confidence labels, with incorrect label formats, or with model version numbers not in the whitelist, the gateway directly rejects the request and records the anomaly, preventing attackers from bypassing verification by stripping labels. When allowing data packets, the gateway strips internal fields used only for verification and retains only pseudonymous data required by overseas business, thus preventing the leakage of internal feature vectors.

[0112] In one optional deployment method, confidence verification is not performed synchronously in the inline gateway. Instead, a lightweight verification probe is deployed in the bypass mode of the gateway, performing post-event auditing and circuit breaking through asynchronously mirrored traffic. This method is suitable for high-concurrency services that are extremely sensitive to latency: the inline gateway only performs existence and format verification of the confidence label in the request header before allowing the request to proceed, while the bypass probe asynchronously replicates the traffic and performs complete threshold comparison and feature sampling. Once a violation is detected, subsequent sessions of the same type are blocked through the circuit breaker interface. The sampling results of the bypass probe are also fed back as feedback samples to the localized data center for the next round of retraining of the discriminator and vehicle-side model, enabling the entire control loop to continuously evolve with changes in attack methods and data distribution. Regardless of whether the inline or bypass method is used, the verification logic on the gateway side only involves numerical comparison of confidence labels and feature vector matching, without the need for secondary full decryption analysis of the encrypted payload. Therefore, the computational complexity is low and it will not become a network bottleneck for high-concurrency vehicle networking services.

[0113] For example, the cross-border gateway synchronizes the location data of the vehicle network from the compliance knowledge graph to the target location. The security threshold is 0.90. The confidence level of the identity trajectory decoupling attached in an outbound request is 0.85. Since the confidence level is lower than the security threshold, the gateway issues an interception command and returns an access denied status code. The interception log records the request time, source address, target location, confidence level of 0.85, security threshold of 0.90 and rule version number for subsequent verification by domestic regulatory agencies.

[0114] The method embodiments of this application can be implemented by software, hardware, or a combination of both. At the hardware level, the vehicle-side edge computing module is the processor and memory in an in-vehicle telematics terminal or an autonomous driving domain controller; the localized data center includes a server cluster, an encrypted database, and key management services; and the cross-border gateway includes network devices with deep packet inspection capabilities. The memory of each of the above components stores a computer program, which the processor executes to implement the aforementioned processing steps. The computer program can be stored in a non-transitory computer-readable storage medium, including read-only memory, random access memory, flash memory, hard disk, solid-state drive, optical disk, or mobile storage devices. At the system level, the vehicle, the localized data center, and the cross-border gateway communicate via public mobile communication networks, leased lines, or virtual private networks. Each component collaborates according to the aforementioned data flow to complete the entire process of data collection, classification, desensitization, verification, and interception. The vehicle-side edge computing module is responsible for feature extraction, risk index calculation and dynamic classification. The localized data center's routing gateway is responsible for traffic distribution by label. The desensitization engine is responsible for trajectory generalization, identity replacement and confidence calculation. The cross-border gateway is responsible for law and rule synchronization, confidence verification and interception and release. The modules exchange data through well-defined interfaces. The internal implementation of any module can be upgraded independently without changing the interface agreement.

[0115] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the protection scope of this application.

Claims

1. A method for cross-border compliance management of vehicle network data based on artificial intelligence, characterized in that, Includes the following steps: The machine learning model is used to extract spatiotemporal continuity features and working condition combination features from the original vehicle data. The spatiotemporal continuity features include trajectory features, in order to calculate the sensitivity transition risk index within the current time window. Based on the sensitivity transition risk index, the original vehicle data is dynamically mapped to the corresponding compliance level to generate a data stream with dynamic compliance level labels and a context feature vector. Based on the dynamic compliance level label, an intelligent routing strategy is triggered for the data stream; when the compliance level indicator is general business data, the data stream is encrypted and transferred; when the compliance level indicator is personal sensitive and geospatial data, the data stream is routed to a localized data center, and the trajectory features are generalized using the context feature vector to generate a pseudonymous data stream with decoupled identity mapping, while calculating the identity trajectory decoupling confidence. At the cross-border gateway, the confidence level of the identity trajectory decoupling in the pseudonymous data stream about to leave the country is extracted; the confidence level of the identity trajectory decoupling is cross-validated with a security threshold; when the confidence level of the identity trajectory decoupling is lower than the security threshold, an interception command is issued to block the pseudonymous data stream from leaving the country.

2. The method for cross-border compliance management of vehicle network data based on artificial intelligence according to claim 1, characterized in that, The process involves extracting spatiotemporal continuity features and operating condition combination features from raw vehicle data using a machine learning model to calculate the sensitivity transition risk index within the current time window, and dynamically mapping the raw vehicle data to the corresponding compliance level. This includes: Obtain the original vehicle data, including location coordinates, timestamps, and vehicle operating conditions, from the vehicle terminal; The raw vehicle data is input into the pre-trained machine learning model to extract trajectory curvature and speed change features, and the probability of touching the regulatory boundary after data aggregation within the current time window is calculated and used as the sensitivity transition risk index. Determine whether the sensitivity transition risk index is greater than the risk threshold; When the sensitivity transition risk index is greater than the risk threshold, the original vehicle data is mapped to the compliance level corresponding to the personal sensitivity and geospatial data. When the sensitivity transition risk index is not greater than the risk threshold, the original vehicle data is mapped to the compliance level corresponding to the general business data to obtain the data stream with dynamic compliance level label and the context feature vector.

3. The method for cross-border compliance management of vehicle network data based on artificial intelligence according to claim 2, characterized in that, The process of routing the data stream to a localized data center and generalizing the trajectory features using the context feature vector to generate a pseudonymous data stream with decoupled identity mapping, while simultaneously calculating the identity trajectory decoupling confidence, includes: Parse the dynamic compliance level label and route the data stream, which is mapped to the compliance level corresponding to the personal sensitive data and geospatial data, to the de-identification engine of the localized data center; The trajectory features are generalized to a spatial grid using the context feature vector, and a one-time random identifier is generated to replace the real vehicle identity, thereby generating the pseudonymous data stream of the decoupled identity mapping; The pseudonymous data stream is subjected to reverse re-identification test by a discriminator model in an adversarial generative network. The probability of failing to reverse-engineer the real vehicle identity is used as the confidence level of the identity trajectory decoupling, and the confidence level of the identity trajectory decoupling is added to the pseudonymous data stream.

4. The method for cross-border compliance management of vehicle network data based on artificial intelligence according to claim 3, characterized in that, At the cross-border gateway, the confidence level of the identity trajectory decoupling is extracted from the pseudonymous data stream about to leave the country; the confidence level of the identity trajectory decoupling is cross-validated with a security threshold. When the confidence level of the identity trajectory decoupling is lower than the security threshold, the operation of issuing an interception command is executed, including: The exit request is intercepted at the cross-border gateway, and the identity trajectory decoupling confidence score attached to the pseudonymous data stream is extracted. The confidence level of the decoupled identity trajectory is compared and verified with a security threshold. When the confidence level of the identity trajectory decoupling is lower than the security threshold, the operation of issuing the interception command is executed to reject the outbound request and record the interception log. When the confidence level of the identity trajectory decoupling is not lower than the security threshold, the pseudonymous data is allowed to flow out of the country.

Images