Device privacy management method and apparatus, electronic device, and storage medium

Abstract

Embodiments of the present application disclose a device privacy management method. The method comprises: performing privacy protection level measurement on a device to be measured, so as to obtain a first privacy measurement result; performing privacy management level measurement on a supplier to which said device belongs, so as to obtain a second privacy measurement result; generating a privacy protection degree score according to the first privacy measurement result, the second privacy measurement result, and a preset score weight; and upgrading privacy protection of the device. Thus, privacy security and protection management is implemented.

Description

Device privacy management method, device, electronic device and storage medium

[0001] This application claims priority to Chinese patent application filed on June 14, 2023, application number 202310707303.6, and application name “Device Privacy Management Method, Apparatus, Electronic Device and Storage Medium,” all contents of which are incorporated by reference into this application. Technical Field

[0002] The embodiments of the present application relate to the field of computer technology, and specifically to a device privacy management method, apparatus, electronic device, and storage medium, wherein the storage medium includes a computer-readable storage medium. Background Art

[0003] With the increasing number of privacy protection laws and increasingly stringent enforcement worldwide, companies are facing increasing pressure to protect privacy. With the rapid development of smart homes and the influx of smart home appliances into thousands of households, their security and privacy protection have received widespread attention. Technical issues

[0004] At present, the user data privacy protection of many products is still mainly focused on the products themselves, making it difficult to accurately measure the privacy protection of the products and unable to manage the privacy and security protection of the products. Technical Solutions

[0005] The embodiments of the present application provide a device privacy management method, apparatus, electronic device, and storage medium, which can improve the accuracy of product privacy protection measurement results.

[0006] In a first aspect, an embodiment of the present application provides a device privacy management method, including:

[0007] Measuring the privacy protection level of the device under test to obtain a first privacy measurement result;

[0008] Measuring the privacy management level of the supplier to which the device under test belongs to obtain a second privacy measurement result;

[0009] Generating a privacy protection score for the device under test according to the first privacy measurement result, the second privacy measurement result, and a preset score weight;

[0010] The privacy protection of the device under test is upgraded according to the privacy protection score.

[0011] In a second aspect, an embodiment of the present application further provides a device privacy management apparatus, comprising:

[0012] A first measurement module is used to measure the privacy protection level of the device under test and obtain a first privacy measurement result;

[0013] A second measurement module is used to measure the privacy management level of the supplier to which the device under test belongs, and obtain a second privacy measurement result;

[0014] a score generating module, configured to generate a privacy protection score for the device under test based on the first privacy measurement result, the second privacy measurement result, and a preset score weight;

[0015] The privacy management module is used to upgrade the privacy protection of the device under test according to the privacy protection score.

[0016] In some embodiments of the present application, the first measurement module includes:

[0017] An acquisition unit, used to obtain the privacy security score of the device under test in the privacy protection item;

[0018] A first generating unit, configured to generate a first privacy measurement result according to the score sub-weight corresponding to the privacy protection item and the privacy security score corresponding to the privacy protection item;

[0019] The privacy protection items include at least one of product compliance risk test items, product privacy and security protection technology test items, product adaptation law test items or product privacy protection requirement test items.

[0020] In some embodiments of the present application, if the privacy protection item is a product compliance risk test item, the obtaining unit includes:

[0021] Configuration subunit, used to configure compliance risk test cases;

[0022] A testing subunit, configured to test the device under test according to the compliance risk test case to obtain a compliance risk test result, wherein the compliance risk test result corresponds to a risk level score;

[0023] The first calculation subunit is used to calculate the average of the risk level scores corresponding to each compliance risk test case to obtain an average risk level score;

[0024] The first generating subunit is configured to use the average risk level score as the privacy security score of the device under test in the product compliance risk test item.

[0025] In some embodiments of the present application, if the privacy protection item is a product privacy and security protection technology test item, the obtaining unit includes:

[0026] A first determining subunit is used to determine the privacy and security protection technology items supported by the device under test;

[0027] A second determining subunit is configured to determine, for each privacy and security protection technology item, the type, strength, and quantity of the privacy and security protection technology applied by the privacy and security protection technology item;

[0028] An acquisition subunit, configured to acquire a preset mapping relationship set, wherein the preset mapping relationship set includes a mapping relationship between the type, strength, and quantity of preset privacy and security protection technologies and security scores;

[0029] A third determining subunit is configured to determine a security score according to the preset mapping relationship set and the type, strength or quantity of the privacy and security protection technology applied by the privacy and security protection technology item;

[0030] The second calculation subunit is used to calculate the average security score of each privacy and security protection technology item to obtain an average security score;

[0031] The second generating sub-unit is used to use the average security score as the privacy security score of the device under test in the product privacy security protection technology test item.

[0032] Wherein, in some embodiments of the present application, if the privacy protection item is a product adaptation legal test item, the acquisition unit includes: a region determination subunit, configured to determine a target region where the device under test is to be put online;

[0033] A baseline determination subunit, configured to determine a target legal baseline that the target area needs to meet;

[0034] The score determination subunit is used to determine the privacy security score of the device under test based on the actual legal baseline currently satisfied by the device under test and the target legal baseline.

[0035] In some embodiments of the present application, the second measurement module includes:

[0036] A supplier determination unit, configured to determine the supplier of the device under test;

[0037] a management level determination unit, configured to measure the privacy management level of the supplier based on a reference privacy information management system and a privacy maturity model to obtain a privacy management level score;

[0038] A first matching unit is configured to match a reference software security development lifecycle with an actual software security development lifecycle of the device under test to obtain a first matching result;

[0039] A second matching unit is configured to match the reference R&D privacy protection design process with the actual R&D privacy protection design process of the device under test to obtain a second matching result;

[0040] a research and development level determination unit, configured to obtain a research and development design privacy management score based on the first matching result and the second matching result;

[0041] The second generating unit is used to generate a second privacy measurement result according to the privacy management level score and the developed and designed privacy control score.

[0042] In some embodiments of the present application, the privacy management module includes:

[0043] a protection technology determining unit, configured to determine a current privacy protection technology corresponding to the privacy protection item of the device under test if the privacy protection score does not meet the score threshold;

[0044] a protection technology changing unit, configured to change the current privacy protection technology to obtain a target privacy protection technology;

[0045] a measurement result updating unit, configured to re-measure based on the target privacy protection technology to obtain an updated first privacy measurement result; a score updating unit, configured to multiply the updated first privacy measurement result by a first score weight to obtain a first protection score, multiply the second privacy measurement result by a second score weight to obtain a second protection score, and add the first protection score and the second protection score to obtain an updated privacy protection score;

[0046] A privacy management unit is configured to upgrade the privacy protection of the device under test according to the updated privacy protection score. In a third aspect, an embodiment of the present application further provides an electronic device, the electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the steps of the device privacy management method in the first aspect or the steps of the device privacy management method in the third aspect are implemented.

[0047] In a fourth aspect, an embodiment of the present application further provides a storage medium, which includes a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps in the above-mentioned device privacy management method are implemented.

[0048] In a fifth aspect, embodiments of the present application further provide a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the various optional implementations described in the embodiments of the present application. Beneficial effects

[0049] In an embodiment of the present application, the privacy protection level of the device under test is measured to obtain a first privacy measurement result, the privacy management level of the supplier to which the device under test belongs is measured to obtain a second privacy measurement result, a privacy protection score of the device under test is generated based on the first privacy measurement result and the second privacy measurement result, and the privacy protection of the device under test is upgraded based on the privacy protection score. The second privacy measurement result is obtained by measuring the privacy management level of the supplier, and the privacy protection score of the device under test is generated based on the second privacy measurement result and the first privacy measurement result for the privacy of the product itself. Compared with the traditional evaluation scheme that only evaluates the privacy level of the product itself, the embodiment of the present application enriches the measurement dimension of product privacy protection, improves the accuracy of the product privacy protection measurement result, and facilitates the implementation of privacy and security protection management of the product. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the technical solutions in this application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0051] FIG1 is a schematic diagram of a scenario of a device privacy management method provided by an embodiment of the present application;

[0052] FIG2 is a flow chart of a device privacy management method provided in an embodiment of the present application;

[0053] FIG3 is a schematic diagram of the results of various privacy and security protection technical items and their corresponding security scores provided in an embodiment of the present application;

[0054] FIG4 is a schematic diagram of the architecture of device privacy management provided by an embodiment of the present application;

[0055] FIG5 is another schematic diagram of the device privacy management method provided in an embodiment of the present application;

[0056] FIG6 is a schematic diagram of the structure of a device privacy management apparatus provided in an embodiment of the present application;

[0057] FIG7 is a schematic structural diagram of an electronic device provided in an embodiment of the present application. Modes for Carrying Out the Invention

[0058] The following will be combined with the drawings in this application to clearly and completely describe the technical solutions in this application. Obviously, the embodiments described are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making any creative efforts shall fall within the scope of protection of the present invention.

[0059] The present invention provides a device privacy management method, apparatus, electronic device, and storage medium. Specifically, the present invention provides a device privacy management apparatus suitable for electronic devices, wherein the electronic devices include terminals, wherein the terminals include but are not limited to mobile phones, tablet computers, computers, or televisions.

[0060] Please refer to FIG1 , taking the terminal device executing the device privacy management method as an example, wherein the specific execution process of the device privacy management method is as follows:

[0061] The server 10 obtains configuration parameter information of the device under test 11, and measures the privacy protection level of the device under test 11 according to the configuration parameter information to obtain a first privacy measurement result;

[0062] Subsequently, the server 10 obtains the supplier information of the device under test and measures the privacy management level of the supplier to obtain a second privacy measurement result;

[0063] Then, a privacy protection score is generated according to the first privacy measurement result and the second privacy measurement result, and the privacy protection of the device under test is upgraded according to the privacy protection score.

[0064] It can be understood that by measuring the supplier's privacy management level to obtain a second privacy measurement result, and generating a privacy protection score for the device under test based on the second privacy measurement result and the first privacy measurement result for the privacy of the product itself, compared with the traditional evaluation scheme that only evaluates the privacy level of the product itself, the embodiment of the present application enriches the measurement dimensions of product privacy protection, improves the accuracy of the product privacy protection measurement results, and facilitates the implementation of privacy and security protection management of the product.

[0065] It should be noted that the order of description of the following embodiments does not limit the priority order of the embodiments.

[0066] Please refer to Figure 2, which is a flow chart of a device privacy management method provided by an embodiment of the present application. The specific flow of the device privacy management method may be as follows: 101. Measure the privacy protection level of the device under test to obtain a first privacy measurement result.

[0067] It should be noted that the privacy protection level of a device refers to the privacy protection level of the device for user data when it is used, which is determined by the relevant configuration parameters of the device when it is used. That is, the first privacy measurement result is an evaluation result obtained for the device itself.

[0068] Among them, the device under test refers to the device that needs to undergo privacy protection assessment, such as the device that leaves the factory after production, the equipment used for research and development testing, or the device that needs to be tested due to privacy and security issues during the application process.

[0069] 102. Measure the privacy management level of the supplier of the device under test to obtain a second privacy measurement result. It should be noted that the privacy management level of the supplier refers to the control level of the supplier's privacy protection, where the supplier is the company that develops or produces the device.

[0070] It is understandable that by measuring the privacy management level of the company that produces the device, the privacy protection level of the device can be analyzed from more dimensions. For example, the higher the privacy protection control level of the company, the higher the privacy protection level of the corresponding product will generally be.

[0071] 103. Generate a privacy protection score for the device under test based on the first privacy measurement result, the second privacy measurement result, and a preset score weight.

[0072] It can be understood that the privacy protection score is a score for the device in terms of user data privacy protection. The higher the score, the better the privacy protection of the device or product. Conversely, the lower the score, the worse the privacy protection of the device or product.

[0073] It can be understood that by generating a privacy protection score from the measurement results of multiple dimensions, it is possible to measure and score the privacy protection status of the device from multiple dimensions, thereby improving the accuracy of the privacy protection score.

[0074] The score weights reflect the proportion of the scores corresponding to each privacy metric result. For example, in this embodiment of the present application, the score weights of the first privacy metric result and the second privacy metric result each account for 50%. In this embodiment of the present application, the score weights can be flexibly adjusted according to actual needs, and the specific values ​​of the score weights are not limited here.

[0075] 104. Upgrade the privacy protection of the device under test according to the privacy protection score.

[0076] Among them, by obtaining the privacy protection score of the device, the privacy protection of the device can be upgraded according to the privacy protection score. For example, if the privacy protection score of the device is low, it is necessary to improve the privacy protection score of the device by adjusting the technology and strength of the device in terms of privacy protection.

[0077] Correspondingly, the privacy protection score can also be used to determine whether the introduction of the corresponding device is allowed. For example, when the privacy protection score of the device is low, the introduction of the device will be rejected. When the privacy protection score of the device meets the standard, the introduction of the device will be allowed. Among them, the introduction of equipment is also called equipment introduction, which refers to the purchase or import of equipment.

[0078] It can be understood that by measuring the supplier's privacy management level to obtain a second privacy measurement result, and generating a privacy protection score for the device under test based on the second privacy measurement result and the first privacy measurement result for the privacy of the product itself, compared with the traditional evaluation scheme that only evaluates the privacy level of the product itself, the embodiment of the present application enriches the measurement dimensions of product privacy protection, improves the accuracy of the product privacy protection measurement results, and facilitates the implementation of privacy and security protection management of the product.

[0079] Optionally, in an embodiment of the present application, the first privacy measurement result is a privacy score for the device during application. Therefore, by obtaining the privacy security score of the device under test in each privacy protection item, the first privacy measurement result of the device under test can be obtained. That is, optionally, in some embodiments of the present application, the step of "measuring the privacy protection level of the device under test to obtain the first privacy measurement result" includes:

[0080] Obtain the privacy security score of the device under test in the privacy protection item;

[0081] Generate a first privacy measurement result according to the score sub-weight corresponding to the privacy protection item and the privacy security score corresponding to the privacy protection item;

[0082] The privacy protection items include at least one of product compliance risk test items, product privacy and security protection technology test items, product adaptation law test items or product privacy protection requirement test items.

[0083] It should be noted that the privacy protection items are several detection items that the device under test mainly targets. These detection items realize the detection of device privacy security from different dimensions.

[0084] Among them, the dynamic first privacy measurement result of the device during the application process is obtained by comprehensively analyzing the privacy security scores of various detection items.

[0085] Correspondingly, the score weight reflects the proportion of each privacy protection item's score. For example, if there are four privacy protection items, the score weight of each privacy protection item can be 25%. The specific value of the score weight can also be flexibly adjusted according to actual needs.

[0086] It should be noted that the product compliance risk test item is a test for whether the device has compliance risks. In this process, a test case can be constructed and the device can be tested based on the test case to obtain the test results for the compliance risk. That is, optionally, in some embodiments of the present application, if the privacy protection item is a product compliance risk test item, the step of "obtaining the privacy security score of the device under test in the privacy protection item" includes:

[0087] Configure compliance risk test cases;

[0088] Testing the device under test according to the compliance risk test case to obtain a compliance risk test result, wherein the compliance risk test result corresponds to a risk level score;

[0089] Calculate the average risk level score corresponding to each compliance risk test case to obtain the average risk level score;

[0090] The average risk level score is used as the privacy security score of the device under test for the product compliance risk test item. It is understood that a compliance risk test case is a test case established for the device under test in terms of product compliance risk testing. Based on the execution of this test case, the product compliance risk of the device under test is determined. The compliance risk test case includes the target item under test, as well as related test files and test input data.

[0091] Compliance risk test cases can include multiple test cases, each of which corresponds to a test result. The test result can be expressed as a score between 0 and 5. Different scores correspond to different risk levels. For example, severe: 0 points; high risk: 1 point; medium risk: 2 points; low risk: 4 points; no risk (pass): 5 points.

[0092] Accordingly, the privacy security score of the product compliance risk test item for the device can be obtained by combining the compliance risk test results of multiple test cases, for example, (L i represents the test result score of the i-th test case), where N is the number of test cases or items, that is, the privacy security score of the product compliance risk test item is represented by the average of the test result scores of multiple compliance risk test cases.

[0093] It should be noted that the product privacy and security protection technology test item is a test of the privacy and security protection technology configured on the device. The device's product privacy and security protection technology can be scored from the perspectives of the type, strength, or number of applied privacy and security protection technologies. That is, optionally, in some embodiments of the present application, if the privacy protection item is a product privacy and security protection technology test item, the step of "obtaining the privacy security score of the device under test in the privacy protection item" includes:

[0094] Determine the privacy and security protection technologies supported by the device under test;

[0095] For each privacy and security protection technology item, determine the type, strength, and quantity of privacy and security protection technologies applied by the privacy and security protection technology item;

[0096] Obtain a preset mapping relationship set, wherein the preset mapping relationship set includes a mapping relationship between the type, strength, and quantity of preset privacy and security protection technologies and security scores;

[0097] Determining a security score according to the preset mapping relationship set and the type, strength or quantity of the privacy and security protection technology applied by the privacy and security protection technology item;

[0098] Calculate the average security score of each privacy and security protection technology item to obtain the average security score;

[0099] The average security score is used as the privacy security score of the device under test in the product privacy security protection technology test item.

[0100] It should be noted that privacy and security protection technology items are protection technology items adopted by the device to achieve the purpose of privacy and security. For example, please refer to Figure 3, which is a schematic diagram of the results of various privacy and security protection technology items and their corresponding security scores provided in the embodiment of the present application. Among them, privacy and security protection technology items include data encryption, data backup and recovery, secure sockets layer protocol data transmission, security products used in the cloud, interface authentication and authorization, data desensitization, anonymity algorithm, differential privacy and other technical items. Accordingly, for each privacy and security protection technology item, the security score of the corresponding privacy and security protection technology item is determined according to the type, strength or quantity of protection technology applied by the privacy and security protection technology item.

[0101] For example, the more secure the type of protection technology, the higher the protection strength, and the greater the number of protection technologies, the higher the corresponding security score. Specifically, in an embodiment of the present application, the security score of each current privacy and security protection technology item can be obtained based on the pre-established mapping relationship between the type, strength, number and security score of the privacy and security protection technology, and then the privacy and security score of the device under test for the product privacy and security protection technology test item can be obtained based on the average of each security score. Correspondingly, the privacy and security score for the product privacy and security protection technology test item can also be obtained by comprehensively combining the security scores of multiple privacy and security protection technology items corresponding to the product privacy and security protection technology test item. For example, (L i represents the security score of the i-th privacy protection technology item).

[0102] It should be noted that the product legal adaptation test item is a privacy security test for whether the device meets the legal requirements of the corresponding country or region, for example, whether the laws used by the product meet the privacy security legal baseline of the corresponding region. That is, optionally, in some embodiments of the present application, if the privacy protection item is a product legal adaptation test item, the step of "obtaining the privacy security score of the device under test in the privacy protection item" includes:

[0103] Determine the target area where the equipment under test will be put online;

[0104] Determine the target legal baselines that need to be met in the target area;

[0105] Determine a privacy security score of the device under test according to an actual legal baseline currently satisfied by the device under test and the target legal baseline.

[0106] It can be understood that the legal baseline is the benchmark corresponding to the law, that is, the legal requirements met by the device. For example, in the embodiment of the present application, the legal baseline mainly refers to the privacy legal requirements corresponding to the device in terms of privacy law. According to the comparison of the actual legal baseline currently applicable to the device and the target legal baseline of the online area, the privacy security score of the device in the product adaptation legal test item can be obtained. For example, if the privacy law requirements of country A are relatively low or there is no privacy law, but the privacy protection measures taken by the product have exceeded the legal requirements of country A, the score is 5 points; the privacy law requirements of country B are particularly high, but the product has not taken privacy protection measures, then the score is 0 points.

[0107] Optionally, in the embodiment of the present application, the privacy protection requirement that the device needs to meet may be determined based on the product type. That is, each product type corresponds to a different privacy protection requirement. Accordingly, if the privacy protection item is a product privacy protection requirement test item, then "obtaining the privacy security score of the device under test in the privacy protection item" includes:

[0108] Determine the product type of the device under test;

[0109] Determine the product privacy protection requirement corresponding to the device under test based on the product type and the mapping relationship;

[0110] The product privacy protection requirement is used as the privacy security score of the device under test for the product type. The mapping relationship includes a mapping relationship between a preset product type and a preset product privacy protection requirement. It is understandable that the mapping relationship can be predefined according to the degree of protection of data privacy requirements of different products. For example, the product privacy protection requirement for smart lighting control, smart curtains, smart range hoods, and Bluetooth temperature and humidity sensors is 1, the product privacy protection requirement for smart air conditioners, smart refrigerators (without screens), smart washing machines, smart air purifiers, smart fresh air systems, and Bluetooth body fat scales is 2, the product privacy protection requirement for smart sweeping robots (without cameras) and smart refrigerators (with screens) is 3, the product privacy protection requirement for smart TVs and smart gateways is 4, the product privacy protection requirement for smart door locks, smart cameras, smart doorbells, smart cat eyes, smart sweeping robots (with cameras), smart watches, and smart phones is 5, etc.

[0111] It should be noted that the second privacy measurement result is a scoring result of the privacy management level of the enterprise that develops or designs the device and the R&D and design process of the enterprise. The scoring results of the enterprise's privacy management level and the R&D and design process of the enterprise reflect the privacy protection of the developed device to a certain extent. For example, if the enterprise's privacy management level is high and the R&D and design process is scored as a more standardized design process, then the privacy protection and specifications of the corresponding developed device will also be higher. Therefore, the evaluation result of the enterprise can be used as a reference for the privacy protection of the corresponding device. That is, optionally, in some embodiments of the present application, the step of "measuring the privacy management level of the supplier to which the device to be tested belongs to obtain a second privacy measurement result" includes:

[0112] Determine the supplier of the device under test;

[0113] Measuring the supplier's privacy management level based on the reference privacy information management system and privacy maturity model to obtain a privacy management level score;

[0114] Matching the reference software security development lifecycle with the actual software security development lifecycle of the device under test to obtain a first matching result;

[0115] Matching the reference R&D privacy protection design process with the actual R&D privacy protection design process of the device under test to obtain a second matching result;

[0116] Obtaining a research and design privacy control score based on the first matching result and the second matching result;

[0117] A second privacy measurement result is generated based on the privacy management level score and the developed and designed privacy control score.

[0118] Among them, the matching result reflects the degree of matching, which can be expressed as a percentage or a decimal between 0 and 1. For example, a higher percentage of the first matching result indicates that the two life cycles are relatively close or consistent, and a lower percentage of the first matching result indicates that the similarity between the two life cycles is low. For example, a higher percentage of the second matching result indicates that the privacy protection design processes are relatively close or consistent. Conversely, a lower percentage of the second matching result indicates that the two privacy protection design processes are basically different or have low overlap. Among them, the degree of matching between the two comparison objects is reflected in the form of a percentage. Accordingly, the first matching result and the second matching result can also be calculated by weight ratio to obtain the R&D design privacy control score. For example, the percentages corresponding to the two matching results are multiplied by the weight ratio and then added to obtain the final R&D design privacy control score.

[0119] It is understandable that the privacy management level score reflects the company's level of privacy management, and the R&D and design privacy control score reflects the company's privacy control score during device development.

[0120] Among them, the Software Security Development Life Cycle (SSDLC) and the Privacy by Design (PbD) process have corresponding reference standards. The company's R&D and design privacy management score is determined by judging whether the company meets the corresponding standards.

[0121] Correspondingly, for the privacy management level score, the company's privacy management level can be analyzed by whether it meets the relevant privacy information management system, and the privacy maturity model can also be used to analyze the company's privacy management level. For example, the company's overall privacy management level can be evaluated according to the ISO27701 privacy management system to obtain the management system assessment score; the company's overall privacy management level can be evaluated according to the classic privacy maturity model such as ISC2, NIST, GAPP, and CNIL.

[0122] Correspondingly, for the R&D design privacy control score, the privacy protection score of the device can be analyzed through aspects such as the device R&D life cycle and the privacy protection design process. For example, the company's R&D software security development life cycle (SSDLC) level can be evaluated to obtain the R&D cycle evaluation score; the company's R&D privacy protection design process (PbD) level can be evaluated to obtain the privacy design process evaluation score.

[0123] Accordingly, after obtaining the scores of each detection item, the scores can be fused by the weights of each detection item to obtain a privacy protection score. For example, please refer to Figure 4, which is a schematic diagram of the architecture of device privacy management provided in an embodiment of the present application, wherein the architecture of the device privacy management includes a static measurement module A, a dynamic measurement module B, and a result visualization module C. The static measurement module A is used to evaluate the privacy management level of the enterprise that develops or designs the device to be tested, the dynamic measurement module B is used to evaluate the dynamic privacy data of the device to be tested during the application process, and the result visualization module C is used to visualize the privacy protection score obtained by fusion of the static measurement module A and the dynamic measurement module B. In the embodiment of the present application, the fusion weights of the static measurement module A and the dynamic measurement module B are 50% each;

[0124] Correspondingly, for the static measurement module A, the static measurement module A includes the company internal control measurement part a1 and the R&D management and control measurement part a2, each accounting for 50%. The company internal control measurement part a1 includes the privacy information management system test part a11 and the privacy maturity model test part a12. Among them, the management system evaluation score of the privacy information management system test part a11 accounts for 80% of the company internal control measurement part a1, and the model evaluation score of the privacy maturity model test part a12 accounts for 20% of the company internal control measurement part a1.

[0125] For example, the second privacy measurement result St of the static measurement module A is: (management system evaluation score*0.8+model evaluation score*0.2)*0.5+R&D control measurement score*0.5.

[0126] Correspondingly, for the dynamic measurement module B, the dynamic measurement module B includes product compliance risk test item b1, product privacy and security protection technology test item b2, product adaptation law test item b3 or product privacy protection requirement test item b4, among which the fusion weights of each test item account for 40%, 40%, 10% and 10% of the dynamic measurement module B respectively.

[0127] For example, the first privacy measurement result Dy of the dynamic measurement module B is: compliance risk detection score*0.4+product privacy and security protection technology score*0.4+legal adaptability*0.1+1 / selected product type privacy protection requirement strength*0.1.

[0128] Optionally, when upgrading the privacy protection of the device under test based on the privacy protection score, the privacy protection data of the device under test may be adjusted to obtain a new privacy protection score, and privacy protection data suitable for the device under test may be determined based on changes in the new privacy protection score. That is, optionally, in some embodiments of the present application, the step of "upgrading the privacy protection of the device under test based on the privacy protection score" includes:

[0129] Determine the current privacy protection technology corresponding to the privacy protection items of the device under test;

[0130] Changing the current privacy protection technology to obtain a target privacy protection technology;

[0131] The first privacy measurement result is updated according to the target privacy protection technology to obtain an updated first privacy measurement result; an updated privacy protection score is obtained according to the updated first privacy measurement result and the second privacy measurement result; and the privacy protection of the device under test is upgraded according to the updated privacy protection score.

[0132] Among them, by selecting or adding other privacy protection technologies, you can view the impact of different privacy protection technologies on the privacy protection score of the corresponding product to see whether it meets the privacy protection requirements of the online country.

[0133] It is understandable that the embodiment of the present application implements the engineering configuration of the device privacy and security protection assessment process through static measurement, dynamic measurement and result visualization. Based on this process, the privacy and security protection assessment of each device can be implemented. Evaluating the privacy and security of the device based on this assessment process can reduce the professional skills requirements for operators and reduce application costs. It can also evaluate the privacy and security of the device from multiple dimensions such as the enterprise and the device itself, and can provide a more comprehensive understanding of the privacy defects of the product. In the dynamic measurement part, different privacy protection scores can be obtained by adjusting the privacy protection technology applied to each privacy protection item, so that different measures can be taken according to the cost to judge the degree of privacy protection and whether it meets the requirements of local laws and regulations.

[0134] Accordingly, after conducting a privacy and security assessment on the device, corresponding privacy and security improvements can be made to the device to obtain a device with better privacy protection effects. When the user uses the device for communication or application, the user's data can be better protected and privacy and security can be improved.

[0135] Please refer to FIG5 , which is a flowchart of another method for device privacy management provided by an embodiment of the present application. The specific process of the device privacy management includes:

[0136] 201. Launch the privacy protection management system;

[0137] Start the static measurement part first:

[0138] 202. Whether to update the company's internal control metrics. If yes, proceed to step 203;

[0139] The company's internal control metrics are typically updated annually, so they don't need to be updated every time. Furthermore, the company's internal control metric values ​​remain largely unchanged each year. Therefore, if you choose not to update, you can simply use the historical company internal control metric results.

[0140] 203. Evaluate the company's overall privacy management level according to the ISO27701 privacy management system and obtain the management system assessment score;

[0141] 204. Evaluate the company's overall privacy management level based on the classic privacy maturity model to obtain a model evaluation score; among them, the privacy maturity model includes ISC2, NIST, GAPP, and CNIL.

[0142] 205. Whether to update the R&D control metrics, if so, execute step 206;

[0143] The R&D control metric is usually updated annually and does not need to be updated every time. The R&D control metric value remains basically unchanged each year. Therefore, if you do not choose to update, you can continue to use the historical R&D control metric results.

[0144] 206. Evaluate the company's R&D Software Security Development Lifecycle (SSDLC) level and obtain an R&D cycle assessment score;

[0145] 207. Evaluate the company's R&D Privacy by Design (PbD) process and derive a privacy by design process assessment score; initiate dynamic measurement:

[0146] 208. Select the laws of the country where the smart home product will be launched and determine the legal privacy security score based on the legal adaptation;

[0147] 209. Select the type of smart home product to be evaluated and obtain the product privacy protection requirement score;

[0148] Among them, the product privacy protection requirement level score corresponding to the current product type is determined according to the corresponding relationship between the product type and the product privacy protection requirement level.

[0149] 210. Select the privacy and security protection technology currently used or to be used by the smart home product type to be evaluated to obtain the privacy and security technology security score;

[0150] Among them, the current smart home privacy security technology security score is obtained based on the pre-established mapping relationship between the type, strength, quantity and security score of privacy security protection technology.

[0151] 211. Conduct compliance risk testing on smart home products and obtain compliance risk privacy security scores;

[0152] Among them, the risks of smart products can be detected through automatic detection and a score can be obtained; for example, compliance risk test cases can be configured and executed, and the scores of each compliance risk test case can be averaged to obtain the privacy security score of the smart home in compliance risk detection.

[0153] 212. Weight the management system assessment score, model assessment score, R&D cycle assessment score, privacy design process assessment score, legal privacy security score, product privacy protection requirement score, privacy security technology security score, and compliance risk privacy security score to calculate the final score and obtain the privacy protection score.

[0154] For example, the privacy protection score = [(management system assessment score*0.8+model assessment score*0.2)*0.5+(R&D cycle assessment score*0.5+privacy design process assessment score*0.5)*0.5]*0.5+[compliance risk privacy security score*0.4+privacy security technology security score*0.4+legal privacy security score*0.1+product privacy protection requirement score*0.1]*0.5.

[0155] 213. Display the smart home privacy protection score, as well as the scores of each dimension and the privacy protection items that can be improved;

[0156] Among them, privacy protection items that can be improved refer to privacy protection items with lower scores.

[0157] 214. Based on the privacy protection items that can be improved, choose whether to recalculate the current evaluation score, and repeat steps 208-213 until there are no privacy protection items that can be improved.

[0158] It is understandable that the embodiments of this application combine multiple privacy protection assessment methods and secure development processes to provide a more comprehensive understanding of product privacy deficiencies. Different measures can be taken based on cost to determine the degree of privacy protection and whether it meets local legal and regulatory requirements.

[0159] To facilitate better implementation of the device privacy management method of this application, this application also provides a device privacy management apparatus based on the aforementioned device privacy management method. The meaning of the third target term is the same as in the aforementioned device privacy management method. For specific implementation details, please refer to the description in the method embodiment.

[0160] Please refer to FIG6 , which is a schematic diagram of the structure of a device privacy management apparatus provided in an embodiment of the present application, wherein the device privacy management apparatus may include:

[0161] A first measurement module 301 is configured to measure the privacy protection level of the device under test and obtain a first privacy measurement result;

[0162] A second measurement module 302 is configured to measure the privacy management level of the supplier to which the device under test belongs, and obtain a second privacy measurement result;

[0163] A score generating module 303 is configured to generate a privacy protection score for the device under test based on the first privacy measurement result, the second privacy measurement result, and a preset score weight;

[0164] The privacy management module 304 is configured to upgrade the privacy protection of the device under test according to the privacy protection score.

[0165] In some embodiments of the present application, the first measurement module 301 includes:

[0166] An acquisition unit, used to obtain the privacy security score of the device under test in the privacy protection item;

[0167] A first generating unit, configured to generate a first privacy measurement result according to the score sub-weight corresponding to the privacy protection item and the privacy security score corresponding to the privacy protection item;

[0168] The privacy protection items include at least one of product compliance risk test items, product privacy and security protection technology test items, product adaptation law test items or product privacy protection requirement test items.

[0169] In some embodiments of the present application, if the privacy protection item is a product compliance risk test item, the obtaining unit includes:

[0170] Configuration subunit, used to configure compliance risk test cases;

[0171] A testing subunit, configured to test the device under test according to the compliance risk test case to obtain a compliance risk test result, wherein the compliance risk test result corresponds to a risk level score;

[0172] The first calculation subunit is used to calculate the average of the risk level scores corresponding to each compliance risk test case to obtain an average risk level score;

[0173] The first generating subunit is configured to use the average risk level score as the privacy security score of the device under test in the product compliance risk test item.

[0174] In some embodiments of the present application, if the privacy protection item is a product privacy and security protection technology test item, the obtaining unit includes:

[0175] A first determining subunit is used to determine the privacy and security protection technology items supported by the device under test;

[0176] A second determining subunit is configured to determine, for each privacy and security protection technology item, the type, strength, and quantity of the privacy and security protection technology applied by the privacy and security protection technology item;

[0177] An acquisition subunit, configured to acquire a preset mapping relationship set, wherein the preset mapping relationship set includes a mapping relationship between the type, strength, and quantity of preset privacy and security protection technologies and security scores;

[0178] A third determining subunit is configured to determine a security score according to the preset mapping relationship set and the type, strength or quantity of the privacy and security protection technology applied by the privacy and security protection technology item;

[0179] The second calculation subunit is used to calculate the average security score of each privacy and security protection technology item to obtain an average security score;

[0180] The second generating sub-unit is used to use the average security score as the privacy security score of the device under test in the product privacy security protection technology test item.

[0181] Wherein, in some embodiments of the present application, if the privacy protection item is a product adaptation legal test item, the acquisition unit includes: a region determination subunit, configured to determine a target region where the device under test is to be put online;

[0182] A baseline determination subunit, configured to determine a target legal baseline that the target area needs to meet;

[0183] The score determination subunit is used to determine the privacy security score of the device under test according to the actual legal baseline currently satisfied by the device under test and the target legal baseline.

[0184] In some embodiments of the present application, the second metric module 302 includes:

[0185] A supplier determination unit, configured to determine the supplier of the device under test;

[0186] a management level determination unit, configured to measure the privacy management level of the supplier based on a reference privacy information management system and a privacy maturity model to obtain a privacy management level score;

[0187] A first matching unit is configured to match a reference software security development lifecycle with an actual software security development lifecycle of the device under test to obtain a first matching result;

[0188] A second matching unit is configured to match the reference R&D privacy protection design process with the actual R&D privacy protection design process of the device under test to obtain a second matching result;

[0189] a research and development level determination unit, configured to obtain a research and development design privacy management score based on the first matching result and the second matching result;

[0190] The second generating unit is used to generate a second privacy measurement result according to the privacy management level score and the developed and designed privacy control score.

[0191] In some embodiments of the present application, the privacy management module 304 includes:

[0192] a protection technology determining unit, configured to determine a current privacy protection technology corresponding to the privacy protection item of the device under test if the privacy protection score does not meet the score threshold;

[0193] a protection technology changing unit, configured to change the current privacy protection technology to obtain a target privacy protection technology;

[0194] a measurement result updating unit, configured to re-measure based on the target privacy protection technology to obtain an updated first privacy measurement result; a score updating unit, configured to multiply the updated first privacy measurement result by a first score weight to obtain a first protection score, multiply the second privacy measurement result by a second score weight to obtain a second protection score, and add the first protection score and the second protection score to obtain an updated privacy protection score;

[0195] A privacy management unit is configured to upgrade the privacy protection of the device under test based on the updated privacy protection score. In this embodiment of the present application, the first measurement module 301 first measures the privacy protection level of the device under test to obtain a first privacy measurement result. Then, the second measurement module 302 measures the privacy management level of the vendor to which the device under test belongs to obtain a second privacy measurement result. Subsequently, the score generation module 303 generates a privacy protection score for the device under test based on the first privacy measurement result, the second privacy measurement result, and a preset score weight. Then, the privacy management module 304 upgrades the privacy protection of the device under test based on the privacy protection score.

[0196] Among them, the embodiment of the present application obtains a second privacy measurement result by measuring the supplier's privacy management level, and generates a privacy protection score for the device under test based on the second privacy measurement result and the first privacy measurement result for the privacy of the product itself. Compared with the traditional evaluation scheme that only evaluates the privacy level of the product itself, the embodiment of the present application enriches the measurement dimensions of product privacy protection, improves the accuracy of product privacy protection measurement results, and facilitates the implementation of privacy and security protection management of the product.

[0197] In addition, the present application also provides an electronic device, as shown in FIG7 , which shows a schematic structural diagram of the electronic device involved in the present application. Specifically:

[0198] The electronic device may include components such as a processor 401 with one or more processing cores, a memory 402 with one or more computer-readable storage media, a power supply 403, and an input unit 404. Those skilled in the art will appreciate that the electronic device structure shown in FIG7 does not limit the electronic device and may include more or fewer components than shown, or combine certain components, or arrange the components differently.

[0199] Processor 401 is the control center of the electronic device. It connects all parts of the electronic device using various interfaces and circuits. It executes the various functions of the electronic device and processes data by running or executing software programs and / or modules stored in memory 402 and accessing data stored in memory 402. Optionally, processor 401 may include one or more processing cores. Preferably, processor 401 may integrate an application processor and a modem processor. The application processor primarily handles the operating system, object interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into processor 401.

[0200] The memory 402 can be used to store software programs and modules. The processor 401 executes various functional applications and device privacy management by running the software programs and modules stored in the memory 402. The memory 402 may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function (such as a sound playback function, an image playback function, etc.), etc.; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 402 may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device. Accordingly, the memory 402 may also include a memory controller to provide the processor 401 with access to the memory 402.

[0201] The electronic device also includes a power supply 403 for supplying power to various components. Preferably, the power supply 403 can be logically connected to the processor 401 via a power management system, thereby enabling the power management system to manage charging, discharging, and power consumption. The power supply 403 can also include one or more DC or AC power supplies, a recharging system, a power failure detection circuit, a power converter or inverter, a power status indicator, and other arbitrary components.

[0202] The electronic device may also include an input unit 404, which can be used to receive input digital or character information and generate keyboard, mouse, joystick, optical or trackball signal input related to object setting and function control. Although not shown, the electronic device may also include a display unit, etc., which will not be described in detail here. Specifically in this embodiment, the processor 401 in the electronic device will load the executable files corresponding to the processes of one or more applications into the memory 402 according to the following instructions, and the processor 401 will run the application stored in the memory 402, thereby implementing the steps in any device privacy management method provided in this application.

[0203] The privacy protection level of the device under test is measured to obtain a first privacy measurement result, the privacy management level of the supplier to which the device under test belongs is measured to obtain a second privacy measurement result, a privacy protection score for the device under test is generated based on the first privacy measurement result, the second privacy measurement result, and a preset score weight, and the privacy protection of the device under test is upgraded based on the privacy protection score. The second privacy measurement result is obtained by measuring the supplier's privacy management level, and the privacy protection score for the device under test is generated based on the second privacy measurement result and the first privacy measurement result for the privacy of the product itself. Compared with traditional evaluation schemes that only evaluate the privacy level of the product itself, the embodiments of the present application enrich the measurement dimensions of product privacy protection, improve the accuracy of product privacy protection measurement results, and facilitate the implementation of privacy and security protection management for the product.

[0204] Those skilled in the art will appreciate that all or part of the steps in the various methods of the above embodiments may be accomplished by instructions, or by controlling related hardware through instructions. The instructions may be stored in a computer-readable storage medium and loaded and executed by a processor.

[0205] To this end, the present application provides a storage medium, which includes a computer-readable storage medium, on which a computer program is stored. The computer program can be loaded by a processor to execute the steps in any device privacy management method provided in the present application.

[0206] The computer-readable storage medium may include a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0207] Since the instructions stored in the computer-readable storage medium can execute the steps in any device privacy management method provided in this application, the beneficial effects that can be achieved by any device privacy management method provided in this application can be achieved. Please refer to the previous embodiments for details and will not be repeated here.

[0208] The above is a detailed introduction to the device privacy management method, apparatus, electronic device and storage medium provided by this application. Specific examples are used herein to illustrate the principles and implementation methods of the present invention. The description of the above embodiments is only used to help understand the method of the present invention and its core idea. At the same time, for those skilled in the art, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present invention.

[0209] Among them, it can be understood that in the specific implementation of this application, it involves the configuration data of the device to be tested (compliance risk data, adaptation legal data, privacy and security protection technology, product type, etc.), and relevant information of the enterprise corresponding to the device to be tested (the name of the enterprise, the privacy management level of the enterprise, including the level of privacy management and the life cycle of the equipment R&D and the corresponding privacy design process) and other related data. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of relevant data need to comply with relevant laws, regulations and standards of relevant countries and regions.

Claims

1. A device privacy management method, wherein: include: Measuring the privacy protection level of the device under test to obtain a first privacy measurement result; Measuring the privacy management level of the supplier to which the device under test belongs to obtain a second privacy measurement result; Generate a privacy protection score for the device under test according to the first privacy measurement result, the second privacy measurement result and a preset score weight; The privacy protection of the device under test is upgraded according to the privacy protection score.

2. The method according to claim 1, wherein: The measuring the privacy protection level of the device to be tested to obtain a first privacy measurement result includes: Obtain the privacy security score of the device under test in the privacy protection item; Generate a first privacy measurement result according to the score sub-weight corresponding to the privacy protection item and the privacy safety score corresponding to the privacy protection item; The privacy protection items include at least one of product compliance risk test items, product privacy and security protection technology test items, product adaptation law test items or product privacy protection requirement test items.

3. The method according to claim 2, wherein: If the privacy protection item is a product compliance risk test item, obtaining the privacy security score of the device under test in the privacy protection item includes: Configure compliance risk test cases; Testing the device to be tested according to the compliance risk test case to obtain a compliance risk test result, wherein the compliance risk test result corresponds to a risk level score; Calculate the average of the risk level scores corresponding to each compliance risk test case to obtain the average risk level score; The average risk level score is used as the privacy security score of the device under test in the product compliance risk test item.

4. The method according to claim 2, wherein: If the privacy protection item is a product privacy security protection technology test item, obtaining the privacy security score of the device under test in the privacy protection item includes: Determine the privacy and security protection technologies supported by the device under test; For each privacy and security protection technology item, determine the type, strength, and quantity of privacy and security protection technology applied by the privacy and security protection technology item; Obtain a preset mapping relationship set, wherein the preset mapping relationship set includes a mapping relationship between the type, strength, and quantity of preset privacy and security protection technologies and security scores; Determine the security score according to the preset mapping relationship set and the type, strength or quantity of the privacy and security protection technology applied by the privacy and security protection technology item; Calculate the average security score of each privacy and security protection technology item to obtain the average security score; The average security score is used as the privacy security score of the device under test in the product privacy security protection technology test item.

5. The method according to claim 2, wherein: If the privacy protection item is a product adaptation legal test item, obtaining the privacy security score of the device under test in the privacy protection item includes: Determine the target area where the equipment under test is to be put online; Determine the target legal baselines that need to be met in the target area; A privacy security score of the device under test is determined according to an actual legal baseline currently satisfied by the device under test and the target legal baseline.

6. The method according to claim 1, wherein: The step of measuring the privacy management level of the supplier to which the device under test belongs to obtain a second privacy measurement result includes: Determine the supplier of the device under test; Measuring the privacy management level of the supplier according to the reference privacy information management system and privacy maturity model to obtain a privacy management level score; Matching the reference software security development lifecycle with the actual software security development lifecycle of the device under test to obtain a first matching result; Matching the reference R&D privacy protection design process with the actual R&D privacy protection design process of the device under test to obtain a second matching result; Obtaining a research and design privacy management score according to the first matching result and the second matching result; A second privacy measurement result is generated based on the privacy management level score and the developed and designed privacy control score.

7. The method according to claim 2, wherein: The step of upgrading the privacy protection of the device under test according to the privacy protection score includes: If the privacy protection score does not meet the score threshold, determining the current privacy protection technology corresponding to the privacy protection item of the device under test; Changing the current privacy protection technology to obtain a target privacy protection technology; Re-measure based on the target privacy protection technology to obtain an updated first privacy measurement result; Obtaining an updated privacy protection score according to the updated first privacy measurement result and the second privacy measurement result; The privacy protection of the device under test is upgraded according to the updated privacy protection score.

8. The method according to claim 7, wherein: The step of obtaining an updated privacy protection score according to the updated first privacy measurement result and the second privacy measurement result includes: Multiplying the updated first privacy measurement result by the first score weight to obtain a first protection score; Multiplying the second privacy measurement result by the second score weight to obtain a second protection score; The first protection score and the second protection score are added together to obtain an updated privacy protection score.

9. The method according to claim 2, wherein: The step of obtaining the privacy security score of the device under test in the privacy protection item includes: Determine the product type of the device under test; Determine the product privacy protection requirement corresponding to the device under test according to the product type and the mapping relationship; The product privacy protection requirement degree is used as the privacy security score of the device under test with respect to the product type.

10. The method according to claim 1, wherein: The privacy protection level is the privacy protection level of the device for user data when the device is in use, and is determined by relevant configuration parameters of the device when the device is in use; The privacy management level refers to the control level of the supplier's privacy protection, where the supplier is the company that develops or produces the device.

11. The method according to claim 1, wherein: The preset score weights include a first score weight for the first privacy metric result and a second score weight for the second privacy metric result, and the first score weight and the second score weight each include 50%.

12. The method according to claim 4, wherein: The privacy and security protection technical items include at least one of data encryption, data backup and recovery, secure socket layer protocol data transmission, security products used in the cloud, interface authentication and authorization, data desensitization, anonymity algorithm, and differential privacy.

13. The method according to claim 6, wherein: The obtaining of a research and design privacy management score according to the first matching result and the second matching result includes: The first percentage corresponding to the first matching result and the second percentage corresponding to the second matching result are calculated according to the weight data to obtain the R&D design privacy management score.

14. The method according to claim 6, wherein: The reference privacy information management system includes ISO27701, and the privacy maturity model includes at least one of ISC2, NIST, GAPP, and CNIL.

15. A device privacy management apparatus, wherein: include: A first measurement module, used to measure the privacy protection level of the device under test to obtain a first privacy measurement result; A second measurement module, used to measure the privacy management level of the supplier to which the device under test belongs, to obtain a second privacy measurement result; A score generating module, configured to generate a privacy protection score of the device under test according to the first privacy measurement result, the second privacy measurement result and a preset score weight; The privacy management module is used to upgrade the privacy protection of the device under test according to the privacy protection score.

16. The device according to claim 15, wherein: The first measurement module includes: An acquisition unit, used to acquire the privacy security score of the device under test in the privacy protection item; A first generating unit, configured to generate a first privacy measurement result according to the score sub-weight corresponding to the privacy protection item and the privacy safety score corresponding to the privacy protection item; The privacy protection items include at least one of product compliance risk test items, product privacy and security protection technology test items, product adaptation law test items or product privacy protection requirement test items.

17. The device according to claim 16, wherein: The privacy protection item is a product compliance risk test item, and the acquisition unit includes: Configuration subunit, used to configure compliance risk test cases; A testing subunit, configured to test the device to be tested according to the compliance risk test case to obtain a compliance risk test result, wherein the compliance risk test result corresponds to a risk level score; The first calculation subunit is used to calculate the average value of the risk level scores corresponding to each compliance risk test case to obtain an average risk level score; The first generating subunit is used to use the average risk level score as the privacy security score of the device under test in the product compliance risk test item.

18. The device according to claim 16, wherein: The privacy protection item is a product privacy security protection technology test item, and the acquisition unit includes: A first determination subunit is used to determine the privacy and security protection technology items supported by the device under test; A second determination subunit is used to determine, for each privacy and security protection technology item, the type, strength and quantity of the privacy and security protection technology applied by the privacy and security protection technology item; An acquisition subunit is used to acquire a preset mapping relationship set, wherein the preset mapping relationship set includes a mapping relationship between the type, strength, and quantity of preset privacy and security protection technologies and security scores; A third determination subunit is used to determine a security score according to the preset mapping relationship set and the type, strength or quantity of the privacy and security protection technology applied by the privacy and security protection technology item; The second calculation subunit is used to calculate the average security score of each privacy and security protection technology item to obtain an average security score; The second generating subunit is used to use the average security score as the privacy security score of the device under test in the product privacy security protection technology test item.

19. An electronic device, wherein: The electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the device privacy management method according to any one of claims 1 to 14 are implemented.

20. A computer-readable storage medium, wherein: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the device privacy management method according to any one of claims 1 to 14 are implemented.

Images