WO2023123493A1 - 数据管理方法及装置 - Google Patents

数据管理方法及装置 Download PDF

Info

Publication number
WO2023123493A1
WO2023123493A1 PCT/CN2021/144004 CN2021144004W WO2023123493A1 WO 2023123493 A1 WO2023123493 A1 WO 2023123493A1 CN 2021144004 W CN2021144004 W CN 2021144004W WO 2023123493 A1 WO2023123493 A1 WO 2023123493A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
privacy
service
module
identifier
Prior art date
Application number
PCT/CN2021/144004
Other languages
English (en)
French (fr)
Inventor
尚瑜
李江琪
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to CN202180046943.6A priority Critical patent/CN116686307A/zh
Priority to PCT/CN2021/144004 priority patent/WO2023123493A1/zh
Publication of WO2023123493A1 publication Critical patent/WO2023123493A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor

Definitions

  • This application relates to the field of intelligent control, in particular to a data management method and device.
  • the present application provides a data management method and device, which improves the security and efficiency of privacy control.
  • a data management method is provided, the method is applied to a vehicle, and the vehicle includes a privacy center module, a privacy proxy module, and a middleware module, wherein the privacy center module is used to implement a privacy configuration function, The privacy proxy module is used to implement a privacy control function, and the middleware module is used to provide an interface based on a service-oriented architecture SOA for the business.
  • the method includes: the privacy center module obtains a privacy configuration file; the privacy center module According to the privacy configuration file, obtain a privacy policy file, the privacy policy file includes at least one of the following: first configuration information, used to indicate access rights between services or between services; Two configuration information, used to indicate the access rights of the service; the privacy center module sends the privacy policy file to the privacy agent module, and the privacy policy file is used for access control of the middleware module.
  • a privacy configuration scheme for vehicles based on the SOA architecture is provided, using a privacy center module to obtain a privacy configuration file, generating a privacy policy file, and then distributing it to a privacy proxy module close to the business.
  • the privacy proxy module is used to control the privacy data of the business processed by the middleware module according to the privacy policy file, so that all the business inside the vehicle cannot bypass the privacy control, and it provides a terminal from the business end to the underlying data end.
  • the end-to-end privacy control service associates the user's privacy configuration with the data service interface at the bottom of the system, and can provide unified privacy control for the heterogeneous architecture in the vehicle, improving the security and efficiency of privacy control.
  • the privacy center module acquires a privacy policy file according to the privacy configuration file, including: the privacy center module obtains a privacy policy file through a display interface according to the privacy configuration file Presenting privacy configuration options to the user, the privacy configuration options are used for the user to select at least one of the following: whether to authorize the service to call the data of at least one service, whether to authorize the service to call the data of at least one other service; the privacy center The module obtains the user's selection result of the privacy configuration option; the privacy center module obtains the privacy policy file according to the selection result.
  • the privacy center module binds the user's consent status in units of business, so that business behavior must comply with the user's wishes and cannot be bypassed, thereby realizing a privacy protection scheme from the business end to the data end.
  • the privacy configuration file includes privacy classification information, and the privacy classification information is used to indicate the privacy level of data corresponding to different service identifiers, wherein the service The ID is an ID indicating the provider of the data.
  • the privacy level information uses a quantitative value to distinguish data privacy levels.
  • the source of the provided data is classified through the service identification. Based on the service of the platform, it is also possible to quantify and mark the data by classification and classification on the basis of marking with service marks.
  • the privacy classification information is associated with the service identification, so as to identify and manage private data in the process of business processing based on the SOA architecture, realize quantitative evaluation of data privacy sensitivity, and improve the efficiency of private data management of vehicles.
  • the first configuration information includes at least one of the following: indicating the first between the service identifier of the service that allows data provision and the customer identifier of the service that allows data collection Information about an association relationship; information indicating a second association relationship between a service identifier that allows the provision of shared data services and a customer identifier that allows the acquisition of shared data services; wherein, the customer identifier is the identifier indicating the caller of the data , the service identifier is an identifier indicating a data provider.
  • the second configuration information includes at least one of the following: the customer identification of the business that allows data collection; the customer identification or process of the business that allows data transmission outside the vehicle ID; a service ID that allows data to be provided; a service ID that allows data sharing services; wherein, the customer ID is the ID of the caller indicating the data, and the service ID is the ID of the provider of the data, so
  • the above-mentioned process ID is the ID when the business runs as a process.
  • the privacy configuration file includes at least one of the following: defining the identification of the business; defining the identification of the service; defining the identification of different data life cycle stages; indicating the business and Information on the relationship between services; information indicating the relationship between services and services.
  • the defining service identifier includes at least one of the following: defining service identifiers in different data lifecycle stages; defining service identifiers in different communication protocols;
  • the definition of service identification includes at least one of the following: defining service identification in different data life cycle stages; defining service identification in different communication protocols.
  • a data management method is provided, the method is applied to a vehicle, and the vehicle includes a processing module, a privacy agent module, and a middleware module, wherein the processing module is used to process business, and the privacy agent The module is used to realize the privacy control function, and the middleware module is used to provide an interface based on service-oriented architecture SOA for the business.
  • the method includes: the processing module sends the first request information to the middleware module, and the second A request message is used to request to call the first data for the first service, the first request message includes a first identifier, and the first identifier includes at least one of the following: the client identifier of the first service, the first A business process identifier, the service identifier of the provider of the first data, wherein the client identifier is the identifier indicating the caller of the data, the service identifier is the identifier indicating the provider of the data, and the process identifier is the identifier when the service is running as a process; the middleware module sends first query information to the privacy agent module, and the first query information is used to query whether to agree to call the first data for the first service, The first query information includes the first identification; the privacy proxy module sends first response information to the middleware module, and the first response information is used to indicate whether to agree to the first service call.
  • the first data wherein the first response information is determined according to the first identification and the privacy policy file, and the privacy policy file includes at least one of the following: first configuration information, used to indicate business and service access rights between services or between services; the second configuration information is used to indicate the access rights of services.
  • data privacy control can be realized. For example, data collection, data sharing, and data out-of-vehicle transmission, etc., when the business calls data, based on the SOA principle of the vehicle, the business uniformly calls the data through the middleware module, and the middleware module determines whether the call belongs to the privacy policy file through the privacy proxy module allowed range.
  • a privacy control node is added to control the business performed by the middleware module, and implement a private data collection control method that cannot be bypassed by the upper-level business. Improve the efficiency and security of vehicle privacy control.
  • the first configuration information includes at least one of the following: indicating the first between the service identifier of the service that allows data provision and the customer identifier of the service that allows data collection Information about an association relationship; information indicating a second association relationship between a service identifier of a service that allows sharing data and a customer identifier that allows access to the service of sharing data.
  • the second configuration information includes at least one of the following: the customer identification of the business that allows data collection; the customer identification or process of the business that allows data transmission outside the vehicle ID; the service ID of the service that allows the provision of data; the service ID of the service that allows the provision of shared data.
  • the first service invokes the first data through data collection
  • the first data is the data of the first service
  • the first identification Including the customer identification of the first business and the service identification of the first service
  • the privacy proxy module sends the first response information to the middleware module, including: the privacy proxy module in the first business If the customer identifier and the service identifier of the first service belong to the first association relationship indicated by the first configuration information, send the first response information to the middleware module, and the first response information It is used to indicate that the first data is agreed to be invoked for the first service.
  • the first service invokes the first data through data sharing
  • the first data is the data of the second service
  • the shared data The type is subscription publishing
  • the first identification includes the customer identification of the first business and the service identification of the second business
  • the method further includes: the privacy proxy module sends a first response to the middleware module information, including: the privacy proxy module sends the intermediary a
  • the software module sends the first response information, where the first response information is used to indicate that the first data is agreed to be called for the first service.
  • the first service invokes the first data in any of the following ways: data collection, data transmission outside the vehicle, and the first identification Including the client ID of the first business or the process ID of the first business, the privacy proxy module sends the first response information to the middleware module, including: the privacy proxy module belongs to If the second configuration information indicates that the access is allowed, the first response information is sent to the middleware module, and the first response information is used to indicate the consent to call the first service for the first service. first data.
  • the first service invokes the first data in a data sharing manner
  • the first data is the data of the second service
  • the shared data The type is shared broadcast
  • the first identification includes the service identification of the second business
  • the privacy proxy module sends the first response information to the middleware module, including: the privacy proxy module in the second business If the service identifier of the service belongs to the scope of the allowed access indicated by the second configuration information, the first response information is sent to the middleware module, and the first response information is used to indicate that the first response information is agreed to be the first The service invokes the first data.
  • a data management method includes: a data storage management module receives storage request information of a first service from a processing module, and the storage request information includes: the first data to be stored, the second Data identification and storage rating information of a data, wherein the storage rating information is used to indicate the privacy level corresponding to the data identification of the first data, wherein the processing module is set in the vehicle, and the data storage management module It is used to realize the data storage management function, the processing module is used to process business; the data storage management module stores the first data; , deleting the first data, wherein the retention period is determined according to the storage grading information.
  • This application associates the retention period of the data with the storage classification information and manages and controls it.
  • the data storage management module stores and manages the data in the vehicle, it can delete the data according to the retention period corresponding to the storage classification information, so as to realize the unified management of private data and timing deletion, which improves the safety and efficiency of vehicle data storage management.
  • the data storage management module sends second query information to the privacy proxy module, the second query information is used to query the retention period of the first data,
  • the second query information includes the data identifier of the first data and the storage classification information, and the privacy proxy module is used to implement the privacy control function;
  • the privacy proxy module sends the first indication information, the first indication information is used to indicate the storage period of the first data.
  • the privacy proxy module associates the data retention period with the storage classification information and controls it.
  • the data storage management module stores and manages the data in the vehicle, it can obtain information related to the retention period through communication with the privacy proxy module. , to delete data according to the retention period, realize the unified management and regular deletion of private data, and improve the safety and efficiency of vehicle data storage management.
  • the data storage management module sends second query information to the privacy agent module, and the second query information includes the data identifier of the first data and the The storage classification information
  • the privacy proxy module is used to implement the privacy control function; the privacy proxy module determines the retention period according to the storage classification information; when the storage duration of the first data reaches the retention period
  • the privacy proxy module sends deletion instruction information to the data storage management module, where the deletion instruction information is used to instruct deletion of the first data.
  • the data storage management module is set in the vehicle.
  • a vehicle-mounted device in a fourth aspect, includes a privacy center module, a privacy agent module, and a middleware module, the privacy center module is used to obtain a privacy configuration file; according to the privacy configuration file, obtain a privacy policy file, the privacy policy file includes at least one of the following: first configuration information, used to indicate the access rights between services or between services; second configuration information, used to indicate the access rights of services authority; and send the privacy policy file to the privacy agent module, the privacy policy file is used for the access control of the middleware module, wherein the middleware module is configured to provide services based on service-oriented architecture SOA interface.
  • the privacy center module is specifically configured to: present privacy configuration options to the user through a display interface according to the privacy configuration file, and the privacy configuration options use The user selects at least one of the following: whether to authorize the service to call data of at least one service, whether to authorize the service to call data of at least one other service; obtain the selection result of the user for the privacy configuration option; and according to the According to the above selection result, obtain the privacy policy file.
  • the privacy configuration file includes privacy rating information, and the privacy rating information is used to indicate the privacy level of data corresponding to different service identifiers, where the The above service identifier is an identifier indicating a data provider.
  • the privacy level information uses a quantitative value to distinguish data privacy levels.
  • the first configuration information includes at least one of the following: indicating the difference between a service identifier of a service that is allowed to provide data and a customer identifier of a service that is allowed to collect data The information of the first association relationship; the information indicating the second association relationship between the service identification that allows the provision of shared data business and the customer identification that allows the acquisition of shared data business; wherein, the customer identification is the caller indicating the data The identifier of the service identifier is the identifier indicating the provider of the data.
  • the second configuration information includes at least one of the following: a customer identification of a business that allows data collection; a customer identification of a business that allows data transmission outside the vehicle or a process identifier; a service identifier that allows data to be provided; a service identifier that allows data sharing services; wherein, the client identifier is the identifier indicating the caller of the data, and the service identifier is the identifier indicating the provider of the data , the process identifier is the identifier when the service is running as a process.
  • the privacy configuration file includes at least one of the following: defining the identity of the business; defining the identity of the service; defining the identity of different data life cycle stages; indicating Information on the relationship between businesses and services; information indicating the relationship between businesses and services.
  • the defining service identifiers includes at least one of the following: defining service identifiers in different data life cycle stages; defining service identifiers in different communication protocols ;
  • the identification of the defined service includes at least one of the following: defining the identification of the service in different data life cycle stages; defining the identification of the service in different communication protocols.
  • a vehicle-mounted device in a fifth aspect, includes a processing module, a privacy agent module, and a middleware module, and the processing module is used to send first request information to the middleware module, and the first request
  • the information is used to request to call the first data for the first service
  • the first request information includes a first identification
  • the first identification includes at least one of the following: the customer identification of the first service, the first service process identifier of the provider of the first data, the service identifier of the provider of the first data, wherein, the client identifier is the identifier of the caller indicating the data, the service identifier is the identifier of the provider of the data, and the process identifier is the business As an identifier when the process is running;
  • the middleware module is used to send first query information to the privacy agent module, and the first query information is used to query whether to agree to call the first data for the first service,
  • the first query information includes the first identifier, wherein the middleware module is configured to provide an
  • the first configuration information includes at least one of the following: indicating the relationship between the service identifier of the service that allows data provision and the customer identifier of the service that allows data collection The information of the first association relationship; the information indicating the second association relationship between the service identifier of the service that allows the sharing of data and the customer identifier of the service that allows the sharing of data.
  • the second configuration information includes at least one of the following: a customer identification of a business that allows data collection; a customer identification of a business that allows data transmission outside the vehicle or a process ID; a service ID for a service that allows data to be provided; a service ID for a business that allows data sharing.
  • the first service invokes the first data through data collection
  • the first data is data of the first service
  • the first service An identification includes a customer identification of the first business and a service identification of the first service
  • the privacy proxy module is specifically configured to identify the customer identification of the first business and the service identification of the first service belonging to the In the case of the first association relationship indicated by the first configuration information, send the first response information to the middleware module, where the first response information is used to indicate the consent to call the first service for the first service a data.
  • the first service invokes the first data through data sharing
  • the first data is the data of the second service
  • the data The type of sharing is subscription publication
  • the first identification includes the customer identification of the first business and the service identification of the second business
  • the privacy agent module is specifically used to share the customer identification of the first business and the service identification of the second business. If the service identifier of the second service belongs to the second association relationship indicated by the first configuration information, send the first response information to the middleware module, and the first response information is used to indicate consent Invoking the first data for the first service.
  • the first service invokes the first data in any of the following ways: data collection, data transmission outside the vehicle, the first service An identification includes a customer identification of the first service or a process identification of the first service, and the privacy agent module is specifically used to allow access when the first identification belongs to the scope indicated by the second configuration information.
  • the first response information is sent to the middleware module, where the first response information is used to indicate that the first data is agreed to be invoked for the first service.
  • the first service invokes the first data in a data sharing manner
  • the first data is the data of the second service
  • the data The type of sharing is broadcast sharing
  • the first identifier includes the service identifier of the second business
  • the privacy proxy module is specifically used to allow access when the service identifier of the second business belongs to the second configuration information.
  • a device for data management including: a data storage management module, the data storage management module is configured to receive storage request information of the first service from a processing module, and the storage request information includes: The first data to be stored, the data identifier of the first data, and storage rating information, wherein the storage rating information is used to indicate the privacy level corresponding to the data identifier of the first data, wherein the processing module sets In the vehicle, the data storage management module is used to realize the data storage management function, and the processing module is used to process business; the data storage management module is also used to store the first data; and in the first After the storage period of the data reaches the retention period, the first data is deleted, wherein the retention period is determined according to the storage classification information.
  • the device further includes a privacy proxy module, and the data storage management module is further configured to send second query information to the privacy proxy module, so The second query information is used to query the retention period of the first data, and the second query information includes the data identifier of the first data and the storage classification information; the privacy agent module is used to send the data to the The data storage management module sends first indication information, where the first indication information is used to indicate the retention period of the first data.
  • the device further includes a privacy proxy module, and the data storage management module is further configured to send second query information to the privacy proxy module, so
  • the second query information includes the data identifier of the first data and the storage classification information;
  • the privacy proxy module is used to determine the retention period according to the storage classification information; and in the first data When the storage duration reaches the retention period, sending deletion instruction information to the data storage management module, where the deletion instruction information is used to instruct deletion of the first data.
  • the device is the vehicle.
  • a vehicle-mounted device the device includes a processor, the processor is used to call a computer program from the memory, and when the computer program is executed, the processor is used to execute the above-mentioned first aspect or the first aspect A method in any possible implementation manner, or used to execute the above second aspect or a method in any possible implementation manner of the second aspect.
  • a device for data management includes a processor, the processor is used to call a computer program from a memory, and when the computer program is executed, the processor is used to perform the above-mentioned third aspect or A method in any possible implementation of the third aspect.
  • a computer-readable storage medium for storing a computer program, the computer program including codes for executing the method in the above-mentioned first aspect or any possible implementation manner of the first aspect, or including The code for executing the method in the above second aspect or any possible implementation manner of the second aspect, or includes the code for executing the method in the above third aspect or any possible implementation manner of the third aspect.
  • a computer program product including a computer program, where the computer program includes code for executing the method in the first aspect or any possible implementation of the first aspect, or includes code for executing the above-mentioned
  • a vehicle in an eleventh aspect, includes the above-mentioned fourth aspect or the vehicle-mounted device in any possible implementation of the fourth aspect, the fifth aspect or the vehicle-mounted device in any possible implementation of the fifth aspect, or The sixth aspect or the device in any possible implementation manner of the sixth aspect, or the vehicle-mounted device of the seventh aspect, or the device for data management of the eighth aspect.
  • FIG. 1 is a schematic diagram of an SOA applied to a vehicle according to an embodiment of the present application.
  • FIG. 2 is a schematic diagram of a privacy management framework applied to a vehicle according to an embodiment of the present application.
  • FIG. 3 is a schematic diagram of a vehicle domain control architecture in which the vehicle is a central gateway type according to an embodiment of the present application.
  • Fig. 4 is a schematic diagram of a vehicle domain control architecture in which the vehicle is a central gateway type according to another embodiment of the present application.
  • FIG. 5 is a schematic diagram of a vehicle as a new ring network architecture according to an embodiment of the present application.
  • Fig. 6 is a specific embodiment of a privacy file configuration applied to a vehicle according to an embodiment of the present application.
  • Fig. 7 is a specific embodiment of a privacy file configuration applied to a vehicle according to an embodiment of the present application.
  • Fig. 8 is a schematic diagram of a privacy configuration file according to an embodiment of the present application.
  • Fig. 9 is a schematic diagram of a privacy configuration file according to an embodiment of the present application.
  • Fig. 10 is a schematic diagram of a privacy configuration file according to an embodiment of the present application.
  • Fig. 11 is a schematic diagram of a data management method according to an embodiment of the present application.
  • Fig. 12 is a specific embodiment of a data management method for data collection according to an embodiment of the present application.
  • Fig. 13 is a schematic diagram of a data management method for data sharing according to an embodiment of the present application.
  • FIG. 14 is a schematic flowchart of a data management method for data transmission according to an embodiment of the present application.
  • Fig. 15 is a data management method for data storage according to an embodiment of the present application.
  • FIG. 16 is a schematic flowchart of a data management method for data storage according to an embodiment of the present application.
  • FIG. 17 is a schematic flowchart of a data management method for data storage according to an embodiment of the present application.
  • FIG. 18 is a schematic structural diagram of a device 1800 according to an embodiment of the present application.
  • FIG. 19 is a schematic structural diagram of a device 1900 according to an embodiment of the present application.
  • FIG. 20 is a schematic structural diagram of a device 2000 according to an embodiment of the present application.
  • Fig. 21 is a schematic structural diagram of a device 2100 according to an embodiment of the present application.
  • the embodiment of the present application provides a data management method and device, which can provide a complete set of data cycle management solutions covering human-computer interaction, data collection, business processing using data, and data retention and destruction for vehicle privacy protection.
  • the reversing video service may refer to collecting real-time video of the surrounding environment of the vehicle when the vehicle is reversing.
  • the remote diagnosis service can refer to the regular reporting of fault data during the vehicle operation phase.
  • the pet mode service may refer to a service in which the vehicle feeds back the status information in the vehicle to the owner in real time when the owner leaves the pet inside the vehicle.
  • the vehicle upgrade business can refer to the vehicle regularly reporting the status information of each component in the vehicle to support the software upgrade of the vehicle.
  • the data obtained during the execution of the above business may belong to private data.
  • the aforementioned private data includes, but is not limited to: video data obtained from reversing images, vehicle status data, and the like.
  • Program Refers to the underlying functions in the system that are not directly exposed to users, such as a service program that is being executed.
  • a service refers to the internal services of the system that do not directly face customers.
  • the basic capabilities of the system can be provided to the business in the form of services for scheduling.
  • services may refer to different units of functionality in an application.
  • a service may be: a functional unit that records video data from an in-vehicle camera, a functional unit that records status information on vehicle interior components, a functional unit that records audio data from a vehicle microphone.
  • the above state information may include state information of a thermal management system (thermal management system, TMS), vehicle driving state information of a vehicle domain controller (VDC), environment perception information of a radar, and the like.
  • TMS thermal management system
  • VDC vehicle domain controller
  • environment perception information of a radar and the like.
  • Client identifier It is the identifier used to indicate the data caller.
  • the data caller may also be referred to as the service caller, and generally refers to the identification of the service using the data.
  • the customer ID can be understood as the ID assigned by the system protocol stack to the upper-layer business, so as to distinguish the business that calls the data.
  • Service identifier It is the identifier used to indicate the data provider. Wherein, a data provider may also be called a service provider, and generally refers to a program that generates data or provides data.
  • the service identification can be understood as the system protocol stack used to identify the underlying program. From the perspective of privacy protection, when the underlying program is associated with personal privacy data, it can be considered that the service identifier is the identifier assigned to the data provider.
  • service identifiers are assigned to programs. For example, if a service requires a vehicle identification number (VIN), the assigned service identifier 001 is used to identify the program that provides the VIN, not the VIN itself.
  • VIN vehicle identification number
  • Process ID When a business that uses private data runs directly as a process in the machine, the business can be identified through the process ID.
  • Data identification used to identify different data, and can be used to identify saved data items or files during data storage. For example, after a business obtains data, it can assign a data identifier to the data. After the reversing image service obtains the video data recorded by the camera outside the vehicle, it can assign a data identifier to the video data.
  • This application utilizes a service-oriented architecture (service-oriented architecture, SOA) to realize data management and transmission inside the vehicle.
  • SOA is a loosely coupled service architecture. Services communicate through simple and precisely defined interfaces, without involving underlying programming interfaces and communication models. The interface is defined in a neutral way, which can be independent of the hardware platform, operating system and programming language that implements the service. This enables services built in a wide variety of systems to interact in a unified and common way.
  • FIG. 1 is a schematic diagram of an SOA applied to a vehicle according to an embodiment of the present application.
  • SOA includes application layer, service layer, system software layer, hardware layer, and perception execution layer.
  • the application layer is used to run services, including the functions of the upper layer of the system that users can perceive. It can realize the definition and combination enhancement of vehicle services, applications, experiences, etc.
  • the application layer includes, but is not limited to, services in areas such as smart cockpits, autonomous driving, and connected services.
  • the service layer is used to implement certain data fusion or control logic. As the smallest unit of service and a single execution entity, it provides on-demand basic services for applications through interfaces (for example, application programming interface (API)).
  • API application programming interface
  • the system software layer includes middleware modules, vehicle operating system (operation system, OS), hardware drivers and adapters, virtual machines, etc.
  • the middleware module may refer to a functional module for providing SOA-based interfaces.
  • the middleware module is mainly used to realize the following functions: on the one hand, it can encapsulate the bottom layer implementation, and shield the bottom layer implementation and differences of the system that are useless to the upper layer business. On the other hand, it can aggregate all service information and provide a unified service subscription and request entry for upper-level business. In other words, the middleware module can be used as an anchor point to add a new layer of management and control that cannot be bypassed to the upper-layer business.
  • the functions of the middleware module include: providing a unified service call entry for the upper-level business of the vehicle.
  • the middleware module performs Message transformation, content recognition, and finally redirection of the request to the service, where the service principal responds.
  • the functions of the middleware module include: unified transmission channel control for vehicle data outbound, when business data needs to be transmitted to the cloud, the data is transmitted to the middleware module through the in-vehicle protocol, The middleware module performs message identification, protocol conversion, and finally transmits the data to the cloud server.
  • the hardware layer includes various processors and hardware facilities, such as heterogeneous computing platforms, graphics processing unit (GPU), central processing unit (central processing unit, CPU), image sensor processing (image sensor processing, ISP) Module, microcontroller unit (MCU), acceleration core, etc.
  • graphics processing unit GPU
  • central processing unit central processing unit
  • image sensor processing image sensor processing
  • ISP image sensor processing
  • MCU microcontroller unit
  • acceleration core etc.
  • the perception and execution layer includes various sensors and wire control systems.
  • sensors include but are not limited to radars and cameras.
  • Control-by-wire systems include but are not limited to power systems, steering systems, and braking systems.
  • SOA can encapsulate the traditional controller area network (controller area network, CAN) signal into a form of service to expose the business.
  • the service-oriented data can take advantage of the Ethernet protocol to ensure reliability and provide a convenient call interface.
  • the data stream is no longer sent in the traditional CAN broadcast mode, but is pushed based on subscription to achieve on-demand acquisition of system resources.
  • SOA can realize the following types of platform-based content:
  • Platformization of resources After platformization, personal data sources are uniformly packaged and centrally retrieved through business. For example, when a business needs a VIN, it is no longer obtained separately through diagnostic trouble codes, but a request is made to a unified VIN management service. After the request is successful, the VIN code value can be obtained in the response message.
  • Capability platform In the SOA architecture, the communication protocol of each component can be uniformly managed and controlled to form a platform middleware.
  • the upper-layer business no longer independently integrates the protocol stack, but realizes the communication function by accessing the unified middleware.
  • a network standard protocol such as Hypertext Transfer Protocol HTTP
  • the business access middleware module carries the business data load (payload) that needs to be transmitted in the message in the access request, and the middleware module will The business data load (payload) is encapsulated through the standard protocol definition to realize data outbound.
  • resource platformization in (i) above may refer to data plane platformization
  • capability platformization in (ii) may refer to control plane platformization.
  • Platformization of data storage The cloud can implement platformization of storage with the help of the unified scheduling capability of the data storage management module. Data needs to go through a unified control node before being placed on the disk and the server, and it can only be stored after confirming that it is a business with write permission. And conversely, when reading data from the data storage management module, it will also go through a trusted authentication node.
  • writing to disk refers to writing data into a storage medium, such as a magnetic disk.
  • Platform-based extension of the validity period Based on the storage platform, when the placed data is tagged, the retention period can be managed according to the tag. For example, if the data retention period of a certain business is fixed at 90 days, the data transmitted by the business to the data storage management module every day includes process ID, customer ID or data ID. It will be deleted after the binding label confirmation expires.
  • FIG. 1 is only used as an example to describe the SOA architecture, and the SOA architecture obtained by making appropriate modifications or additions or subtractions on the basis of FIG. 1 is also applicable to the method of the embodiment of the present application.
  • the embodiment of the present application provides a data management solution for vehicles.
  • the data management solution provides an SOA-based privacy management framework, and the privacy management framework can realize customizable unified management of the entire data life cycle. , including data collection, sharing, transmission, storage, etc.
  • the privacy management architecture of the embodiment of the present application will be described with reference to the accompanying drawings.
  • FIG. 2 is a schematic diagram of a privacy management framework applied to a vehicle according to an embodiment of the present application.
  • the privacy management architecture includes a vehicle and a cloud server, which can also be called the vehicle end and the cloud respectively.
  • the cloud server may include one or more servers.
  • the embodiment of the present application does not limit the structure and type of the cloud server.
  • the cloud server may adopt a central system or a distributed system.
  • the cloud server may be an original equipment manufacturer (original equipment manufacturer, OEM) own cloud server, or a server of a third-party service provider (such as a service provider providing voice entertainment services).
  • OEM original equipment manufacturer
  • a third-party service provider such as a service provider providing voice entertainment services
  • the functions of the cloud server include but are not limited to the following items: hosting the editing of privacy configuration files during the vehicle development phase; related control functions during the vehicle use phase; undertaking the responsibility of privacy log backup.
  • the vehicle includes a processing module, a middleware module, a privacy center module, and a privacy agent module.
  • the aforementioned vehicles include, but are not limited to, electric vehicles, smart vehicles, and the like.
  • modules are divided by functions, and in terms of physical implementation, the above-mentioned modules can be set on different nodes, or can be set on the same node. Each module can be set on a single node, or can be set on multiple nodes using distributed technology.
  • the processing module may refer to a functional module in the vehicle for processing services or application programs, and the processing module may be arranged on any node in the vehicle, for example, the above-mentioned processing module may be arranged in a domain controller or an ECU inside the vehicle.
  • the middleware module can be set at a node close to the service, for example, can be set at the same node as the processing module.
  • the vehicle may include a privacy center module and a privacy agent module.
  • the privacy center module may be arranged on a node with higher processing capability in the interior of the vehicle.
  • the functions of the privacy center module include but are not limited to the following items.
  • the privacy configuration file management function is used to edit the privacy configuration file connected to the cloud, that is, to accept the privacy-related configuration file sent by the cloud, and to perceive and process it.
  • the editing of the privacy configuration file may include but not limited to at least one of the following: privacy copy configuration; privacy preference configuration; personally identifiable information (personally identifiable information, PII) storage configuration; data classification configuration.
  • the user configuration management function is used to connect with users, and the above-mentioned users include vehicle owners or other vehicle users.
  • the privacy center module can interact with users through the human machine interface (HMI) interface, and complete the reception and processing of privacy configuration based on natural persons through the associated user management module.
  • HMI human machine interface
  • the policy engine is used for privacy configuration file management and user configuration management, and further generates a privacy policy that can be processed by the internal system of the car, and the privacy policy can be sent to the privacy agent module for execution.
  • the privacy agent module can be used to receive the control instructions from the privacy center module, and realize the privacy control function by docking business.
  • the functions of the privacy proxy module include but are not limited to the following items.
  • Policy execution which is used to connect to the privacy policy issued by the privacy center, or perform real-time privacy operations based on local user configuration.
  • the embodiment of the present application may generally include a privacy center module and one or more privacy agent modules.
  • this embodiment of the present application does not limit the specific deployment locations of the privacy center module and the privacy agent module.
  • the privacy center module and the privacy proxy module can be deployed at different nodes in the vehicle. Even some privacy proxy modules can be deployed on cloud servers.
  • the privacy center module can usually be deployed on nodes inside the vehicle, such as a smart cockpit domain controller (cockpit domain controller, CDC) or a vehicle domain controller (vehicle domain controller, VDC) etc. Computing power nodes, or can be arranged in other domain controllers.
  • different functional modules in the privacy center module can also be scattered and arranged at different nodes.
  • the user configuration management module in the privacy center module can be set at the CDC to facilitate interaction with users, while the other functional modules in the privacy center module can be set at the VDC.
  • the privacy proxy module is usually arranged at a location closer to the business.
  • the privacy proxy module can be set on a node that processes services.
  • the privacy agent module can be arranged at the vehicle operating system (operation system, OS), so as to manage and control the upload service in conjunction with the middleware module.
  • the privacy agent module can be arranged in each node in the vehicle, for example, the privacy agent module can be arranged in domain controllers responsible for different functions or in different ECUs.
  • the privacy agent module can also be arranged in the cloud, for example, the user's privacy data can be uploaded to the data storage management module in the cloud, so the privacy agent module can also be arranged near the data storage management module for use in and data storage Related Privacy Management.
  • nodes may typically be included within the vehicle, each node being responsible for a different management and control function.
  • These nodes may include but not limited to a domain controller (domain control unit, DCU) and an electronic control unit (electronic control unit, ECU) inside the vehicle.
  • ECU refers to the control unit that uses various sensors and bus data acquisition and exchange to control the driving state of the car and other various functions.
  • the ECU may include an engine management system (engine management system, EMS), an automatic transmission control unit (transmission control unit, TCU), a battery management system (battery management system, BMS) and the like.
  • Each ECU is provided with units such as a microcontroller, a memory, an input/output interface, and the like.
  • Different ECUs may have different processing capabilities, or may come from different manufacturers, and are used to manage different functions inside the vehicle.
  • the future vehicle control will tend to be centralized management.
  • several domain controllers can be set in the vehicle, while the functions of the traditional ECU are simplified, and the software and processing functions are Downgrading, only the executive level functions are retained.
  • ECU or sensors can transmit data to the domain controller, and the domain controller will complete complex calculations and most of the control functions.
  • the solutions of the embodiments of the present application can be applied to various system architectures in the evolution process of smart locomotives.
  • the privacy center module and the privacy agent module can be set in the same node, or can be set in different nodes.
  • the privacy center module and the privacy agent module can be set in the same domain controller, or can be set in different domain controllers.
  • a processing module, a middleware module, and a privacy proxy module can be set at multiple nodes in the vehicle.
  • the processing module at each node is used to process the business related to this node, and realize the privacy management of data through the middleware module and privacy agent module of this node.
  • communication and interaction may also be performed to realize data privacy management.
  • the vehicle may also include some basic components required by the smart car.
  • a human machine interface human machine interface, HMI
  • a user management module used to provide user interaction capabilities, for example, it can provide a screen to output content for users to read, and provide button options so that users can perform input configurations according to their wishes.
  • the user management module is used to provide the user's identity authentication ability and identity association ability, so that the privacy protection scheme centered on "people" can be established.
  • the system architecture of the vehicle in the embodiment of the present application may be applicable to the traditional central gateway type vehicle domain controller architecture, or to the new ring network architecture, or may also be applicable to other vehicle architectures.
  • the central gateway vehicle-mounted domain controller architecture is also called a star architecture, in which multiple domains are set, and each domain includes a master domain controller, such as a smart cockpit domain controller (cockpit domain controller, CDC ), Multi Domain Controller (MDC), Vehicle Domain Controller (VDC), etc.
  • a master domain controller such as a smart cockpit domain controller (cockpit domain controller, CDC ), Multi Domain Controller (MDC), Vehicle Domain Controller (VDC), etc.
  • MDC Multi Domain Controller
  • VDC Vehicle Domain Controller
  • One or more ECUs can be mounted under each domain controller.
  • each domain controller can be connected to the VIU, and each VIU is mounted with multiple ECUs.
  • the VIU can be understood as an enhanced gateway.
  • the concept of the domain is weakened, and the ECU is not directly connected to the domain controller, but is connected to the domain controller through the VIU.
  • FIG. 3 is a schematic diagram of a vehicle domain control architecture in which the vehicle is a central gateway type according to an embodiment of the present application.
  • the architecture may include domain controllers such as CDC, MDC, VDC, and telematics BOX (TBOX).
  • the privacy center module can be set in CDC.
  • the privacy proxy module, the processing module and the middleware module can be set in each domain controller, and the privacy proxy module can be used to realize the privacy control function of the domain controller where it is located.
  • the above domain controllers are defined as follows.
  • CDC Domain controller used to carry human-computer interaction and audio-visual entertainment functions of the car.
  • MDC A domain controller used to carry assisted driving or automatic driving functions, and can also be called an automated driving control unit (ADCU).
  • ADCU automated driving control unit
  • VDC Domain controller for chassis and power control.
  • TBOX Provides the basic communication capabilities of the Internet of Vehicles.
  • an ECU with higher computing power can also be used to process services, therefore, a privacy proxy module, a processing module, and a middleware module can also be set in the ECU.
  • the privacy center module can also be arranged on multiple domain controllers in a distributed manner.
  • FIG. 4 is a schematic diagram of another embodiment of the present application in which the vehicle is a central gateway type vehicle domain control architecture.
  • the user configuration management module in the privacy center module can be set at the CDC to facilitate interaction with users, while the privacy configuration file management module and policy engine in the privacy center module can be set at the VDC.
  • FIG. 5 is a schematic diagram of a vehicle as a new ring network architecture according to an embodiment of the present application.
  • the privacy center module can be set in CDC
  • the privacy proxy module, processing module and middleware module can be set in CDC, VDC or MDC.
  • the privacy center module can also be arranged on other nodes, or the privacy center module can also be arranged on multiple nodes using distributed technology.
  • the user configuration management module in the privacy center module can be set at the CDC, while the privacy configuration file management module and the policy engine in the privacy center module can be set at the VDC.
  • the VIU with higher computing power can also be used to process services, therefore, a privacy proxy module, a processing module, and a middleware module can also be set in the VIU.
  • Fig. 2 to Fig. 5 are only used as examples to describe possible application scenarios of the embodiments of the present application, and the application scenarios obtained by making appropriate deformations or additions or subtractions on the basis of Fig. 2 to Fig. 5 are also applicable to the implementation of this application example method.
  • the data management method for vehicles can realize the following functions: based on platformization and serviceization of resources and capabilities in the vehicle, associating and communicating the user's privacy configuration with the data service interface at the bottom of the system
  • the protocol stack interface and other platform capabilities are associated; based on the quantitative marking of data classification and classification, the quantitative evaluation of privacy sensitivity is realized; based on the configuration file, the data life cycle stage and business scope of privacy protection are limited.
  • Fig. 6 is a specific embodiment of a private file configuration method applied to a vehicle according to an embodiment of the present application.
  • the method can be executed by the privacy center module and the privacy agent module in Fig. 2 to Fig. 5 . As shown in FIG. 6, the method includes S601-S603.
  • the privacy center module acquires a privacy configuration file, where the privacy configuration file is a file for defining a privacy configuration.
  • the privacy configuration file may be defined by an original equipment manufacturer (OEM), provided to the cloud server, and then delivered to the privacy center module by the cloud server.
  • OEM original equipment manufacturer
  • the privacy configuration file may include, but not limited to, the following content: identification defining business; identification defining service; identification defining different data lifecycle stages; information indicating the relationship between business and service; Information about the relationship between business and business. Combining the above information, the privacy configuration file functionally implements a privacy policy file for restricting business use of data.
  • the aforementioned data life cycle may include but not limited to the following stages: data collection, data sharing, data transmission, and data storage.
  • data collection can refer to the business obtaining data from the service, or can be understood as the business collecting and obtaining data from the underlying program.
  • the reversing image service collects video data through the in-vehicle camera service.
  • the vehicle upgrade business collects vehicle driving status information through VDC's body data service.
  • the pet mode service collects the temperature status information inside the vehicle through the temperature monitoring service of the TMS.
  • Data sharing can mean that one business provides shared data to another business, and data sharing occurs at the business layer.
  • data sharing includes two types of sharing broadcast and subscription publishing.
  • Shared broadcast means that services that provide shared data can send shared data in the form of broadcast.
  • Subscription publishing means that services that obtain shared data need to subscribe to obtain shared data, that is, shared data is sent in a targeted manner.
  • the remote diagnosis service can provide component operation information as shared data to the vehicle upgrade service.
  • the event data recorder (event data recorder, EDR) service provides component fault data to the fault location service as shared data. Among them, the EDR service is used to record the fault data of the vehicle.
  • Data transmission may refer to the business of transmitting data in the vehicle to devices outside the vehicle. Data transmission does not limit the recipient of the data, the recipient can be a cloud server, other vehicles, or other communication devices.
  • the pet mode service transmits in-vehicle status information to the owner's mobile phone.
  • the whole vehicle upgrade service transmits the status information of the vehicle interior components to the cloud server.
  • Data storage refers to the transmission of data in the vehicle to a storage device, which can be managed by the data storage management module.
  • the storage device can be set inside the vehicle or on a cloud server.
  • the data storage management module can also be set inside the vehicle or on a cloud server.
  • the data storage management module and the storage device may be set in the same physical device, or in different physical devices.
  • Data storage can be business initiated. For example, the reversing image service stores video data in a cloud server or a local storage device.
  • the identification of the definition business can be understood as: the identification of the top-level business that the customer can perceive.
  • the identification of the above services can be understood as the definition of the identification fields of the services that provide personal data sources within the system.
  • the identification of the life cycle stage of the above data can be understood as the identification assigned by the system to distinguish the different data life cycle stages of the business or service.
  • the above information indicating the relationship between business and service can be understood as indicating the relationship between the top-level business perceivable by the customer and one or more services corresponding to the data that may be involved in the business.
  • the above information indicating the relationship between services and services may be understood as indicating the relationship between the top-level services perceivable by customers and one or more services corresponding to the data that may be involved in the services.
  • identifiers for defining services may include, but are not limited to: client identifiers, service identifiers, and process identifiers.
  • the above-mentioned identification of the defined service may include a service identification.
  • defining service identifiers includes at least one of the following: defining service identifiers in different data life cycle stages; defining service identifiers in different communication protocols.
  • defining the identifier of the service includes at least one of the following: defining the identifier of the service in different data life cycle stages; defining the identifier of the service in different communication protocols.
  • the communication protocol is designed to provide a set of standard protocols for the objects of information interaction, so as to ensure the correct implementation of communication.
  • the service protocol in the industrial field is used to provide a unified middleware, support centralized communication service management, and provide a control point for privacy management.
  • SOA communication solutions of hypertext transfer protocol (hypertext transfer protocol, HTTP) and message queuing telemetry transport (message queuing telemetry transport, MQTT) are also provided.
  • the above-mentioned communication protocol may include but not limited to the following items: a scalable service-oriented middleware over internet protocol (scalable service-oriented middleware over internet protocol, SOME/IP), data distribution service (data distribution service, DDS), data distribution service for web clients (web-enabled data distribution service, DDS-WEB), etc.
  • a scalable service-oriented middleware over internet protocol scalable service-oriented middleware over internet protocol, SOME/IP
  • data distribution service data distribution service
  • DDS-WEB data distribution service for web clients
  • the privacy configuration file further includes privacy rating information, and the privacy rating information is used to indicate the privacy level of data corresponding to different service identifiers.
  • the privacy rating information may be in the form of labels to distinguish the sensitivity of data, for example, sensitive, general, or non-personal data.
  • the privacy rating information can use quantified values to measure sensitivity, for example, services with sensitive personal data have a measurement value of 5-10, general personal data have a measurement value of 1-4, and non-personal data have a measurement value of 1-4. If the measurement value is 0, the privacy measurement value of the business as a whole is the cumulative sum of all data.
  • the privacy classification information is associated with the service identification, so as to identify and manage private data in the business process based on the SOA architecture, which can improve the efficiency of private data management of the vehicle.
  • privacy control policies for different data life cycle stages can also be set in the privacy configuration file.
  • different privacy policies can be formulated for the data collection and transmission process.
  • the privacy center module obtains the privacy policy file according to the privacy configuration file, and the privacy policy file includes at least one of the following: first configuration information, used to indicate the access rights between business and service or between business and business ;
  • the second configuration information is used to indicate the access authority of the service.
  • the above privacy policy file can be used to control the privacy of services passing through the middleware module.
  • the aforementioned privacy policy file can implement the function of a data-related permission control list.
  • the first configuration information includes at least one of the following: information indicating the first association relationship between the service identifier of the service that is allowed to provide data and the customer identifier of the business that is allowed to collect data; indicating the business that is allowed to provide shared data.
  • information indicating the first association relationship between the service identifier of the service identifier and the client identifier of the business that is allowed to obtain shared data the former can be applied to the privacy access control in the data collection process, while the latter can be applied to the privacy access control in the data sharing process.
  • the second configuration information includes at least one of the following: the customer identification of the business that allows data collection; the customer identification or process identification of the business that allows data transmission outside the vehicle; the service identification that allows data to be provided; The service ID of the business sharing the data.
  • the second configuration information can be applied to privacy access control in processes such as data collection, data outbound transmission, and data sharing.
  • the privacy center module sends the privacy policy file to the privacy agent module, and accordingly, the privacy agent module receives the privacy policy file from the privacy center module, and the privacy policy file is used for access control of the middleware module.
  • the above-mentioned access control for the middleware module can be understood as performing access control on services processed through the middleware module.
  • the privacy center module obtains the privacy policy file according to the privacy configuration file, including: the privacy center module presents privacy configuration options to the user through a display interface according to the privacy configuration file, and the privacy configuration option is used for the user to select at least one of the following: Item: whether to authorize the business to call data of at least one service, whether to authorize the business to call data of at least one other business; the privacy center module obtains the user's selection result of the privacy configuration option; the privacy center module obtains the privacy policy file according to the selection result.
  • the above display interface may be an HMI interactive interface located in the cockpit of the vehicle, and may also be set on the HMI interface of the mobile phone.
  • the privacy center module obtains the privacy policy file according to the privacy configuration file, and further includes: the privacy center module obtains the privacy statement file corresponding to the first service from the privacy configuration file; the privacy center module presents the privacy statement file to the user through a display interface The privacy statement file corresponding to the first business.
  • the privacy center module can also directly generate all or part of the privacy policy file according to the privacy configuration file.
  • the privacy policy file can be updated dynamically. For example, after the privacy policy file is generated, if the user changes the privacy configuration option through the display interface, the privacy center module may update the privacy policy file accordingly.
  • the privacy center module may determine the user account (or user identity) according to the user's login information, and bind the privacy policy file to the user account. That is to say, the privacy center module can also generate and maintain different privacy policy files for different users to improve the efficiency of privacy management.
  • a privacy configuration scheme for vehicles based on the SOA architecture is provided, using the privacy center module to obtain the privacy configuration file, and generating a privacy policy file, and then distributing it to the privacy proxy module close to the business.
  • the privacy proxy module is used to control the privacy data of the business processed by the middleware module according to the privacy policy file, so that all the business inside the vehicle cannot bypass the privacy control, and it provides a terminal from the business end to the underlying data end.
  • the end-to-end privacy control service associates the user's privacy configuration with the data service interface at the bottom of the system, and can provide unified privacy control for the heterogeneous architecture in the vehicle, improving the security and efficiency of privacy control.
  • Fig. 7 is a specific embodiment of a privacy file configuration applied to a vehicle according to an embodiment of the present application. As shown in Fig. 7, the method includes S701-S706.
  • the cloud server sends the privacy configuration file to the privacy center module, and the privacy center module receives the privacy configuration file accordingly.
  • defining the identification of the service may include: defining the identification of the service in different data life cycle stages; defining the identification of the service in different communication protocols. That is, when the business is in different data life cycle stages or different communication protocols, different identifiers can be assigned to the business. It should be understood that in some examples, a service may all allocate a client ID, a service ID, and a process ID in the same data life cycle stage or the same communication protocol, or may only allocate part of the above three IDs.
  • FIG. 8 is a schematic diagram of a privacy configuration file according to an embodiment of the present application.
  • its customer ID is 005 and service ID is 006 in the data collection phase, while the customer ID is 008 and service ID is 003 in the data sharing phase.
  • the client ID of the data transfer phase is 009, and the process ID is proc A.
  • defining service identifiers above may include: defining service identifiers in different data life cycle stages; defining service identifiers in different communication protocols. That is, different identities can be assigned to services when they are in different data life cycle stages or in different communication protocols.
  • the service identifier of each service can be defined as the identifier of the data provider.
  • the data provider can be a program that generates data or a program that provides shared data.
  • the collection of personal data can be realized.
  • the customer ID will also be defined as the ID of the data caller.
  • the customer ID and service ID itself have no privacy meaning.
  • privacy classification information can be added to the privacy configuration file to identify the data privacy classification level to which each service belongs.
  • Service 1 and Service 2 are two different types of personal data sources provided in the car to upper-level services.
  • a sensitive label can be added to the privacy configuration file.
  • a general label can be added to the privacy configuration file.
  • filtering can be performed based on labels.
  • Fig. 9 is a schematic diagram of a privacy configuration file according to an embodiment of the present application.
  • the privacy grading information may also be subjected to sensitivity measurement based on quantitative values.
  • the metric value of sensitive personal data services is 5-10
  • the metric value of general personal data is 1-4
  • the metric value of non-personal data is 0, then the overall privacy metric value of the business is the cumulative sum of all data, privacy management
  • the privacy interval can be customized according to requirements, and services falling within the privacy interval need to be subject to privacy control.
  • quantized value is only an example, and the relationship between the quantized value and the privacy level can also be implemented in other specific ways.
  • the larger the quantized value the lower the privacy level, which will not be detailed here enumerate.
  • the above privacy classification information can be applied to privacy control policies at various stages of the data life cycle.
  • the access authority and retention period of each data can be determined according to the privacy classification information.
  • the privacy classification information of service 1 is sensitive, the retention period is 3 months, that is, the data needs to be deleted after three months of storage.
  • the privacy classification information of service 2 is general, the retention period is not limited.
  • the privacy rating information of service 1 is 7, and the retention period is 1 month; the privacy rating information of service 2 is 2, and the retention period is unlimited;
  • the privacy rating information is 6, and the retention period is 3 months.
  • the privacy configuration file may also include one or more privacy policies. These privacy policies can be applied to various stages in the data life cycle, and different privacy policies are determined according to the privacy classification information.
  • the privacy center module can select one of the privacy policies to apply to the current privacy policy file.
  • privacy policy 1 controls services whose privacy classification information is general and sensitive labels in the data collection phase.
  • privacy policy 2 only controls the services whose privacy classification information is a sensitive label in the data collection stage.
  • privacy policy 1 controls services with a metric value ⁇ 6 in both the data collection and transmission phases, while privacy policy 2 only controls services with a metric value ⁇ 6 in the data transmission phase.
  • the source of the provided data is classified through the service identification.
  • the quantitative marking of classification and classification realizes the quantitative evaluation of data privacy sensitivity and improves the management efficiency of private data.
  • the privacy center module analyzes the privacy configuration file to form privacy configuration options and documents.
  • the privacy center module presents privacy configuration options and text to the user.
  • the privacy center module acquires a user's selection result of the privacy configuration option.
  • the privacy center module obtains the selection result.
  • FIG. 10 is a schematic diagram of a privacy configuration file according to an embodiment of the present application.
  • a privacy statement can be configured for each business in the privacy configuration file, and the privacy statement can be presented on the user interface through an independent item, and a selection button is displayed. Users can choose to agree to the authorization or refuse the authorization according to their wishes.
  • the privacy statement can be packaged in a privacy configuration file and issued together.
  • the privacy center module forms a privacy policy file according to the selection result of the privacy configuration option.
  • the privacy center module can bind the privacy configuration agreed by the user to the user's account, and form a privacy policy file corresponding to the user.
  • the privacy center module can also directly generate all or part of the privacy policy file according to the privacy configuration file.
  • the privacy center module binds the user's consent status in units of business, so that the business behavior must comply with the user's wishes and cannot be bypassed, thus realizing the privacy protection scheme from the business end to the data end.
  • the privacy center module sends the privacy policy file to each privacy agent module, and correspondingly, each privacy agent module receives the privacy policy file from the privacy center module.
  • the privacy policy file can be used to distribute to each privacy proxy module, and each privacy proxy module is used to perform privacy control on nearby businesses according to the privacy policy file.
  • Each privacy proxy module is used for access control through the middleware module. Since the business in the vehicle needs to call the data through the platform provided by the middleware module, all business is monitored by the privacy proxy module, thereby achieving strictness and security. privacy monitoring solution.
  • the privacy center module can generate a privacy policy file according to the privacy definition file.
  • the privacy policy file is used to provide privacy configuration for the upper-level business call data, and use the middleware module as a platform to bind the upper-level business and the underlying data.
  • the relationship between the business access behavior must comply with the system settings or the user's wishes, and cannot be bypassed, thereby realizing the privacy protection scheme from the business end to the data end, and improving the efficiency and security of the vehicle's privacy control.
  • This application is based on the middleware module provided by the system platform, which can realize the privacy control of data collection, sharing, transmission and storage.
  • the principle of privacy control is: when the business calls data, based on the SOA principle of the vehicle, the business uniformly calls the data through the middleware module, and the middleware module uses the privacy proxy module to determine whether the data call belongs to the access scope allowed by the privacy policy file. The business can call the data only when it belongs to the scope of access.
  • This solution associates the user's privacy configuration with the system's privacy control point, and implements an end-to-end privacy control process. Even in a heterogeneous architecture, any upper-layer business call data cannot bypass privacy control, which improves the privacy control of vehicles. efficiency and safety.
  • Fig. 11 is a schematic diagram of a data management method according to an embodiment of the present application.
  • Figure 11 may involve the process of data collection, sharing and data transmission. As shown in FIG. 11 , the method includes S1101-S1103.
  • the processing module sends first request information to the middleware module, and the middleware module receives the first request information from the processing module accordingly.
  • the first request information is used to request to call the first data for the first business
  • the first request information includes the first identification
  • the first identification includes at least one of the following: the customer identification of the first business, the process identification of the first business, the first identification A service identifier of the provider of the data.
  • the first service invokes the first data in any of the following ways: data collection, data sharing, and data transmission outside the vehicle.
  • the first request information may include but not limited to: data collection request information, data sharing request information, and data transmission request information.
  • the above-mentioned first data may include but not limited to: data to be collected, data to be shared, data to be transmitted, and the like.
  • the middleware module sends first query information to the privacy proxy module, and accordingly, the privacy proxy module receives the first query information from the middleware module.
  • the first query information is used to query whether to agree to call the first data for the first service, and the first query information includes the first identification.
  • the privacy agent module sends first response information to the middleware module, and correspondingly, the middleware module receives the first response information from the privacy agent module.
  • the first response information is used to indicate whether to agree to call the first data for the first service, wherein the first response information is determined according to the first identification and the privacy policy file, and the privacy policy file includes at least one of the following: first configuration information, It is used to indicate the access authority between businesses and services or between businesses; the second configuration information is used to indicate the access authority of services.
  • the middleware module After the middleware module receives the first response information, if the first response information agrees to call the first data for the first service, the middleware module calls the first data for the first service. For example, in the case of data collection, the middleware module obtains the first data from the service and sends it to the processing module. If the first response information does not agree to call the first data for the first service, the middleware module notifies the processing module that the first data is not allowed to be called.
  • the above-mentioned first configuration information includes at least one of the following: information indicating a first association relationship between a service identifier of a service that is allowed to provide data and a customer identifier of a service that is allowed to collect data.
  • the first configuration information stipulates the relationship between the data caller and the data provider, that is, the first service is allowed to call data only when both the data caller and the data provider meet the requirements of the first configuration information.
  • the first identifier may include a customer identifier of the first service and a service identifier of the first service.
  • the privacy agent module sends the first response information to the middleware module when the customer identifier of the first business and the service identifier of the first service belong to the first association relationship indicated by the first configuration information, and the first response information is used to indicate consent
  • the first data is invoked for the first service.
  • the first service invokes the first data through data sharing
  • the first data is the data of the second service
  • the type of data sharing is subscription publishing
  • the first identification includes the customer identification of the first service and the second service The service ID for .
  • subscription publishing means that the data caller needs to subscribe to obtain the shared data, that is, the data is sent in a targeted manner.
  • the privacy agent module sends the first response information to the middleware module, and the first response information is used to indicate consent The first data is invoked for the first service.
  • the above-mentioned second configuration information includes at least one of the following: the customer identification of the business that allows data collection; the customer identification or process identification of the business that allows data transmission outside the vehicle; the service identification of the service that allows data provision; The service ID of the business that provides the shared data.
  • the second configuration information only limits the qualification of one of the data caller and the data provider, that is, as long as one of the data caller and the data provider meets the requirements of the first configuration information, the data can be called.
  • the first identification may include the customer identification of the first service.
  • the privacy agent module may send the first response information to the middleware module when the first identification belongs to the customer identification of the service that is allowed to collect data indicated by the second configuration information, and the first response information is used to indicate that the first service call first data.
  • the first identifier may include a client identifier or a process identifier of the first service.
  • the privacy agent module can send the first response information to the middleware module when the first identification belongs to the customer identification or process identification indicated by the second configuration information that allows data transmission outside the vehicle, and the first response information is used to indicate consent The first data is invoked for the first service.
  • the first service uses data to call the first data in a data sharing manner
  • the first data is the data of the second service
  • the type of data sharing is shared broadcasting
  • the first identifier includes the service identifier of the second service, that is, The service ID of the data provider.
  • shared broadcasting means that the data provider can send the shared data in the form of broadcasting instead of sending in a targeted manner, and any data caller can obtain the shared data.
  • the privacy agent module sends the first response information to the middleware module, and the first response information is used to indicate that the first service call first data.
  • data privacy control can be realized based on the middleware module provided by the system platform. For example, data collection, data sharing, and data out-of-vehicle transmission, etc., when the business calls data, based on the SOA principle of the vehicle, the business uniformly calls the data through the middleware module, and the middleware module determines whether the call belongs to the privacy policy file through the privacy proxy module allowed range.
  • a privacy control node is added to control the business performed by the middleware module, and implement a private data collection control method that cannot be bypassed by the upper-level business. Improve the efficiency and security of vehicle privacy control.
  • Fig. 12 is a specific embodiment of a data management method for data collection according to an embodiment of the present application. As shown in Fig. 12, the method includes S1201-S1204.
  • the processing module sends data collection request information to the middleware module, and correspondingly, the middleware module receives the data collection request information from the processing module.
  • the data collection request information is used to collect the first data for the first service request.
  • the data collection request information includes the first identifier of the first service.
  • the first identifier includes a client identifier of the first service, or, the first identifier includes a client identifier of the first service and a service identifier of the first service.
  • the first service is a provider of the first data to be collected.
  • business A when business A collects data from service 1 or service 2, business A can be the data caller, while service 1 and service 2 can be the data provider. Therefore, in the data collection process, business A uses the customer ID 005, service 1 uses the service ID 101, and service 2 uses the service ID 102.
  • the middleware module sends first query information to the privacy proxy module.
  • the privacy proxy module receives the first query information from the middleware module.
  • the first query information is used to query whether to agree to collect first data for the first service.
  • the first query information includes the first identifier of the first service.
  • the privacy proxy module agrees to collect the first data for the first service request.
  • the privacy proxy module may determine whether the customer ID of the first business and the first service ID belong to the service ID of the service that is allowed to provide data and the customer ID of the business that is allowed to collect data indicated in the first configuration information in the privacy policy file the first relationship between them. If yes, you agree to the collection; if not, you do not agree to the collection.
  • the privacy proxy module may determine whether the customer ID of the first service belongs to the customer ID of a business that is allowed to collect data indicated in the second configuration information in the privacy policy file. If yes, you agree to the collection; if not, you do not agree to the collection.
  • the privacy agent module can also determine the currently logged-in user account according to the current login status, so as to determine the user's privacy configuration.
  • service identifiers can be assigned to services that provide data.
  • the user can use the service ID as a distinction to determine whether to authorize the data corresponding to each service ID.
  • the privacy proxy module sends first response information to the middleware module, and correspondingly, the middleware module receives the first response information from the privacy proxy module.
  • the first response information is used to indicate whether to agree to collect the first data for the first service.
  • the middleware module After the middleware module receives the first response information, if the first response information agrees to collect the first data for the first service, the middleware module collects the first data for the first service. and sent to the processing module. If the first response information does not agree to collect the first data for the first service, the middleware module notifies the processing module that the first data is not allowed to be collected.
  • the privacy control of data collection can be realized.
  • the business collects data
  • the business uniformly invokes the service through the middleware module to realize data collection, and the middleware module determines whether the data collection belongs to the scope of access allowed by the privacy policy file through the privacy agent module.
  • a privacy control node is added to control the business performed by the middleware module, and implement a private data collection control method that cannot be bypassed by the upper-level business.
  • the user's privacy configuration is associated with the system's privacy control point, and an end-to-end privacy control process is implemented, which improves the efficiency and security of the vehicle's privacy control.
  • Fig. 13 is a schematic diagram of a data management method for data sharing according to an embodiment of the present application. As shown in Fig. 13, the method includes S1301-S1304.
  • the processing module sends data sharing request information to the middleware module, where the data sharing request information is used to request that the first data of the second service be shared with the first service.
  • the middleware module sends first query information to the privacy agent module to query whether to agree to provide the first data of the second service for the first service.
  • the first query information includes a first identifier.
  • the first identifier includes a client identifier of the first service, or, the first identifier includes a client identifier of the first service and a service identifier of the second service.
  • business A when business A provides shared data to business B, business A acts as the service provider, and business B acts as the service caller. Therefore, in the process of data sharing, business A uses the service ID 003 as the service provider, and business B uses the customer ID 028 as the service caller.
  • the privacy proxy module judges whether to agree to share the first data of the second service with the first service according to the first identifier.
  • the middleware module only needs to check whether the service identifier of business A is within the scope of access allowed by the privacy policy file, without querying Customer ID of business B. If so, allow sharing.
  • the middleware module needs to query whether the service ID of business A and the customer ID of business B are allowed to be accessed in the privacy policy file within range. If so, allow sharing.
  • the privacy proxy module sends first response information to the middleware module.
  • the first response information is used to indicate whether to agree to share the first data of the second service with the first service.
  • the middleware module After the middleware module receives the first response information, if the first response information agrees to share data, the middleware module provides the first data of the second service to the first service. If the first response information does not agree to share data, the middleware module notifies the processing module that data sharing is not allowed.
  • privacy control can be used for data sharing.
  • the data is shared in the form of service packaging through the middleware module, and the middleware module determines whether the shared business belongs to the sharing allowed by the privacy policy file through the privacy agent module.
  • the system performs privacy control according to the customer ID or service ID of the business, thereby providing a privacy control method for data sharing and improving the privacy control efficiency of the vehicle.
  • FIG. 14 is a schematic flowchart of a data management method for data transmission according to an embodiment of the present application. As shown in Fig. 14, the method includes S1401-S1404.
  • the processing module sends data transmission request information to the middleware module.
  • the data transmission request information is used to request to transmit the first data of the first service to a communication device other than the vehicle.
  • the data transmission request information includes a first identifier, the second An identifier includes a client identifier of the first service or a process identifier of the first service.
  • the middleware module sends first query information to the privacy proxy module, the first query information is used to request whether to allow the first data to be transmitted outside the vehicle, and the first query information includes the first identifier.
  • business A in the process of business outbound data transmission, business A can use process ID pro A or customer ID 009.
  • the privacy agent module determines whether the first business belongs to the scope of the business of transmitting data outside the vehicle permitted by the privacy policy file according to the first identifier.
  • the first identification belongs to the customer identification or process identification of the service that allows data transmission outside the vehicle indicated by the second configuration information in the privacy policy file, it is determined that the first data of the first service is agreed to be transmitted outside the vehicle.
  • the privacy proxy module sends first response information to the middleware module to indicate whether to agree to the request for data transmission request information.
  • the middleware module After the middleware module receives the first response information, if the first response information agrees to transmit the first data outside the vehicle, the middleware module sends the first data outside the vehicle. If the first response message does not agree to transmit the first data outside the vehicle, the middleware module notifies the processing module that the first data is not allowed to be transmitted outside the vehicle.
  • privacy control can also be used for external data transmission.
  • the middleware module needs to be platformized, that is, each business no longer integrates the car out of the protocol stack separately, but uses public capabilities.
  • the process calls the middleware module for unified scheduling.
  • the system performs privacy control according to the business process ID or customer ID, thus providing a privacy control method for the vehicle's out-of-car data transmission, improving Improve the efficiency of vehicle privacy control.
  • the solution of this application can also realize the privacy control of data storage.
  • the data in the vehicle is usually distributed and stored in various nodes. For example, in each domain controller or ECU.
  • the data storage management module can be used to store and manage the data in the vehicle.
  • the data storage management module can be set inside the vehicle or in the cloud.
  • Fig. 15 is a data management method for data storage according to an embodiment of the present application. As shown in Figure 15, the method includes:
  • the processing module sends the storage request information of the first service.
  • the data storage management module receives the storage request information of the first service.
  • the storage request information includes: the first data to be stored, the data identifier of the first data, the storage The rating information, wherein the storage rating information is used to indicate the privacy level corresponding to the data identifier of the first data.
  • the data storage management module can be set inside the vehicle or in a cloud server.
  • the storage rating information is not the same as the privacy rating information mentioned above.
  • Privacy classification information is usually used in the process of data collection, transmission, data sharing or data storage. There is a binding relationship between the privacy classification information and the service ID, that is, during the data storage process, the service ID corresponding to the data needs to be provided. For example, if data is collected from different services, they have different service identifiers.
  • the storage classification information is usually only used in the data storage process.
  • the corresponding relationship between the storage classification information and the retention period can be defined by the preset file of the service itself, and the above corresponding relationship is also stored in the privacy configuration file.
  • the privacy proxy module After the privacy proxy module analyzes the privacy configuration file and generates the privacy policy file, the corresponding relationship between the storage classification information and the retention period is also stored in the privacy proxy module. There is a binding relationship between storage classification information and data identification.
  • the business can carry data, data identification and storage classification information to the data storage management to apply for storage files.
  • different data corresponding to the same service have different data identifiers
  • storage rating information corresponding to different data identifiers may be different.
  • the storage classification information may also adopt a classification and classification method similar to that of the privacy classification information. That is, the classification method of labels or the classification method of quantitative values, or other general classification methods may be adopted, and for the sake of brevity, details are not described here.
  • the data storage management module stores the first data.
  • the data storage management module deletes the first data after the storage duration of the first data reaches a retention period, wherein the retention period is determined according to the storage classification information.
  • the data storage management module may determine the retention period of the first data according to the storage classification information.
  • the data storage management module sends second query information to the privacy agent module, the second query information is used to query the retention period of the first data, and the second query information includes the data identification and storage classification information of the first data;
  • the data storage management module receives first indication information from the privacy proxy module, and the first indication information is used to indicate the retention period of the first data.
  • the data storage management module may start a timer to count the storage duration of the first data after the first data is placed on the disk, and delete the first data after the storage duration reaches the retention period.
  • the data storage management module may not acquire the retention period of the first data, but the privacy proxy module will time the storage duration of the first data, and after the storage duration reaches the retention period, instruct the data storage The management module deletes the first data.
  • the data storage management module sends the second query information to the privacy agent module in the vehicle, and the second query information includes the data identification of the first data, storage classification information and the time of placing the first data;
  • the data storage management module receives deletion instruction information from the privacy proxy module, where the deletion instruction information is used to instruct deletion of the first data.
  • the above-mentioned data storage management module can be set in the vehicle, or can be set in the cloud server.
  • the above-mentioned privacy proxy module may be set near the data storage management module.
  • the privacy proxy module can be set in the vehicle.
  • the privacy agent module can also be set in the cloud server.
  • the storage request information also includes a first identifier
  • the first identifier includes at least one of the following: a client identifier and a process identifier
  • the method further includes: the data storage management module determines whether the first service has storage authority according to the first identifier ; In the case of determining that the first service has the storage authority, the data storage management module puts the data on the disk.
  • the privacy proxy module associates the retention period of the data with the storage classification information and performs management and control.
  • the data storage management module stores and manages the data in the vehicle, it can communicate with the privacy proxy module Obtain information related to the retention period to delete data according to the retention period, realize unified management and timing deletion of private data, and improve the safety and efficiency of vehicle data storage management.
  • FIG. 16 is a schematic flowchart of a data management method for data storage according to an embodiment of the present application. As shown in Figure 16, the method includes:
  • the processing module sends the storage request information of the first service to the data storage management module.
  • the data storage management module receives the storage request information of the first service from the processing module, and the storage request information includes: the first data to be stored , a data identifier of the first data, storage classification information, and a first identifier of the first data.
  • the first identifier of the first data may be a client identifier or a process identifier.
  • the data storage management module identifies the first identifier of the first service, and checks the storage authority of the first service according to the first identifier.
  • the data storage management module sends the second query information to the privacy proxy module.
  • the privacy proxy module receives the second query information from the data storage management module.
  • the second query information is used to query the retention period of the first data.
  • the query information includes the data identification of the first data and storage classification information.
  • the data storage management module receives first indication information from the privacy proxy module.
  • the privacy proxy module receives the first indication information from the data storage management module.
  • the first indication information is used to indicate the retention period of the first data.
  • the data storage management module starts a timer, and the timer counts according to the retention period.
  • the data storage management module deletes the first data.
  • the data storage management module can bind the timer with the data identifier of the first data, and after the retention period expires, the data storage management module can find the first data according to the data identifier, and delete the first data.
  • FIG. 17 is a schematic flowchart of a data management method for data storage according to an embodiment of the present application. As shown in Figure 17, the method includes:
  • the processing module sends the storage request information of the first service to the data storage management module.
  • the storage request information includes: the first data to be stored, the data identifier of the first data, the storage classification information of the first data, the first data the first identifier of .
  • the first identifier of the first data may be a client identifier or a process identifier.
  • the data storage management module identifies the first identifier of the first service, and checks its storage authority according to the first identifier.
  • the data storage management module After confirming that the first service has storage qualifications, the data storage management module puts the data on the disk.
  • the data storage management module sends second query information to the privacy agent module in the vehicle, where the second query information includes the data identification and storage classification information of the first data.
  • the privacy proxy module determines a retention period of the first data according to the storage classification information.
  • the privacy proxy module starts a timer, and the timer counts according to the retention period.
  • the privacy proxy module After the storage duration of the first data reaches the retention period, the privacy proxy module sends deletion instruction information to the data storage management module, where the deletion instruction information is used to instruct deletion of the first data.
  • the data storage management module After receiving the deletion instruction information, the data storage management module deletes the first data.
  • FIG. 18 is a schematic structural diagram of a device 1800 provided by an embodiment of the present application.
  • the device 1800 includes a privacy center module 1801, a privacy agent module 1802, and a middleware module 1803.
  • the device 1800 may be the vehicle in the foregoing embodiments, or a component of the vehicle (such as vehicle equipment, domain controller or chip).
  • the device 1800 can implement the steps or processes corresponding to the execution of the vehicle in the above method embodiments.
  • the privacy center module 1801 is used to obtain a privacy configuration file; according to the privacy configuration file, a privacy policy file is obtained, and the privacy policy file includes at least one of the following: first configuration information, used to indicate access rights between business and service or between business and business the access rights between; the second configuration information, used to indicate the access rights of the business; and send the privacy policy file to the privacy agent module 1802, the privacy policy file is used for the access control of the middleware module 1803, wherein the middleware module 1803 is configured To provide an SOA-based interface to the business.
  • the privacy center module 1801 is specifically configured to: present privacy configuration options to the user through a display interface according to the privacy configuration file. Whether to authorize the service to call the data of at least one other service; obtain the user's selection result of the privacy configuration option; and obtain the privacy policy file according to the selection result.
  • the privacy center module 1801 is specifically configured to: obtain the privacy statement file corresponding to the first service from the privacy configuration file; and present the privacy statement file corresponding to the first service to the user through a display interface.
  • the privacy configuration file includes privacy rating information, and the privacy rating information is used to indicate the privacy level of data corresponding to different service IDs, where the service ID is an ID indicating a data provider.
  • the privacy rating information uses a quantitative value to distinguish the privacy level of the data.
  • the first configuration information includes at least one of the following: information indicating the first association relationship between the service identifier of the service that is allowed to provide data and the customer identifier of the business that is allowed to collect data; indicating the business that is allowed to provide shared data Information about the second association relationship between the service identifier of the service identifier and the client identifier of the business that allows to obtain the shared data; wherein, the client identifier is the identifier indicating the caller of the data, and the service identifier is the identifier indicating the provider of the data.
  • the second configuration information includes at least one of the following: the customer identification of the business that allows data collection; the customer identification or process identification of the business that allows data transmission outside the vehicle; the service identification that allows data to be provided; The service identifier of the business sharing data; wherein, the client identifier is the identifier indicating the caller of the data, the service identifier is the identifier indicating the provider of the data, and the process identifier is the identifier when the service is running as a process.
  • the privacy configuration file includes at least one of the following: an identifier defining a business; an identifier defining a service; an identifier defining different data lifecycle stages; information indicating an association relationship between a business and a service; information about the relationship between them.
  • defining the identity of the service includes at least one of the following: defining the identity of the service in different data life cycle stages; defining the identity of the service in different communication protocols; defining the identity of the service includes at least one of the following: The cycle phase defines the identity of the service; the identity of the service is defined in the different communication protocols.
  • Fig. 19 is a schematic structural diagram of a device 1900 provided by an embodiment of the present application.
  • the device 1900 includes a processing module 1901, a privacy proxy module 1902, and a middleware module 1903.
  • the device 1900 may be the vehicle in the foregoing embodiments, or a component of the vehicle (such as vehicle equipment, domain control devices or chips).
  • the device 1900 can implement the steps or processes corresponding to the execution of the vehicle in the above method embodiments.
  • the processing module 1901 is used to send the first request information to the middleware module 1903, the first request information is used to request to call the first data for the first business, the first request information includes a first identification, and the first identification includes at least one of the following : the customer ID of the first business, the process ID of the first business, and the service ID of the provider of the first data, wherein, the customer ID is the ID of the caller indicating the data, the service ID is the ID of the provider of the data, and the process The identity is the identity when the business runs as a process;
  • the middleware module 1903 is used to send the first query information to the privacy proxy module 1902.
  • the first query information is used to query whether to agree to call the first data for the first business.
  • the first query information includes the first identification, wherein the middleware module 1903 is configured to provide an SOA-based interface for services in the on-vehicle device;
  • the privacy agent module 1902 is used to send the first response information to the middleware module 1903, the first response information is used to indicate whether to agree to call the first data for the first business, wherein the first response information is based on the first identification and the privacy policy file It is determined that the privacy policy file includes at least one of the following: first configuration information, used to indicate the access rights between services or between services; second configuration information, used to indicate the access rights of services .
  • the first configuration information includes at least one of the following: information indicating the first association relationship between the service identifier of the service that is allowed to provide data and the customer identifier of the business that is allowed to collect data; indicating the business that is allowed to provide shared data.
  • information indicating the first association relationship between the service identifier of the service that is allowed to provide data and the customer identifier of the business that is allowed to collect data indicating the business that is allowed to provide shared data.
  • the second configuration information includes at least one of the following: the customer identification of the business that allows data collection; the customer identification or process identification of the business that allows data transmission outside the vehicle; the service identification that allows data to be provided; The service ID of the business sharing the data.
  • the first business invokes the first data through data collection
  • the first data is the data of the first service
  • the first identification includes the customer identification of the first business and the service identification of the first service
  • the privacy proxy module 1902 It is specifically used to send the first response information to the middleware module 1903 when the customer identifier of the first business and the service identifier of the first service belong to the first association relationship indicated by the first configuration information, and the first response information is used to indicate It is agreed to invoke the first data for the first service.
  • the first business calls the first data through data sharing
  • the first data is the data of the second business
  • the type of data sharing is subscription publishing
  • the first identification includes the customer identification of the first business and the second business service ID for ,
  • the privacy proxy module 1902 is specifically configured to send the first response information to the middleware module 1903 when the customer identifier of the first business and the service identifier of the second service belong to the second association relationship indicated by the first configuration information, and the first response The information is used to indicate that it is agreed to invoke the first data for the first service.
  • the first service invokes the first data through any of the following methods: data collection, data transmission outside the vehicle, the first identification includes the customer identification of the first service or the process identification of the first service, and the privacy agent
  • the module 1902 is specifically configured to send the first response information to the middleware module 1903 when the first identifier belongs to the allowed access scope indicated by the second configuration information, and the first response information is used to indicate the consent to call the first service for the first service. a data.
  • the first service calls the first data in the form of data sharing
  • the first data is the data of the second service
  • the type of data sharing is shared broadcasting
  • the first identification includes the service identification of the second service
  • the privacy proxy module 1902 is specifically configured to send the first response information to the middleware module 1903 when the service identifier of the second service belongs to the scope of the allowed access indicated by the second configuration information, and the first response information is used to indicate that the service is agreed to be the first service Call the first data.
  • FIG. 20 is a schematic structural diagram of a device 2000 provided by an embodiment of the present application.
  • the device 2000 includes a data storage management module 2001 .
  • the device 2000 further includes a processing module 2002 and/or a privacy proxy module 2003.
  • the device 2000 may be the vehicle in the foregoing embodiments, or may be a component of the vehicle (such as an on-board device or a chip), or may be a A device for storage management set up in a cloud server.
  • the device 2000 may include a data storage management module 2001 , a processing module 2002 and a privacy proxy module 2003 .
  • the device 2000 may include a data storage management module 2001 and a privacy proxy module 2003, and the processing module 2002 is set in a vehicle. It should be understood that the above-mentioned modules may also have other distribution forms, which will not be enumerated here.
  • the device 2000 can implement the steps or processes corresponding to the execution of the vehicle in the above method embodiments.
  • the processing module 2002 is used to send the storage request information of the first service to the data storage management module 2001 , and accordingly, the data storage management module 2001 receives the storage request information sent by the processing module 2002 .
  • the storage request information includes: the first data to be stored, the data identification of the first data, and storage classification information, wherein the storage classification information is used to indicate the privacy level corresponding to the data identification of the first data;
  • the data storage management module 2001 is configured to store the first data; and delete the first data after the storage duration of the first data reaches a retention period, wherein the retention period is determined according to the storage classification information.
  • the device 2000 further includes a privacy proxy module 2003
  • the data storage management module 2001 is further configured to send second query information to the privacy proxy module 2003, the second query information is used to query the retention period of the first data, and the second query
  • the information includes the data identification and storage classification information of the first data
  • the privacy agent module 2003 is used to send the first indication information to the data storage management module 2001, and the first indication information is used to indicate the retention period of the first data.
  • the device 2000 further includes a privacy proxy module 2003
  • the data storage management module 2001 is further configured to send second query information to the privacy proxy module 2003, where the second query information includes the data identification and storage classification information of the first data
  • the privacy agent module 2003 is used to determine the retention period according to the storage classification information; and when the storage duration of the first data reaches the retention period, send deletion instruction information to the data storage management module 2001, and the deletion instruction information is used to instruct deletion of the first data. data.
  • the storage request information further includes a first identifier
  • the first identifier includes at least one of the following: a client identifier and a process identifier, where the client identifier is the identifier indicating the caller of the data, and the process identifier is the service running as a process
  • the data storage management module 2001 is also used to determine whether the first service has the storage authority according to the first identification; the data storage management module 2001 is specifically used to put the data on the disk when it is determined that the first service has the storage permission .
  • Fig. 21 is a schematic block diagram of an apparatus 2100 provided in yet another embodiment of the present application.
  • the apparatus 2100 includes a processor 2110, and the processor 2110 is configured to execute computer programs or instructions stored in the memory 2120, or read data stored in the memory 2120, so as to execute the methods in the above method embodiments.
  • processors 2110 there are one or more processors 2110.
  • the apparatus 2100 further includes a memory 2120 for storing computer programs or instructions and/or data.
  • the memory 2120 can be integrated with the processor 2110, or can also be set separately.
  • the apparatus 2100 further includes a communication interface 2130, and the communication interface 2130 is used for receiving and/or sending signals.
  • the processor 2110 is configured to control the communication interface 2130 to receive and/or send signals.
  • the device 2100 is used to realize the operations performed by the various modules set in the vehicle or the cloud server in the above various method embodiments.
  • the processor 2110 is used to execute the computer programs or instructions stored in the memory 2120, so as to realize the relevant operations of the various modules in the vehicle in the various method embodiments above.
  • the methods are executed by modules in the vehicle.
  • the processor 2110 is configured to execute the computer programs or instructions stored in the memory 2120, so as to realize the relevant operations of the various modules of the cloud server in the various method embodiments above.
  • the device 2100 in FIG. 21 may be the vehicle in the foregoing embodiments, or a component of the vehicle (such as on-board equipment or chips), or a cloud server, or a component of the cloud server (such as for The storage management device or chip) is not limited here.
  • a component may be, but is not limited to being, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer.
  • an application running on a computing device and the computing device can be components.
  • One or more components can reside within a process and/or thread of execution and a component can be localized on one computer and/or distributed between two or more computers.
  • these components can execute from various computer readable media having various data structures stored thereon.
  • a component may, for example, be based on a signal having one or more packets of data (e.g., data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet via a signal interacting with other systems). Communicate through local and/or remote processes.
  • packets of data e.g., data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet via a signal interacting with other systems.
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing module, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Storage Device Security (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)

Abstract

一种数据管理方法和装置，可应用于智能网联车、新能源汽车等领域，能够提高隐私管控的安全性以及效率。该方法包括：隐私中心模块获取隐私配置文件；隐私中心模块根据隐私配置文件，获取隐私策略文件，隐私策略文件包括以下至少一项：第一配置信息，用于指示业务和服务之间的访问权限或者业务与业务之间的访问权限；第二配置信息，用于指示业务的访问权限；隐私中心模块向隐私代理模块发送隐私策略文件，隐私策略文件用于中间件模块的访问控制。

Description

数据管理方法及装置 技术领域
本申请涉及智能控制领域，尤其涉及数据管理方法及装置。
背景技术
传统的隐私管控技术主要集中于互联网行业，尤其是手机等智能电子产品成为隐私保护技术发展的重要领域。但近些年来，随着智能驾驶的发展逐渐壮大，车辆开始承载更多的智能网联服务，为人们的生活带去便利，而由此引发的智能车辆的隐私保护也成为业界研究的重点领域。
智能车辆的隐私保护与手机系统的隐私保护存在很多不同之处。首先，在智能驾驶场景下，个人数据会更加多样化，除了智能座舱会包含手机中几乎所有的隐私数据之外，车辆驾驶控制所产生的驾驶习惯、车内运动传感器测量出的乘客身体状况数据等则成为车内独有的个人隐私数据。另外，不同于手机中的单一系统，车辆内部的系统也更为多样化，由于一辆车中的不同电子控制单元(electronic control unit，ECU)通常由不同的供应商提供至整车厂进行组装整合，因此车辆的系统信息通常为跨部件的异构架构，需要如何为智能车辆构建安全的隐私保护机制是一个亟需解决的问题。
发明内容
本申请提供一种数据管理方法及装置，提高了隐私管控的安全性以及效率。
第一方面，提供了一种数据管理方法，所述方法应用于车辆，所述车辆中包括隐私中心模块、隐私代理模块和中间件模块，其中，所述隐私中心模块用于实现隐私配置功能，所述隐私代理模块用于实现隐私控制功能，所述中间件模块用于为业务提供基于面向服务架构SOA的接口，所述方法包括：所述隐私中心模块获取隐私配置文件；所述隐私中心模块根据所述隐私配置文件，获取隐私策略文件，所述隐私策略文件包括以下至少一项：第一配置信息，用于指示业务和服务之间的访问权限或者业务与业务之间的访问权限；第二配置信息，用于指示业务的访问权限；所述隐私中心模块向所述隐私代理模块发送所述隐私策略文件，所述隐私策略文件用于所述中间件模块的访问控制。
提供了一种车辆在基于SOA架构下的隐私配置方案，利用隐私中心模块获取隐私配置文件，并生成隐私策略文件，再分发至靠近业务的隐私代理模块。而隐私代理模块用于负责根据隐私策略文件，通过中间件模块处理的业务的隐私数据管控，从而使得车辆内部的所有业务无法绕开隐私管控，提供了从业务端到底层数据端之间的端到端隐私管控服务，将用户的隐私配置与系统底层的数据服务化接口进行关联，能够为车辆中的异构架构提供统一化的隐私管控，提高了隐私管控的安全性以及效率。
结合第一方面，在第一方面的某些实现方式中，所述隐私中心模块根据所述隐私配置文件，获取隐私策略文件，包括：所述隐私中心模块根据所述隐私配置文件，通过显 示界面向用户呈现隐私配置选项，所述隐私配置选项用于所述用户选择以下至少一项：是否授权业务调用至少一个服务的数据、是否授权所述业务调用至少一个其它业务的数据；所述隐私中心模块获取所述用户对所述隐私配置选项的选择结果；所述隐私中心模块根据所述选择结果，获取所述隐私策略文件。
隐私中心模块以业务为单位绑定用户同意状态，使得业务行为必须遵照用户意愿，不可被绕过，从而实现了业务端到数据端的隐私保护方案。
结合第一方面，在第一方面的某些实现方式中，所述隐私配置文件中包括隐私分级信息，所述隐私分级信息用于指示不同服务标识对应的数据的隐私等级，其中，所述服务标识是指示数据的提供方的标识。
结合第一方面，在第一方面的某些实现方式中，所述隐私分级信息使用量化数值区分数据的隐私等级。
针对隐私数据种类多，缺乏统一管控机制的问题，通过服务标识对提供数据的来源进行分类。基于平台服务化，还可以在用服务标识标记的基础上，对数据进行分类分级的量化标记。将隐私分级信息与服务标识进行关联，以便于在基于SOA架构下的业务处理过程中标识和管理隐私数据，实现数据的隐私敏感度的量化评估，能够提高车辆的隐私数据管理的效率。
结合第一方面，在第一方面的某些实现方式中，所述第一配置信息包括以下至少一项：指示允许提供数据的服务的服务标识和允许采集数据的业务的客户标识之间的第一关联关系的信息；指示允许提供共享数据的业务的服务标识和允许获取共享数据的业务的客户标识之间的第二关联关系的信息；其中，所述客户标识是指示数据的调用方的标识，所述服务标识是指示数据的提供方的标识。
结合第一方面，在第一方面的某些实现方式中，所述第二配置信息包括以下至少一项：允许采集数据的业务的客户标识；允许向车外传输数据的业务的客户标识或进程标识；允许提供数据的服务的服务标识；允许提供共享数据的业务的服务标识；其中，所述客户标识是指示数据的调用方的标识，所述服务标识是指示数据的提供方的标识，所述进程标识是业务作为进程运行时的标识。
结合第一方面，在第一方面的某些实现方式中，所述隐私配置文件中包括以下至少一项：定义业务的标识；定义服务的标识；定义不同数据生命周期阶段的标识；指示业务和服务之间的关联关系的信息；指示业务和业务之间的关联关系的信息。
结合第一方面，在第一方面的某些实现方式中，所述定义业务的标识包括以下至少一项：在不同数据生命周期阶段定义业务的标识；在不同通信协议中定义业务的标识；所述定义服务的标识包括以下至少一项：在不同数据生命周期阶段定义服务的标识；在不同通信协议中定义服务的标识。
第二方面，提供了一种数据管理方法，所述方法应用于车辆，所述车辆中包括处理模块、隐私代理模块、中间件模块，其中，所述处理模块用于处理业务，所述隐私代理模块用于实现隐私控制功能，所述中间件模块用于为业务提供基于面向服务架构SOA的接口，所述方法包括：所述处理模块向所述中间件模块发送第一请求信息，所述第一请求信息用于请求为第一业务调用第一数据，所述第一请求信息中包括第一标识，所述第一标识包括以下至少一项：所述第一业务的客户标识、所述第一业务的进程标识、所述 第一数据的提供方的服务标识，其中，所述客户标识是指示数据的调用方的标识，所述服务标识是指示数据的提供方的标识，所述进程标识是业务作为进程运行时的标识；所述中间件模块向所述隐私代理模块发送第一查询信息，所述第一查询信息用于查询是否同意为所述第一业务调用所述第一数据，所述第一查询信息中包括所述第一标识；所述隐私代理模块向所述中间件模块发送第一响应信息，所述第一响应信息用于指示是否同意为所述第一业务调用所述第一数据，其中，所述第一响应信息是根据所述第一标识和隐私策略文件确定的，所述隐私策略文件包括以下至少一项：第一配置信息，用于指示业务和服务之间的访问权限或者业务与业务之间的访问权限；第二配置信息，用于指示业务的访问权限。
基于系统平台提供的中间件模块，可以实现数据的隐私管控。例如，数据采集、数据共享以及数据出车传输等，当业务调用数据时，基于车辆的SOA原则，业务统一通过中间件模块调取数据，中间件模块通过隐私代理模块确定调用是否属于隐私策略文件允许的范围。基于系统的平台化机制增加隐私控制节点，以管控利用中间件模块执行的业务，实施上层业务不可绕过的隐私数据采集控制方法。提高了车辆的隐私管控的效率和安全性。
结合第二方面，在第二方面的某些实现方式中，所述第一配置信息包括以下至少一项：指示允许提供数据的服务的服务标识和允许采集数据的业务的客户标识之间的第一关联关系的信息；指示允许提供共享数据的业务的服务标识和允许获取共享数据的业务的客户标识之间的第二关联关系的信息。
结合第二方面，在第二方面的某些实现方式中，所述第二配置信息包括以下至少一项：允许采集数据的业务的客户标识；允许向车外传输数据的业务的客户标识或进程标识；允许提供数据的服务的服务标识；允许提供共享数据的业务的服务标识。
结合第二方面，在第二方面的某些实现方式中，所述第一业务通过数据采集的方式调用所述第一数据，所述第一数据为第一服务的数据，所述第一标识包括所述第一业务的客户标识和所述第一服务的服务标识，所述隐私代理模块向所述中间件模块发送第一响应信息，包括：所述隐私代理模块在所述第一业务的客户标识和所述第一服务的服务标识属于所述第一配置信息指示的所述第一关联关系的情况下，向所述中间件模块发送所述第一响应信息，所述第一响应信息用于指示同意为所述第一业务调用所述第一数据。
结合第二方面，在第二方面的某些实现方式中，所述第一业务通过数据共享的方式调用所述第一数据，所述第一数据为第二业务的数据，所述数据共享的类型为订阅发布，所述第一标识包括所述第一业务的客户标识和所述第二业务的服务标识，所述方法还包括：所述隐私代理模块向所述中间件模块发送第一响应信息，包括：所述隐私代理模块在所述第一业务的客户标识和所述第二服务的服务标识属于所述第一配置信息指示的所述第二关联关系的情况下，向所述中间件模块发送所述第一响应信息，所述第一响应信息用于指示同意为所述第一业务调用所述第一数据。
结合第二方面，在第二方面的某些实现方式中，所述第一业务通过以下方式中的任意一种调用所述第一数据：数据采集、数据向车外传输，所述第一标识包括所述第一业务的客户标识或所述第一业务的进程标识，所述隐私代理模块向所述中间件模块发送第 一响应信息，包括：所述隐私代理模块在所述第一标识属于所述第二配置信息指示的允许访问的范围内的情况下，向所述中间件模块发送所述第一响应信息，所述第一响应信息用于指示同意为所述第一业务调用所述第一数据。
结合第二方面，在第二方面的某些实现方式中，所述第一业务以数据共享的方式调用所述第一数据，所述第一数据为第二业务的数据，所述数据共享的类型为共享广播，所述第一标识包括所述第二业务的服务标识；所述隐私代理模块向所述中间件模块发送第一响应信息，包括：所述隐私代理模块在所述第二业务的服务标识属于所述第二配置信息指示的允许访问的范围内的情况下，向所述中间件模块发送所述第一响应信息，所述第一响应信息用于指示同意为所述第一业务调用所述第一数据。
第三方面，提供了一种数据管理方法，该方法包括：数据存储管理模块从处理模块接收第一业务的存储请求信息，所述存储请求信息中包括：待存储的第一数据、所述第一数据的数据标识、存储分级信息，其中，所述存储分级信息用于指示所述第一数据的数据标识对应的隐私等级，其中，所述处理模块设置于车辆中，所述数据存储管理模块用于实现数据的存储管理功能，所述处理模块用于处理业务；所述数据存储管理模块存储所述第一数据；所述数据存储管理模块在所述第一数据的存储时长达到留存期之后，删除所述第一数据，其中，所述留存期是根据所述存储分级信息确定的。
本申请将数据的留存期与存储分级信息相关联并进行管控，数据存储管理模块在对车辆中的数据进行存储管理时，可以根据存储分级信息对应的留存期删除数据，实现隐私数据的统一管理和定时删除，提高了车辆的数据存储管理的安全性和效率。
结合第三方面，在第三方面的某些实现方式中，所述数据存储管理模块向隐私代理模块发送第二查询信息，所述第二查询信息用于查询所述第一数据的留存期，所述第二查询信息中包括所述第一数据的数据标识以及所述存储分级信息，所述隐私代理模块用于实现隐私控制功能；所述隐私代理模块向所述数据存储管理模块发送第一指示信息，所述第一指示信息用于指示所述第一数据的留存期。
隐私代理模块将数据的留存期与存储分级信息相关联并进行管控，数据存储管理模块在对车辆中的数据进行存储管理时，可以通过和隐私代理模块之间的通信获取与留存期相关的信息，以根据留存期删除数据，实现隐私数据的统一管理和定时删除，提高了车辆的数据存储管理的安全性和效率。
结合第三方面，在第三方面的某些实现方式中，所述数据存储管理模块向隐私代理模块发送第二查询信息，所述第二查询信息中包括所述第一数据的数据标识和所述存储分级信息，所述隐私代理模块用于实现隐私控制功能；所述隐私代理模块根据所述存储分级信息，确定所述留存期；在所述第一数据的存储时长达到所述留存期的情况下，所述隐私代理模块向所述数据存储管理模块发送删除指示信息，所述删除指示信息用于指示删除所述第一数据。
结合第三方面，在第三方面的某些实现方式中，所述数据存储管理模块设置于所述车辆中。
第四方面，提供了一种车载设备，所述车载设备包括隐私中心模块、隐私代理模块和中间件模块，所述隐私中心模块用于获取隐私配置文件；根据所述隐私配置文件，获取隐私策略文件，所述隐私策略文件包括以下至少一项：第一配置信息，用于指示业务 和服务之间的访问权限或者业务与业务之间的访问权限；第二配置信息，用于指示业务的访问权限；以及向所述隐私代理模块发送所述隐私策略文件，所述隐私策略文件用于所述中间件模块的访问控制，其中所述中间件模块被配置为向业务提供基于面向服务架构SOA的接口。
结合第四方面，在第四方面的某些可能的实现方式中，所述隐私中心模块具体用于：根据所述隐私配置文件，通过显示界面向用户呈现隐私配置选项，所述隐私配置选项用于所述用户选择以下至少一项：是否授权业务调用至少一个服务的数据、是否授权所述业务调用至少一个其它业务的数据；获取所述用户对所述隐私配置选项的选择结果；以及根据所述选择结果，获取所述隐私策略文件。
结合第四方面，在第四方面的某些可能的实现方式中，所述隐私配置文件中包括隐私分级信息，所述隐私分级信息用于指示不同服务标识对应的数据的隐私等级，其中，所述服务标识是指示数据的提供方的标识。
结合第四方面，在第四方面的某些可能的实现方式中，所述隐私分级信息使用量化数值区分数据的隐私等级。
结合第四方面，在第四方面的某些可能的实现方式中，所述第一配置信息包括以下至少一项：指示允许提供数据的服务的服务标识和允许采集数据的业务的客户标识之间的第一关联关系的信息；指示允许提供共享数据的业务的服务标识和允许获取共享数据的业务的客户标识之间的第二关联关系的信息；其中，所述客户标识是指示数据的调用方的标识，所述服务标识是指示数据的提供方的标识。
结合第四方面，在第四方面的某些可能的实现方式中，所述第二配置信息包括以下至少一项：允许采集数据的业务的客户标识；允许向车外传输数据的业务的客户标识或进程标识；允许提供数据的服务的服务标识；允许提供共享数据的业务的服务标识；其中，所述客户标识是指示数据的调用方的标识，所述服务标识是指示数据的提供方的标识，所述进程标识是业务作为进程运行时的标识。
结合第四方面，在第四方面的某些可能的实现方式中，所述隐私配置文件中包括以下至少一项：定义业务的标识；定义服务的标识；定义不同数据生命周期阶段的标识；指示业务和服务之间的关联关系的信息；指示业务和业务之间的关联关系的信息。
结合第四方面，在第四方面的某些可能的实现方式中，所述定义业务的标识包括以下至少一项：在不同数据生命周期阶段定义业务的标识；在不同通信协议中定义业务的标识；所述定义服务的标识包括以下至少一项：在不同数据生命周期阶段定义服务的标识；在不同通信协议中定义服务的标识。
第五方面，提供了一种车载设备，所述车载设备包括处理模块、隐私代理模块、中间件模块，所述处理模块用于向所述中间件模块发送第一请求信息，所述第一请求信息用于请求为第一业务调用第一数据，所述第一请求信息中包括第一标识，所述第一标识包括以下至少一项：所述第一业务的客户标识、所述第一业务的进程标识、所述第一数据的提供方的服务标识，其中，所述客户标识是指示数据的调用方的标识，所述服务标识是指示数据的提供方的标识，所述进程标识是业务作为进程运行时的标识；所述中间件模块用于向所述隐私代理模块发送第一查询信息，所述第一查询信息用于查询是否同意为所述第一业务调用所述第一数据，所述第一查询信息中包括所述第一标识，其中， 所述中间件模块被设置为向所述车载设备中的业务提供基于面向服务架构SOA的接口；所述隐私代理模块用于向所述中间件模块发送第一响应信息，所述第一响应信息用于指示是否同意为所述第一业务调用所述第一数据，其中，所述第一响应信息是根据所述第一标识和隐私策略文件确定的，所述隐私策略文件包括以下至少一项：第一配置信息，用于指示业务和服务之间的访问权限或者业务与业务之间的访问权限；第二配置信息，用于指示业务的访问权限。
结合第五方面，在第五方面的某些可能的实现方式中，所述第一配置信息包括以下至少一项：指示允许提供数据的服务的服务标识和允许采集数据的业务的客户标识之间的第一关联关系的信息；指示允许提供共享数据的业务的服务标识和允许获取共享数据的业务的客户标识之间的第二关联关系的信息。
结合第五方面，在第五方面的某些可能的实现方式中，所述第二配置信息包括以下至少一项：允许采集数据的业务的客户标识；允许向车外传输数据的业务的客户标识或进程标识；允许提供数据的服务的服务标识；允许提供共享数据的业务的服务标识。
结合第五方面，在第五方面的某些可能的实现方式中，所述第一业务通过数据采集的方式调用所述第一数据，所述第一数据为第一服务的数据，所述第一标识包括所述第一业务的客户标识和所述第一服务的服务标识，所述隐私代理模块具体用于在所述第一业务的客户标识和所述第一服务的服务标识属于所述第一配置信息指示的所述第一关联关系的情况下，向所述中间件模块发送所述第一响应信息，所述第一响应信息用于指示同意为所述第一业务调用所述第一数据。
结合第五方面，在第五方面的某些可能的实现方式中，所述第一业务通过数据共享的方式调用所述第一数据，所述第一数据为第二业务的数据，所述数据共享的类型为订阅发布，所述第一标识包括所述第一业务的客户标识和所述第二业务的服务标识，所述隐私代理模块具体用于在所述第一业务的客户标识和所述第二服务的服务标识属于所述第一配置信息指示的所述第二关联关系的情况下，向所述中间件模块发送所述第一响应信息，所述第一响应信息用于指示同意为所述第一业务调用所述第一数据。
结合第五方面，在第五方面的某些可能的实现方式中，所述第一业务通过以下方式中的任意一种调用所述第一数据：数据采集、数据向车外传输，所述第一标识包括所述第一业务的客户标识或所述第一业务的进程标识，所述隐私代理模块具体用于在所述第一标识属于所述第二配置信息指示的允许访问的范围内的情况下，向所述中间件模块发送所述第一响应信息，所述第一响应信息用于指示同意为所述第一业务调用所述第一数据。
结合第五方面，在第五方面的某些可能的实现方式中，所述第一业务以数据共享的方式调用所述第一数据，所述第一数据为第二业务的数据，所述数据共享的类型为共享广播，所述第一标识包括所述第二业务的服务标识；所述隐私代理模块具体用于在所述第二业务的服务标识属于所述第二配置信息指示的允许访问的范围内的情况下，向所述中间件模块发送所述第一响应信息，所述第一响应信息用于指示同意为所述第一业务调用所述第一数据。
第六方面，提供了一种用于数据管理的设备，包括：数据存储管理模块，所述数据存储管理模块用于从处理模块接收第一业务的存储请求信息，所述存储请求信息中包 括：待存储的第一数据、所述第一数据的数据标识、存储分级信息，其中，所述存储分级信息用于指示所述第一数据的数据标识对应的隐私等级，其中，所述处理模块设置于车辆中，所述数据存储管理模块用于实现数据的存储管理功能，所述处理模块用于处理业务；所述数据存储管理模块还用于存储所述第一数据；以及在所述第一数据的存储时长达到留存期之后，删除所述第一数据，其中，所述留存期是根据所述存储分级信息确定的。
结合第六方面，在第六方面的某些可能的实现方式中，所述设备中还包括隐私代理模块，所述数据存储管理模块还用于向所述隐私代理模块发送第二查询信息，所述第二查询信息用于查询所述第一数据的留存期，所述第二查询信息中包括所述第一数据的数据标识以及所述存储分级信息；所述隐私代理模块用于向所述数据存储管理模块发送第一指示信息，所述第一指示信息用于指示所述第一数据的留存期。
结合第六方面，在第六方面的某些可能的实现方式中，所述设备中还包括隐私代理模块，所述数据存储管理模块还用于向所述隐私代理模块发送第二查询信息，所述第二查询信息中包括所述第一数据的数据标识和所述存储分级信息；所述隐私代理模块用于根据所述存储分级信息，确定所述留存期；以及在所述第一数据的存储时长达到所述留存期的情况下，向所述数据存储管理模块发送删除指示信息，所述删除指示信息用于指示删除所述第一数据。
结合第六方面，在第六方面的某些可能的实现方式中，所述设备为所述车辆。
第七方面，提供了一种车载设备，该设备包括处理器，该处理器用于从存储器调用计算机程序，当所述计算机程序被执行时，该处理器用于执行上述第一方面或第一方面的任意可能的实现方式中的方法，或者，用于执行上述第二方面或第二方面的任意可能的实现方式中的方法。
第八方面，提供了一种用于数据管理的设备，该设备包括处理器，该处理器用于从存储器调用计算机程序，当所述计算机程序被执行时，该处理器用于执行上述第三方面或第三方面的任意可能的实现方式中的方法。
第九方面，提供了一种计算机可读存储介质，用于存储计算机程序，该计算机程序包括用于执行上述第一方面或第一方面的任意可能的实现方式中的方法的代码，或者，包括用于执行上述第二方面或第二方面的任意可能的实现方式中的方法的代码，或者，包括用于执行上述第三方面或第三方面的任意可能的实现方式中的方法的代码。
第十方面，提供了一种计算机程序产品，包括计算机程序，该计算机程序包括用于执行上述第一方面或第一方面的任意可能的实现方式中的方法的代码，或者，包括用于执行上述第二方面或第二方面的任意可能的实现方式中的方法的代码，或者，包括用于执行上述第三方面或第三方面的任意可能的实现方式中的方法的代码。
第十一方面，提供了一种车辆，该车辆包括上述第四方面或第四方面任意可能的实现方式中的车载设备、第五方面或第五方面任意可能的实现方式中的车载设备、或者第六方面或第六方面任意可能的实现方式中的设备、或者第七方面的车载设备、或者第八放方面的用于数据管理的设备。
附图说明
图1是本申请一实施例的应用于车辆的SOA的架构示意图。
图2是本申请一实施例的应用于车辆的隐私管理架构的示意图。
图3是本申请一实施例的车辆为中央网关型车载域控制架构的示意图。
图4是本申请又一实施例的车辆为中央网关型车载域控制架构的示意图。
图5是本申请一实施例的车辆为新型环网架构的示意图。
图6是本申请一实施例的应用于车辆的隐私文件配置的具体实施例。
图7是本申请一实施例的应用于车辆的隐私文件配置的具体实施例。
图8是本申请一实施例的隐私配置文件的示意图。
图9是本申请一实施例的隐私配置文件的示意图。
图10是本申请一实施例的隐私配置文件的示意图。
图11是本申请一实施例的数据管理方法的示意图。
图12是本申请一实施例的用于数据采集的数据管理方法的具体实施例。
图13是本申请一实施例的用于数据共享的数据管理方法的示意图。
图14是本申请一实施例的数据传输的数据管理方法的流程示意图。
图15是本申请一实施例的用于数据存储的数据管理方法。
图16是本申请一实施例用于数据存储的数据管理方法的具体流程示意图。
图17是本申请一实施例用于数据存储的数据管理方法的具体流程示意图。
图18是本申请一实施例的装置1800的结构示意图。
图19是本申请一实施例的装置1900的结构示意图。
图20是本申请一实施例的装置2000的结构示意图。
图21是本申请一实施例的装置2100的结构示意图。
具体实施方式
下面将结合附图，对本申请中的技术方案进行描述。
本申请实施例提供了一种数据管理方法及装置，能够为车辆的隐私保护提供覆盖人机交互、数据采集、使用数据进行业务处理以及数据留存销毁的一套完整的数据周期管理方案。
为了便于理解，接下来介绍本申请实施例中涉及到的若干术语的定义。
业务：指用户比较能感知到的系统上层的功能，比如，通过人脸识别进行账户登录业务、倒车影像业务、远程诊断业务、宠物模式业务、整车升级业务。其中，倒车影像业务可以指在车辆倒车的时候采集车辆周边环境的实时视频。远程诊断业务可以指车辆运行阶段定期上报故障数据。宠物模式业务可以指在车主将宠物遗留在车辆内部的情况下，车辆向车主实时反馈车内状态信息的业务。整车升级业务可以指指车辆定时上报车辆内各部件的状态信息，以支持车辆的软件升级。其中，上述业务在执行过程中获取的数据可以属于隐私数据。上述隐私数据包括但不限于：倒车影像获取的视频数据、车辆状态数据等。
程序：指系统内不直接暴露给用户的底层的功能，例如可以是一段正在执行的服务程序。
服务：指不直接面向客户的系统内部服务，可以将系统的基础能力以服务的形式提 供给业务进行调度。在一些示例中，服务可以指应用程序中的不同功能单元。作为示例，服务可以为：记录车内摄像头的视频数据的功能单元、记录车辆内部部件的状态信息的功能单元、记录车辆麦克风的音频数据的功能单元。上述状态信息可以包括热管理系统(thermal management system，TMS)的状态信息、车控域控制器(vehicle domain controller，VDC)的车辆行驶状态信息、雷达的环境感知信息等。
客户标识(client identifier,client ID)：是用于指示数据调用方的标识。其中，数据调用方也可以称为服务调用方，通常指使用数据的业务的标识。客户标识可以理解为系统协议栈为上层业务分配的标识，以用于区别调用数据的业务。
服务标识(service identifier,service ID)：是用于指示数据提供方的标识。其中，数据提供方也可以称为服务提供方，通常指产生数据或提供数据的程序。服务标识可以理解为系统协议栈用来标识底层程序的。从隐私保护的角度来看，当底层程序与个人隐私数据相关联时，可以认为服务标识是分配给数据提供方的标识。
另外，应理解，服务标识是分配给程序的。例如，若一个服务要求提供车辆识别号码(vehicle identification number，VIN)，则分配的服务标识001用于标识提供VIN的程序，而不是表示VIN本身。
进程标识：当使用隐私数据的业务直接作为一个进程在机器中运行时，可以通过进程标识来识别业务。
数据标识：用于识别不同的数据，可用于在数据存储时标识保存的数据项或者文件。例如，业务在获取数据后，可以给数据分配数据标识。倒车影像业务在获取车外摄像头记录的视频数据之后，可以为该视频数据分配数据标识。
本申请利用面向服务架构(service-oriented architecture,SOA)实现车辆内部的数据管理和传输。SOA是一种松耦合服务架构，服务之间通过简单、精确定义接口进行通讯，不涉及底层编程接口和通讯模型。接口采用中立的方式进行定义，可以独立于实现服务的硬件平台、操作系统和编程语言。这使得构建在各种各样的系统中的服务可以以一种统一和通用的方式进行交互。
图1是本申请一实施例的应用于车辆的SOA的架构示意图。如图1所示，SOA中包括应用层、服务层、系统软件层、硬件层、感知执行层。
应用层用于运行业务，其包括用户能够感知的系统上层的功能。可实现对整车服务、应用、体验等进行定义和组合增强。应用层包括但不限于智能座舱、自动驾驶、网联服务等领域内的业务。
服务层用于实现一定的数据融合或控制逻辑。作为服务的最小单位与单一执行实体，通过接口(例如，应用程序接口(application programming interface，API))为应用提供可按需编排的基础服务。
系统软件层包括中间件模块、车载操作系统(operation system,OS)、硬件驱动及适配器、虚拟机等。
其中，中间件模块可以指用于提供基于SOA的接口的功能模块，中间件模块主要用于实现以下功能：一方面可以将底层实现进行封装，屏蔽对上层业务没有用的系统底层实现及差异。另一方面可以汇聚所有服务的信息，为上层业务提供统一的服务订阅和请求的入口。或者说，中间件模块可以作为锚点，对上层业务新加入一层不可绕过的管 控。
作为示例，在车辆内部的业务处理方面，中间件模块的功能包括：为车辆的上层业务提供统一的服务调用入口，当业务发起服务请求时，请求统一集中到中间件模块，由中间件模块进行消息转换、内容识别，并最终将请求重定向到服务，由服务主体进行响应。
作为示例，在车辆对外通信方面，中间件模块的功能包括：对车辆的数据出车进行统一的传输通道管控，当业务数据需要传递到云端时，通过车内协议将数据传递到中间件模块，中间件模块进行消息识别、协议转换，最终将数据传递到云服务器。
硬件层包括各类处理器以及硬件设施，例如，异构计算平台、图形处理器(graphics processing unit，GPU)、中央处理器(central processing unit，CPU)、图像传感器处理(image sensor processing，ISP)模块、微控制单元(microcontroller unit；MCU)、加速核等。
感知执行层包括各类传感器以及线控系统。例如，传感器包括但不限于雷达、摄像头。线控系统包括但不限于动力系统、转向系统、制动系统。
SOA可以将传统的控制器局域网络(controller area network,CAN)信号封装成服务的形态对业务进行暴露。经过服务化的数据能够利用以太的协议优势，保障可靠的同时提供了便捷的调用接口，数据流不再以传统CAN的广播式发送，而是基于订阅进行推送，实现系统资源的按需获取。
SOA可实现以下几类平台化的内容：
(i)资源平台化：平台化后个人数据源都经过了统一封装，并通过业务集中调取。例如，业务需要VIN时不再通过诊断故障码单独获取，而是向一个统一管理VIN的服务进行请求，请求成功后即可在响应消息中得到VIN码值。
(ii)能力平台化：SOA架构中可以对每个部件的通信协议进行统一管控，形成平台化中间件。上层业务不再独立集成协议栈，而是通过访问统一中间件实现通讯功能。例如，将网络标准协议(例如超文本传输协议HTTP)作为一个公用的中间件模块，业务访问中间件模块并在访问请求中携带需要在消息中传输的业务数据负载(payload)，中间件模块将业务数据负载(payload)通过标准协议定义封装后实现数据外发。其中，上述(i)中的资源平台化可以指数据面的平台化，而(ii)中的能力平台化可以指控制面的平台化。
(iii)数据存储平台化：云端借助数据存储管理模块的统一调度能力，可以实现对存储的平台化。数据落盘与服务器前需要经过统一控制节点，确认是有写入权限的业务才可进行存储。而反过来从数据存储管理模块读取数据时也会经过一个可信认证节点。其中落盘是指将数据写入到存储介质中，例如磁盘。
(iv)有效期的平台化扩展：基于存储平台化，当落盘数据被打上标签时，可以按照标签进行留存期管理。例如，某个业务的数据留存期固定90天，则该业务每天向数据存储管理模块传递的数据中包含进程标识、客户标识或数据标识，集中存储管理模块每天循环判断当天需要被清除的数据，结合标签确认到期后则会进行删除。
应理解，图1仅仅作为示例描述SOA架构，在图1的基础上所作的适当的变形或增减所得到的SOA架构，也适用于本申请实施例的方法。
本申请实施例提供了一种用于车辆的数据管理方案，该数据管理方案中提供了一种基于SOA的隐私管理架构，该隐私管理架构能够现对数据全生命周期的可定制化式统一管理，包括数据的采集、共享、传输、存储等。接下来将结合附图，描述本申请实施例的隐私管理架构。
图2是本申请一实施例的应用于车辆的隐私管理架构的示意图。如图2所示，该隐私管理架构包括车辆和云端服务器，也可以分别称作车端和云端。其中，云端服务器可以包括一个或多个服务器，本申请实施例对云端服务器的结构和类型不作限定，例如，云端服务器可以采用中心系统，也可以采用分布式系统。
可选地，云端服务器可以是原设备制造商(original equipment manufacturer，OEM)自己的云服务器，也可以是第三方服务提供商(例如提供语音娱乐服务的服务商)的服务器。
如图2所示，作为示例，云端服务器的功能包括但不限于以下各项：承载在车辆开发阶段的隐私配置文件的编辑工作；车辆使用阶段的相关控制功能；承担隐私日志备份的职责。
继续参见图2，车辆包括处理模块、中间件模块、隐私中心模块、隐私代理模块。上述车辆包括但不限于电动车辆、智能车辆等。
应理解，上述各个模块是以功能进行划分的，在物理实现上，上述各个模块可以设置在不同的节点上，也可以设置在同一节点上。每个模块可以设置在单一的节点上，可以利用分布式技术设置在多个节点上。
处理模块可以指车辆中用于处理业务或应用程序的功能模块，处理模块可设置于车辆中的任何节点上，例如，上述处理模块可以设置于车辆内部的域控制器或ECU中等。
关于中间件模块的定义可参考图1中的描述，此处不再赘述。可选地，中间件模块可以设置在靠近业务的节点，例如，可以和处理模块设置于同一节点处。
继续参见图2，车辆中可包括隐私中心模块以及隐私代理模块。作为示例，隐私中心模块可布置在车辆内部中的处理能力较高的节点上。隐私中心模块的功能包括但不限于以下各项。
(1)隐私配置文件管理功能，用于对接云端的隐私配置文件的编辑，即接受云端下发的隐私相关配置文件，并进行感知以及处理。在一些示例中，隐私配置文件的编辑可包括但不限于以下至少一项：隐私文案配置；隐私偏好配置；个人可识别信息(personally identifiable information，PII)存储配置；数据分类配置。
(2)用户配置管理功能，用于对接用户，上述用户包括车主或者其他车辆使用者。例如，隐私中心模块可通过人机接口(human machine interface,HMI)交互界面与用户交互，并通过关联用户管理模块完成基于自然人的隐私配置接收以及处理工作。
(3)策略引擎，用于隐私配置文件管理以及用户配置管理，并且进一步生成车端内部系统能够处理的隐私策略，隐私策略可下发到隐私代理模块执行。
隐私代理模块可用于接收隐私中心模块的控制指令，并且对接业务实现隐私控制功能。隐私代理模块的功能包括但不限于以下各项。
(1)用户配置处理，用于存储隐私配置信息。
(2)策略执行，用于对接隐私中心下发的隐私策略，或者基于本地的用户配置，执行实时的隐私操作。
可选地，本申请实施例中通常可包括一个隐私中心模块以及一个或多个隐私代理模块。
可选地，本申请实施例对隐私中心模块和隐私代理模块的具体部署位置不作限定。隐私中心模块和隐私代理模块可以部署在车辆中的不同节点处。甚至一些隐私代理模块也可以部署在云端服务器处。
在一些示例中，通常可以将隐私中心模块部署在车辆内部的节点上，例如可以布置在智能座舱域控制器(cockpit domain controller，CDC)或者车控域控制器(vehicle domain controller，VDC)等高算力节点，或者可以布置于其它域控制器中。在一些示例中，隐私中心模块中的不同功能模块还可以分散布置在不同的节点处。例如，可以将隐私中心模块中的用户配置管理模块设置在CDC处，以便于与用户之间进行交互，而隐私中心模块中的其余功能模块可以设置于VDC处。而为了便于管理，隐私代理模块通常布置在距离业务较近的位置。例如，隐私代理模块可以设置于处理业务的节点上。在一些示例中，隐私代理模块可以布置在车载操作系统(operation system,OS)处，以结合中间件模块对上传业务进行管控。
在一些示例中，隐私代理模块可布置在车辆中的各个节点中，例如，负责不同的功能的域控制器或不同的ECU中均可以布置隐私代理模块。在一些示例中，隐私代理模块还可以布置在云端，例如，用户的隐私数据可以上传至云端的数据存储管理模块，因此可以在数据存储管理模块附近也布置隐私代理模块，以用于和数据存储相关的隐私管理。
应理解，在车辆设计中，车辆内部通常可包括多个节点，每个节点用于负责不同的管理和控制功能。这些节点可以包括但不限于车辆内部的域控制器(domain control unit，DCU)、电子控制单元(electronic control unit，ECU)等。其中，ECU是指利用各种传感器以及总线的数据采集和交换来控制汽车行驶状态以及其它各种功能的控制单元。例如，ECU可以包括发动机管理系统(engine management system，EMS)、自动变速箱控制单元(transmission control unit，TCU)、电池管理系统(battery management system，BMS)等。每个ECU都设置有微控制器、存储器、输入/输出接口等单元。不同的ECU的处理能力可能不同，也可能来自不同的厂商，并用于负责车辆内部不同的功能管理。随着智能车领域的发展，未来的车辆控制会趋近于管理中心化的发展，这种情况下，车辆中可以设置若干域控制器，而传统的ECU的功能被简化，软件和处理功能被降级，只保留执行层面功能。ECU或者传感器可以将数据传输给域控制器，由域控制器来完成复杂的运算和大部分控制功能。本申请实施例的方案可以适用于智能机车演进过程中的多种系统架构。
可选地，隐私中心模块可以和隐私代理模块设置于同一节点中，也可以设置于不同的节点中。例如，隐私中心模块可以和隐私代理模块可以设置于同一域控制器，也可以设置于不同的域控制器。
可选地，车内的多个节点处均可以设置处理模块、中间件模块以及隐私代理模块。每个节点处的处理模块用于处理本节点相关的业务，并且通过本节点的中间件模块以及 隐私代理模块实现数据的隐私管理。可选地，在处理模块、中间件模块和隐私代理模块设置于不同的节点的情况下，也可以进行通信交互，以实现数据的隐私管理。
另外，如图2所示，车辆中还可以包括一些智能车所需的基础组件。例如，人机交互界面(human machine interface,HMI)系统以及用户管理模块。其中，HMI系统用于提供用户交互能力，例如，能够提供屏幕以输出内容供用户阅读，并提供按钮选项使得用户能够按照意愿进行输入配置。用户管理模块则用于提供用户的身份认证能力以及身份关联能力，使得以“人”为中心的隐私保护方案能够成立。
本申请实施例的车辆的系统架构可适用于传统的中央网关型车载域控制器架构，也适用于新型环网架构，或者也可以适用于其它车辆架构。其中，中央网关型车载域控制器架构也称为星型架构，该架构中设置有多个域，每个域包括一个主控的域控制器，例如智能座舱域控制器(cockpit domain controller，CDC)、多域控制器(multi domain controller，MDC)、车控域控制器(vehicle domain controller，VDC)等。每个域控制器之下可挂载一个或多个ECU。
而在新型环网架构中，设置多个车辆识别节点(vehicle identification unit，VIU)，各个域控制器可以和VIU相连，每个VIU挂载多个ECU。其中，可以将VIU理解为增强型的网关，对于ECU来说，域的概念被弱化，ECU不与域控制器直接相连，而是通过VIU与域控制器相连。
接下来结合图3至图5继续介绍本申请实施例的方案应用于不同的车辆架构的结构说明。
图3是本申请一实施例的车辆为中央网关型车载域控制架构的示意图。如图3所示，该架构中可包括CDC、MDC、VDC、远程信息处理器(telematics BOX，TBOX)等域控制器。隐私中心模块可设置于CDC中。而隐私代理模块、处理模块以及中间件模块可以设置在各个域控制器中，隐私代理模块可以用于实现其所在的域控制器的业务的隐私控制功能。
作为示例，上述各域控制器的定义如下。
CDC：用于承载车端人机交互、影音娱乐功能的域控制器。
MDC：用于承载辅助驾驶或自动驾驶功能的域控制器，也可以称为自动驾驶域控制器(automated driving control unit，ADCU)。
VDC：用于进行底盘及动力控制的域控制器。
TBOX：提供车联网的基础通信能力。
应理解，上述域控制器的仅仅作为示例描述，本申请实施例的方案可以还可以应用于其它类型的域控制器或者计算节点，并且上述各域控制器的名称也可以为其它名称。
可选地，算力较高的ECU也可以用于处理业务，因此，在ECU中也可以设置隐私代理模块、处理模块以及中间件模块。
在一些示例中，隐私中心模块也可以呈分布式地布置在多个域控制器上。例如，图4是本申请又一实施例的车辆为中央网关型车载域控制架构的示意图。如图4所示，隐私中心模块中的用户配置管理模块可设置在CDC处，以便于与用户之间进行交互，而隐私中心模块中的隐私配置文件管理模块和策略引擎可以设置于VDC处。
图5是本申请一实施例的车辆为新型环网架构的示意图。如图5所示，隐私中心模 块可设置于CDC中，而隐私代理模块、处理模块以及中间件模块可设置于CDC、VDC或者MDC中。
可选地，隐私中心模块也可以设置于其它节点上，或者也可以利用分布式技术将隐私中心模块布置在多个节点上。例如，可以将隐私中心模块中的用户配置管理模块设置在CDC处，而隐私中心模块中的隐私配置文件管理模块和策略引擎可以设置于VDC处。
可选地，算力较高的VIU也可以用于处理业务，因此，在VIU中也可以设置隐私代理模块、处理模块以及中间件模块。
应理解，图2至图5仅仅作为示例描述本申请实施例可能的应用场景，在图2至图5的基础上所作的适当的变形或增减所得到的应用场景，也适用于本申请实施例的方法。
本申请实施例提供的用于车辆的数据管理方法，可以实现以下功能：基于车辆中的资源、能力的平台化和服务化，将用户的隐私配置与系统底层的数据服务化接口进行关联、通信协议栈接口等平台能力进行关联；基于数据分类分级的量化标记，实现隐私敏感度的量化评估；基于配置文件，限制隐私保护的数据生命周期阶段及业务范围。
在本申请实施例中，可以实现对数据全生命周期的可定制化式统一管理，包括数据的采集、共享、传输、存储等。并可以利用数据处理的不同流程(例如，采集、共享、传输、存储)所对应的特征，在隐私配置中标注对不同流程的管控要求。
图6是本申请一实施例的应用于车辆的隐私文件配置方法的具体实施例。该方法可以由图2至图5中的隐私中心模块和隐私代理模块执行。如图6所示，该方法包括S601～S603。
在S601，隐私中心模块获取隐私配置文件，隐私配置文件是用于定义隐私配置的文件。
可选地，隐私配置文件可以是由原始设备制造商(original equipment manufacturer,OEM)定义的，并提供给云端服务器，再由云端服务器下发给隐私中心模块。
在一些示例中，隐私配置文件中可以包括但不限于以下内容：定义业务的标识；定义服务的标识；定义不同数据生命周期阶段的标识；指示业务和服务之间的关联关系的信息；指示业务和业务之间的关联关系的信息。综合上述这些信息，隐私配置文件从功能上实现了一个用于限制业务对数据使用的隐私策略文件。
上述的数据生命周期可以包括但不限于以下阶段：数据采集、数据共享、数据传输、数据存储。
其中，数据采集可以指业务从服务获取数据，或者可以理解为业务从底层的程序采集和获取数据。例如，倒车影像业务通过车内摄像头服务采集视频数据。又例如，整车升级业务通过VDC的车身数据服务采集车辆行驶状态信息。又例如，宠物模式业务通过TMS的温度监控服务采集车辆内部的温度状态信息。
数据共享可以指一个业务向另一个业务提供共享数据，数据共享在业务层发生。作为示例，数据共享包括共享广播和订阅发布两种类型。共享广播是指提供共享数据的业务可以以广播的方式发送共享数据，订阅发布是指获取共享数据的业务需要通过订阅才能获取共享数据，即共享数据是定向发送的。例如，以共享广播为例，远程诊断业务可以向整车升级业务提供部件运行信息作为共享数据。以订阅发布为例，事件数据记录仪 (event data recorder，EDR)业务向故障定位业务提供部件故障数据作为共享数据。其中，EDR业务用于记录车辆的故障数据。
数据传输可以指业务将车辆内的数据向车辆外的设备传输。数据传输对数据的接收方不作限定，接收方可以是云端服务器，也可以是其它车辆，或者其它通信设备。例如，宠物模式业务向车主的手机传输车内状态信息。或者，整车升级业务向云端服务器传输车内部件的状态信息。
数据存储是指将车辆内的数据传输至存储设备，存储设备可以由数据存储管理模块管理。存储设备可以设置于车辆内部，也可以设置于云端服务器。相应地，数据存储管理模块也可以设置于车辆内部或者云端服务器。数据存储管理模块和存储设备可以设置在同一实体装置中，也可以设置于不同的实体装置中。数据存储可以是业务发起的。例如，倒车影像业务向云端服务器或者本地存储设备中存储视频数据。
其中，定义业务的标识可以理解为：对客户可感知的顶层业务的标识。上述服务的标识可理解为系统内部提供个人数据源的服务的标识字段的定义。上述数据的生命周期阶段的标识可以理解系统为区分业务或服务所处的不同数据生命周期阶段而分配的标识。上述指示业务和服务之间关联关系的信息可以理解为指示客户可感知的顶层业务与该业务可能涉及的数据所对应的一个或多个服务之间的关系。上述指示业务和业务之间关联关系的信息可以理解为指示客户可感知的顶层业务与该业务可能涉及的数据所对应的一个或多个业务之间的关系。
上述定义业务的标识可以包括但不限于：客户标识、服务标识、进程标识。
上述定义服务的标识可包括服务标识。
可选地，定义业务的标识包括以下至少一项：在不同数据生命周期阶段定义业务的标识；在不同通信协议中定义业务的标识。
可选地，定义服务的标识包括以下至少一项：在不同数据生命周期阶段定义服务的标识；在不同通信协议中定义服务的标识。
其中，通信协议是旨在为信息交互的对象提供一套标准的协议，以保障通信的正确实施。工业领域的服务化协议用于提供一个统一的中间件，支持集中化的通信服务管理，为隐私管理提供控制点。在常见的车载通信方案中，还会提供超文本传输协议(hypertext transfer protocol，HTTP)和消息队列遥测传输(message queuing telemetry transport，MQTT)的SOA通信方案。
作为示例，上述通信协议可以包括但不限于以下各项：基于互联网协议的可扩展面向服务的中间件协议(scalable service-oriented middleware over internet protocol，SOME/IP)、数据分发服务(data distribution service，DDS)、面向web客户端的数据分发服务(web-enabled data distribution service，DDS-WEB)等。
可选地，隐私配置文件中还包括隐私分级信息，隐私分级信息用于指示不同服务标识对应的数据的隐私等级。
在具体示例中，隐私分级信息可以以标签的形式区分数据的敏感程度，例如，敏感、一般或者非个人数据等。在另一些示例中，隐私分级信息可以采用量化数值来进行敏感度测量，例如，如敏感个人数据的服务的度量值为5～10，一般个人数据的度量值为1～4，非个人数据的度量值为0，则业务整体的隐私度量值是所有数据的累计和。
在本申请实施例中，将隐私分级信息与服务标识进行关联，以便于在基于SOA架构下的业务处理过程中标识和管理隐私数据，能够提高车辆的隐私数据管理的效率。
可选地，在本申请实施例中，还可以在隐私配置文件中设置不同数据生命周期阶段的隐私控制策略。例如，如图8和图9所示，可以针对数据的采集、传输过程制定不同的隐私策略。
在S602，隐私中心模块根据隐私配置文件，获取隐私策略文件，隐私策略文件包括以下至少一项：第一配置信息，用于指示业务和服务之间的访问权限或者业务与业务之间的访问权限；第二配置信息，用于指示业务的访问权限。
上述隐私策略文件可用于对通过中间件模块的业务进行隐私管控。或者可以理解为，上述隐私策略文件可以实现数据相关的权限控制列表的功能。
在一些示例中，第一配置信息包括以下至少一项：指示允许提供数据的服务的服务标识和允许采集数据的业务的客户标识之间的第一关联关系的信息；指示允许提供共享数据的业务的服务标识和允许获取共享数据的业务的客户标识之间的第二关联关系的信息；前者可应用与数据采集过程中的隐私访问控制，而后者可应用于数据共享过程中的隐私访问控制。
在一些示例中，第二配置信息包括以下至少一项：允许采集数据的业务的客户标识；允许向车外传输数据的业务的客户标识或进程标识；允许提供数据的服务的服务标识；允许提供共享数据的业务的服务标识。第二配置信息可应用于数据采集、数据的出车传输、数据共享等过程中的隐私访问控制。
在S603，隐私中心模块向隐私代理模块发送隐私策略文件，相应地，隐私代理模块从隐私中心模块接收隐私策略文件，隐私策略文件用于中间件模块的访问控制。
其中，上述用于中间件模块的访问控制可以理解为对通过中间件模块处理的业务进行访问控制。
可选地，在S603，隐私中心模块根据隐私配置文件，获取隐私策略文件，包括：隐私中心模块根据隐私配置文件，通过显示界面向用户呈现隐私配置选项，隐私配置选项用于用户选择以下至少一项：是否授权业务调用至少一个服务的数据、是否授权业务调用至少一个其它业务的数据；隐私中心模块获取用户对隐私配置选项的选择结果；隐私中心模块根据选择结果，获取隐私策略文件。
例如，上述显示界面可以为位于车辆座舱内的HMI交互界面，还可以设置于手机的HMI界面。
可选地，在S603，隐私中心模块根据隐私配置文件，获取隐私策略文件，还包括：隐私中心模块从隐私配置文件中获取第一业务对应的隐私声明文件；隐私中心模块通过显示界面向用户呈现第一业务对应的隐私声明文件。
在一些示例中，在不通过用户选择的情况下，隐私中心模块也可以直接根据隐私配置文件，生成全部或部分的隐私策略文件。
可选地，隐私策略文件可以动态更新。例如，在生成隐私策略文件之后，若用户通过显示界面更改隐私配置选项，则隐私中心模块可以相应地更新隐私策略文件。
可选地，隐私中心模块可以根据用户的登陆信息确定用户账号(或者说，用户身份)，并将隐私策略文件与用户账号绑定。也就是说，隐私中心模块也可以为不同的用 户生成和维护不同的隐私策略文件，以提高隐私管理的效率。
在本申请实施例中，提供了一种车辆在基于SOA架构下的隐私配置方案，利用隐私中心模块获取隐私配置文件，并生成隐私策略文件，再分发至靠近业务的隐私代理模块。而隐私代理模块用于负责根据隐私策略文件，通过中间件模块处理的业务的隐私数据管控，从而使得车辆内部的所有业务无法绕开隐私管控，提供了从业务端到底层数据端之间的端到端隐私管控服务，将用户的隐私配置与系统底层的数据服务化接口进行关联，能够为车辆中的异构架构提供统一化的隐私管控，提高了隐私管控的安全性以及效率。
图7是本申请一实施例的应用于车辆的隐私文件配置的具体实施例。如图7所示，该方法包括S701-S706。
S701、云端服务器向隐私中心模块发送隐私配置文件，相应地，隐私中心模块接收该隐私配置文件。
可选地，上述定义业务的标识可包括：在不同数据生命周期阶段定义业务的标识；在不同通信协议中定义业务的标识。即在业务处于不同的数据生命周期阶段或不同的通信协议中时，可以为业务分配不同的标识。应理解，在一些示例中，业务在同一数据生命周期阶段或同一通信协议中可以都分配客户标识、服务标识和进程标识，也可以仅分配上述三个标识中的部分标识。
例如，图8是本申请一实施例的隐私配置文件的示意图。如图8所示，对于隐私业务A来说，其在数据采集的阶段的客户标识为005，服务标识为006，而在数据共享阶段的客户标识为008，服务标识为003，在数据存储和数据传输阶段的客户标识为009，进程标识为proc A。
可选地，上述定义服务的标识可包括：在不同数据生命周期阶段定义服务的标识；在不同通信协议中定义服务的标识。即在服务处于不同的数据生命周期阶段或不同的通信协议中时，可以为服务分配不同的标识。
例如，继续参见图8，服务1在对应的通信协议为SOME/IP时，其服务标识为101；而服务1在对应的通信协议为DDS时，其服务标识为111。
其中，在车辆的设计阶段，需要识别车辆内部各业务所有涉及的个人数据。当数据是通过服务化接口进行调用时，就可以纳入隐私集中式管控。具体管控方式依托服务调用的定义方式。以SOME/IP的服务化接口调用为例，在设计阶段，可以定义各个服务的服务标识作为数据提供方的标识。数据提供方可以是产生数据的程序，也可以是提供共享数据的程序。上层业务调取服务后可实现个人数据的采集。而在设计阶段也会定义客户标识，作为数据调用方的标识。当客户标识与服务标识关联时即可形成数据相关的权限控制列表，即在设计允许范围内对个人数据的使用矩阵。
在一些示例中，客户标识与服务标识本身无隐私意义，为实现进一步精确控制，可通过在隐私配置文件中增加隐私分级信息，以标识各个服务所属的数据隐私分类等级。如图8所示，服务1和服务2分别是车内向上层业务提供的两类不同的个人数据源。当其中的服务1敏感度较高时，可在隐私配置文件中增加敏感标签。而对于敏感度较低的服务2，可在隐私配置文件增加一般标签。对于不同场景下的隐私管理需求，可以基于标签进行过滤。
图9是本申请一实施例的隐私配置文件的示意图。可选地，如图9所示，隐私分级信息除了上述的敏感/一般的分类分级方式，还可以基于量化数值进行敏感性度量。如敏感个人数据的服务的度量值为5～10，一般个人数据的度量值为1～4，非个人数据的度量值为0，则业务整体的隐私度量值是所有数据的累计和，隐私管理需求可定制隐私区间，落在隐私区间内的业务需要受到隐私控制。应理解，上述量化数值的具体实现仅作为示例，量化数值与隐私分级之间的关联关系也可以采用其它具体实施方式，例如，量化值越大，则隐私等级越低，此处不再一一枚举。
可选地，上述隐私分级信息可以应用于在数据生命周期的各个阶段的隐私控制策略中。例如，可以根据隐私分级信息确定各数据的访问权限以及留存期。如图8所示，服务1的隐私分级信息为敏感，则留存期为3个月，即该数据在存储满三个月之后需要被删除。而服务2的隐私分级信息为一般，则留存期不受限制。又如图9所示，当采用量化数值衡量时，服务1的隐私分级信息为7，则留存期为1个月；服务2的隐私分级信息为2，留存期为不限时长；服务4的隐私分级信息为6，留存期为3个月。
另外，隐私配置文件中也可以包括一种或多种隐私策略。这些隐私策略可应用于数据生命周期中的各阶段，并且根据隐私分级信息来确定不同的隐私策略。隐私中心模块在接收到隐私配置文件之后，可以选择其中一种隐私策略应用于当前的隐私策略文件。例如，图8中，隐私策略1在数据采集阶段中对隐私分级信息为一般和敏感标签的服务进行管控。而隐私策略2在数据采集阶段中只对隐私分级信息为敏感标签的服务进行管控。又例如，在图9中，隐私策略1在数据采集和传输阶段中均对度量值≥6的服务进行管控，而隐私策略2仅在数据传输阶段对度量值≥6的服务进行管控。
在本申请实施例中，针对隐私数据种类多，缺乏统一管控机制的问题，通过服务标识对提供数据的来源进行分类，基于平台服务化，还可以在用服务标识标记的基础上，对数据进行分类分级的量化标记，实现数据的隐私敏感度的量化评估，提高了隐私数据的管理效率。
S702、隐私中心模块对隐私配置文件进行分析，形成隐私配置选项和文案。
S703、隐私中心模块将隐私配置选项和文案呈现给用户。
S704、隐私中心模块获取用户对隐私配置选项的选择结果。
例如，用户阅读了文案并通过选择按钮同意了相应的隐私配置，则隐私中心模块获取到选择结果。
例如，图10是本申请一实施例的隐私配置文件的示意图。如图10所示，隐私配置文件中可以为每个业务配置隐私声明，隐私声明可通过独立条目在用户界面上呈现，并显示选择按键。用户可根据意愿选择同意授权或拒绝授权。隐私声明可以打包在隐私配置文件中一起下发。
S705、隐私中心模块根据隐私配置选项的选择结果，形成隐私策略文件。
在一些示例中，隐私中心模块可以将用户同意的隐私配置绑定用户的账号，并形成与该用户对应的隐私策略文件。
在一些示例中，在不通过用户选择的情况下，隐私中心模块也可以直接根据隐私配置文件，生成全部或部分的隐私策略文件。
在本申请实施例中，隐私中心模块以业务为单位绑定用户同意状态，使得业务行为 必须遵照用户意愿，不可被绕过，从而实现了业务端到数据端的隐私保护方案。
S706、隐私中心模块将隐私策略文件发送至各个隐私代理模块，相应地，各隐私代理模块从隐私中心模块接收隐私策略文件。
可选地，该隐私策略文件可用于分发至各个隐私代理模块处，每个隐私代理模块用于根据隐私策略文件对就近的业务进行隐私管控。各个隐私代理模块用于通过中间件模块进行访问控制，由于车辆中的业务均需通过中间件模块提供的平台进行数据调用，因此所有的业务均受到隐私代理模块的监控，从而实现了严密和安全的隐私监控方案。
在本申请实施例中，隐私中心模块可根据隐私定义文件生成隐私策略文件，该隐私策略文件用于为上层业务调用数据提供隐私配置，并以中间件模块为平台，绑定上层业务与底层数据之间的关系，使得业务访问行为必须遵照系统设置或者用户意愿，不可被绕过，从而实现了从业务端到数据端的隐私保护方案，提高了车辆的隐私管控的效率和安全性。
本申请基于系统平台提供的中间件模块，可以实现数据采集、共享、传输以及存储的隐私管控。隐私管控的原理在于：当业务调用数据时，基于车辆的SOA原则，业务统一通过中间件模块调取数据，中间件模块通过隐私代理模块确定该数据调用是否属于隐私策略文件允许的访问范围。在属于访问范围的情况下，该业务才可以调用数据。该方案将用户的隐私配置与系统的隐私控制点进行关联，实行端到端的隐私管控流程，即使在异构架构中，任何上层业务调用数据都不可绕过隐私管控，提高了车辆的隐私管控的效率和安全性。接下来结合附图，详细介绍本申请实施例的在不同数据生命周期阶段中的数据管理方法。
图11是本申请一实施例的的数据管理方法的示意图。图11中可涉及到数据采集、共享以及数据传输的过程。如图11所示，该方法包括S1101～S1103。
在S1101，处理模块向中间件模块发送第一请求信息，相应地，中间件模块从处理模块接收第一请求信息。第一请求信息用于请求为第一业务调用第一数据，第一请求信息中包括第一标识，第一标识包括以下至少一项：第一业务的客户标识、第一业务的进程标识、第一数据的提供方的服务标识。
可选地，第一业务通过以下方式中的任意一种调用第一数据：数据采集、数据共享、数据向车外传输。
可选地，根据调用第一数据时所属的不同数据生命周期阶段，上述第一请求信息可以包括但不限于：数据采集请求信息、数据共享请求信息以及数据传输请求信息等。上述第一数据可以包括但不限于：待采集数据、待共享数据以及待传输数据等。
在S1102，中间件模块向隐私代理模块发送第一查询信息，相应地，隐私代理模块从中间件模块接收第一查询信息。第一查询信息用于查询是否同意为第一业务调用第一数据，第一查询信息中包括第一标识。
在S1103，隐私代理模块向中间件模块发送第一响应信息，相应地，中间件模块从隐私代理模块接收第一响应信息。第一响应信息用于指示是否同意为第一业务调用第一数据，其中，第一响应信息是根据第一标识和隐私策略文件确定的，隐私策略文件包括以下至少一项：第一配置信息，用于指示业务和服务之间的访问权限或者业务与业务之间的访问权限；第二配置信息，用于指示业务的访问权限。
可选地，中间件模块在接收到第一响应信息之后，若第一响应信息同意为第一业务调用第一数据，则中间件模块为第一业务调用第一数据。例如，在数据采集的情况下，中间件模块从服务获取第一数据，并发送给处理模块。若第一响应信息不同意为第一业务调用第一数据，则中间件模块通知处理模块不允许调用第一数据。
在一些示例中，上述第一配置信息包括以下至少一项：指示允许提供数据的服务的服务标识和允许采集数据的业务的客户标识之间的第一关联关系的信息。指示允许提供共享数据的业务的服务标识和允许获取共享数据的业务的客户标识之间的第二关联关系的信息。
其中，第一配置信息中规定了数据调用方和数据提供方之间的关联关系，即数据调用方和数据提供方都符合第一配置信息的规定的情况下，才允许第一业务调用数据。
例如，若第一业务使用数据采集的方式调用第一数据，则第一标识可以包括第一业务的客户标识以及第一服务的服务标识。隐私代理模块在第一业务的客户标识和第一服务的服务标识属于第一配置信息指示的第一关联关系的情况下，向中间件模块发送第一响应信息，第一响应信息用于指示同意为第一业务调用第一数据。
又例如，若第一业务通过数据共享的方式调用第一数据，第一数据为第二业务的数据，数据共享的类型为订阅发布，则第一标识包括第一业务的客户标识和第二业务的服务标识。其中，订阅发布是指数据调用方需要通过订阅才能获取共享数据，即数据是定向发送的。隐私代理模块在第一业务的客户标识和第二服务的服务标识属于第一配置信息指示的第二关联关系的情况下，向中间件模块发送第一响应信息，第一响应信息用于指示同意为第一业务调用第一数据。
在一些示例中，上述第二配置信息包括以下至少一项：允许采集数据的业务的客户标识；允许向车外传输数据的业务的客户标识或进程标识；允许提供数据的服务的服务标识；允许提供共享数据的业务的服务标识。
其中，第二配置信息中只限定了数据调用方和数据提供方中一方的资格，即只要数据调用方和数据提供方的一方符合第一配置信息的要求，便可以调用数据。
例如，若第一业务使用数据采集的方式调用第一数据，则第一标识可以包括第一业务的客户标识。隐私代理模块可以在第一标识属于第二配置信息指示的允许采集数据的业务的客户标识的情况下，向中间件模块发送第一响应信息，第一响应信息用于指示同意为第一业务调用第一数据。
又例如，若第一业务使用数据向车外传输的方式调用第一数据，则第一标识可以包括第一业务的客户标识或进程标识。隐私代理模块可以在第一标识属于第二配置信息指示的允许向车外传输数据的业务的客户标识或进程标识情况下，向中间件模块发送第一响应信息，第一响应信息用于指示同意为第一业务调用第一数据。
又例如，若第一业务使用数据向数据共享的方式调用第一数据，第一数据为第二业务的数据，数据共享的类型为共享广播，则第一标识包括第二业务的服务标识，即数据提供方的服务标识。其中，共享广播是指数据提供方可以以广播的方式发送共享数据，而非定向发送，任何数据调用方都可以获取该共享数据。隐私代理模块在第一标识属于第二配置信息指示的允许提供共享数据的业务的服务标识的情况下，向中间件模块发送第一响应信息，第一响应信息用于指示同意为第一业务调用第一数据。
在本申请实施例中，基于系统平台提供的中间件模块，可以实现数据的隐私管控。例如，数据采集、数据共享以及数据出车传输等，当业务调用数据时，基于车辆的SOA原则，业务统一通过中间件模块调取数据，中间件模块通过隐私代理模块确定调用是否属于隐私策略文件允许的范围。基于系统的平台化机制增加隐私控制节点，以管控利用中间件模块执行的业务，实施上层业务不可绕过的隐私数据采集控制方法。提高了车辆的隐私管控的效率和安全性。
图12是本申请一实施例的用于数据采集的数据管理方法的具体实施例。如图12所示，该方法包括S1201-S1204。
S1201、处理模块向中间件模块发送数据采集请求信息，相应地，中间件模块从处理模块接收数据采集请求信息。数据采集请求信息用于为第一业务请求采集第一数据。该数据采集请求信息中包括第一业务的第一标识。其中，第一标识包括第一业务的客户标识，或者，第一标识包括第一业务的客户标识以及第一服务的服务标识。其中，第一服务为待采集的第一数据的提供方。
如图8和图9所示，在数据采集过程中，业务A采集服务1或服务2的数据时，业务A可作为数据调用方，而服务1和服务2可作为数据提供方。因此在数据采集过程中，业务A使用客户标识005，服务1使用服务标识101，服务2使用服务标识102。
S1202、中间件模块向隐私代理模块发送第一查询信息，相应地，隐私代理模块从中间件模块接收第一查询信息，第一查询信息用于查询是否同意为第一业务采集第一数据。第一查询信息中包括第一业务的第一标识。
S1203、隐私代理模块根据第一业务的第一标识和隐私策略文件，是否同意为第一业务请求采集第一数据。
例如，隐私代理模块可以确定第一业务的客户标识和第一服务标识是否属于隐私策略文件中的第一配置信息中指示的允许提供数据的服务的服务标识和允许采集数据的业务的客户标识之间的第一关联关系。若是，则同意采集；若否，则不同意采集。
又例如，隐私代理模块可以确定第一业务的客户标识是否属于隐私策略文件中的第二配置信息中指示的允许采集数据的业务的客户标识。若是，则同意采集；若否，则不同意采集。
在一些示例中，隐私代理模块还可以根据当前登录状态确定当前登录的用户账号，以便于确定该用户的隐私配置。
可选地，在隐私配置阶段，可以为提供数据的服务分配服务标识。针对同一业务(即相同的客户标识)可能采集的多个数据，用户可以以服务标识为区分，确定是否授权给各服务标识对应的数据。
S1204、隐私代理模块向中间件模块发送第一响应信息，相应地，中间件模块从隐私代理模块接收第一响应信息。第一响应信息用于指示是否同意为第一业务采集第一数据。
可选地，中间件模块在接收到第一响应信息之后，若第一响应信息同意为第一业务采集第一数据，则中间件模块为第一业务采集第一数据。并发送给处理模块。若第一响应信息不同意为第一业务采集第一数据，则中间件模块通知处理模块不允许采集第一数据。
在本申请实施例中，基于系统平台提供的中间件模块，可以实现数据采集的隐私管控。当业务采集数据时，基于车辆的SOA原则，业务统一通过中间件模块调取服务实现数据采集，中间件模块通过隐私代理模块确定数据采集是否属于隐私策略文件允许访问的范围。基于系统的平台化机制增加隐私控制节点，以管控利用中间件模块执行的业务，实施上层业务不可绕过的隐私数据采集控制方法。将用户的隐私配置与系统的隐私控制点进行关联，实行端到端的隐私管控流程，提高了车辆的隐私管控的效率和安全性。
图13是本申请一实施例的用于数据共享的数据管理方法的示意图。如图13所示，该方法包括S1301-S1304。
S1301、处理模块向中间件模块发送数据共享请求信息，该数据共享请求信息用于请求将第二业务的第一数据共享给第一业务。
S1302、中间件模块向隐私代理模块发送第一查询信息，以查询是否同意为第一业务提供第二业务的第一数据。该第一查询信息中包括第一标识。该第一标识包括第一业务的客户标识，或者，该第一标识包括第一业务的客户标识以及第二业务的服务标识。
如图9所示，当业务A向业务B提供共享数据时，业务A作为服务提供方，业务B作为服务调用方。因此在数据共享过程中，业务A作为服务提供方使用服务标识003，而业务B作为服务调用方使用客户标识028。
S1303、隐私代理模块根据第一标识判断是否同意将第二业务的第一数据共享给第一业务。
例如，继续参见图9，若共享方式为共享广播类，即业务A以广播的方式发送数据，则中间件模块只需要查询业务A的服务标识是否在隐私策略文件允许访问的范围内，无需查询业务B的客户标识。若是，则允许共享。
又例如，若共享方式为订阅发布类，即业务B以订阅的方式获取业务A的数据，则中间件模块需要同时查询业务A的服务标识以及业务B的客户标识是否在隐私策略文件允许访问的范围内。若是，则允许共享。
S1304、隐私代理模块向中间件模块发送第一响应信息。第一响应信息用于指示是否同意将第二业务的第一数据共享给第一业务。
可选地，中间件模块在接收到第一响应信息之后，若第一响应信息同意为共享数据，则中间件模块将第二业务的第一数据提供给第一业务。若第一响应信息不同意共享数据，则中间件模块通知处理模块不允许共享数据。
在本申请实施例中，基于系统平台提供的公共的中间件模块，隐私管控可以用于数据共享。当数据在不同业务之间进行共享时，基于车辆的SOA架构实现方式，数据通过中间件模块以服务包装的形式实现共享，中间件模块通过隐私代理模块确定共享业务是否属于隐私策略文件允许的共享范围，此时系统根据业务的客户标识或服务标识进行隐私管控，从而提供了一种数据共享的隐私管控方法，提高了车辆的的隐私管控效率。
图14是本申请一实施例的数据传输的数据管理方法的流程示意图。如图14所示，该方法包括S1401-S1404。
S1401、处理模块向中间件模块发送数据传输请求信息，数据传输请求信息用于请求将第一业务的第一数据传输至车辆之外的通信设备，数据传输请求信息中包括第一标 识，该第一标识包括第一业务的客户标识或者第一业务的进程标识。
S1402、中间件模块向隐私代理模块发送第一查询信息，第一查询信息用于请求是否允许向车外传输该第一数据，第一查询信息中包括第一标识。
作为示例，如图8和图9所示，在业务向外传输数据的过程中，业务A可使用进程标识pro A或者客户标识009。
S1403、隐私代理模块根据第一标识，确定第一业务是否属于隐私策略文件允许的向车外传输数据的业务的范围。
例如，若第一标识属于隐私策略文件中的第二配置信息指示的允许向车外传输数据的业务的客户标识或进程标识情况下，则确定同意向车外传输第一业务的第一数据。
S1404、隐私代理模块向中间件模块发送第一响应信息，以指示是否同意数据传输请求信息的请求。
可选地，中间件模块在接收到第一响应信息之后，若第一响应信息同意向车外传输第一数据，则中间件模块向车外发送第一数据。若第一响应信息不同意向车外传输第一数据，则中间件模块通知处理模块不允许向车外传输第一数据。
在本申请实施例中，隐私管控还可以用于数据向外传输。当数据进行出车传输时，基于车的SOA思想，中间件模块需要实现平台化，即每个业务不再单独集成出车协议栈，而是使用公共能力。业务的数据需要向外传输时，进程调用中间件模块进行统一调度，此时系统根据业务的进程标识或客户标识进行隐私管控，从而提供了一种车辆的出车数据传输的隐私管控方法，提高了车辆的隐私管控效率。
本申请方案还可以实现数据存储的隐私管控。车辆内的数据通常分布在各个不同的节点进行存储。例如、各域控制器或者ECU中。数据存储管理模块可用于对车辆内的数据进行存储管理。可选地，数据存储管理模块可以设置于车辆内部，也可以设置在云端。接下来将结合附图，继续描述本申请实施例的数据存储的隐私管控方案。
图15是本申请一实施例的用于数据存储的数据管理方法。如图15所示，该方法包括：
S1501、处理模块发送第一业务的存储请求信息，相应地，数据存储管理模块接收第一业务的存储请求信息，存储请求信息中包括：待存储的第一数据、第一数据的数据标识、存储分级信息，其中，存储分级信息用于指示第一数据的数据标识对应的隐私等级。
可选地，数据存储管理模块可以设置于车辆内部，也可以设置于云端服务器中。
需要说明的是，存储分级信息与前文中的隐私分级信息并不相同。隐私分级信息通常通常应用于数据采集、传输、数据共享或者数据存储的过程中。隐私分级信息与服务标识之间存在绑定关系，即在数据存储过程中，需要提供数据对应的服务标识。例如，若数据是采集自不同的服务，则具有不同的服务标识。而存储分级信息通常仅应用于数据存储过程中。存储分级信息和留存期之间的对应关系可以由业务自身预置文件定义，上述对应关系也存储于隐私配置文件中。隐私代理模块在对隐私配置文件进行分析，生成隐私策略文件后，存储分级信息和留存期之间的对应关系也存储于隐私代理模块中。存储分级信息和数据标识之间存在绑定关系，当在存储过程中需要根据分类分级进行控制时，业务可携带数据、数据标识以及存储分级信息向数据存储管理申请存储文件。
在一些示例中，同一业务对应的不同数据具有不同的数据标识，不同数据标识对应的存储分级信息可能不同。
可选地，存储分级信息也可以采取与隐私分级信息相似的分类分级方式。即采用标签的分类方式或者采取量化数值的分类方式，或者也可以采取其它通用的分类方式，为了简洁，此处不再赘述。
S1502、数据存储管理模块存储第一数据。
S1503、数据存储管理模块在第一数据的存储时长达到留存期之后，删除第一数据，其中，留存期是根据存储分级信息确定的。
可选地，在S1503，数据存储管理模块可以根据存储分级信息确定第一数据的留存期。在一些示例中，数据存储管理模块向隐私代理模块发送第二查询信息，第二查询信息用于查询第一数据的留存期，第二查询信息中包括第一数据的数据标识以及存储分级信息；数据存储管理模块从隐私代理模块接收第一指示信息，第一指示信息用于指示第一数据的留存期。数据存储管理模块在第一数据落盘后，可以开启计时器，对第一数据的存储时长进行计时，并在存储时长达到留存期之后，删除第一数据。
可选地，在S1502，数据存储管理模块也可以不获取第一数据的留存期，而是由隐私代理模块对第一数据的存储时长进行计时，并在存储时长达到留存期之后，指示数据存储管理模块删除第一数据。在一些示例中，数据存储管理模块向车辆中的隐私代理模块发送第二查询信息，第二查询信息中包括第一数据的数据标识、存储分级信息以及第一数据的落盘时间；在第一数据的存储时长达到留存期的情况下，数据存储管理模块从隐私代理模块接收删除指示信息，删除指示信息用于指示删除第一数据。
可选地，上述数据存储管理模块可以设置在车辆中，也可以设置在云端服务器中。
可选地，上述隐私代理模块可以设置于数据存储管理模块附近。例如，若数据存储管理模块设置于车辆中，则可以将隐私代理模块设置于车辆中。若数据存储管理模块设置于云端服务器中，则可以将隐私代理模块也设置在云端服务器中。
进一步地，存储请求信息中还包括第一标识，第一标识包括以下至少一项：客户标识和进程标识，该方法还包括：数据存储管理模块根据第一标识，确定第一业务是否具有存储权限；在确定第一业务具有存储权限的情况下，数据存储管理模块将数据落盘。
在本申请实施例中，隐私代理模块将数据的留存期与存储分级信息相关联并进行管控，数据存储管理模块在对车辆中的数据进行存储管理时，可以通过和隐私代理模块之间的通信获取与留存期相关的信息，以根据留存期删除数据，实现隐私数据的统一管理和定时删除，提高了车辆的数据存储管理的安全性和效率。
图16是本申请一实施例用于数据存储的数据管理方法的具体流程示意图。如图16所示，该方法包括：
S1601、处理模块向数据存储管理模块发送第一业务的存储请求信息，相应地，数据存储管理模块从处理模块接收第一业务的存储请求信息，该存储请求信息中包括：待存储的第一数据、第一数据的数据标识、存储分级信息、第一数据的第一标识。
其中，第一数据的第一标识可以为客户标识或者进程标识。
S1602、数据存储管理模块识别第一业务的第一标识，并根据第一标识审核第一业务的存储权限。
S1603、数据存储管理模块确认第一业务具有存储资格后，将第一数据落盘。
S1604、数据存储管理模块向隐私代理模块发送第二查询信息，相应地，隐私代理模块从数据存储管理模块接收第二查询信息，该第二查询信息用于查询第一数据的留存期，第二查询信息中包括第一数据的数据标识以及存储分级信息。
S1605、数据存储管理模块从隐私代理模块接收第一指示信息，相应地，隐私代理模块从数据存储管理模块接收第一指示信息，第一指示信息用于指示第一数据的留存期。
S1606、数据存储管理模块开启计时器，该计时器根据留存期计时。
S1607、在留存期到期后，数据存储管理模块删除第一数据。
其中，数据存储管理模块可以将计时器与第一数据的数据标识绑定，在留存期到期之后，数据存储管理模块可以根据数据标识找到第一数据，并删除第一数据。
图17是本申请一实施例用于数据存储的数据管理方法的具体流程示意图。如图17所示，该方法包括：
S1701、处理模块向数据存储管理模块发送第一业务的存储请求信息，该存储请求信息中包括：待存储的第一数据、第一数据的数据标识、第一数据的存储分级信息、第一数据的第一标识。
其中，第一数据的第一标识可以为客户标识或者进程标识。
S1702、数据存储管理模块识别第一业务的第一标识，并根据第一标识审核其存储权限。
S1703、数据存储管理模块确认第一业务具有存储资格后，将数据落盘。
S1704、数据存储管理模块向车辆中的隐私代理模块发送第二查询信息，第二查询信息中包括第一数据的数据标识以及存储分级信息。
S1705、隐私代理模块根据存储分级信息，确定第一数据的留存期。
S1706、隐私代理模块开启计时器，该计时器根据留存期计时。
S1707、隐私代理模块在第一数据的存储时长达到留存期之后，向数据存储管理模块发送删除指示信息，删除指示信息用于指示删除第一数据。
S1708、数据存储管理模块在接收删除指示信息之后，删除第一数据。
图18是本申请一实施例提供的装置1800的结构示意图。如图18所示，该装置1800包括隐私中心模块1801、隐私代理模块1802和中间件模块1803，该装置1800可以是前述实施例中的车辆，也可以是车辆的组成部件(如车载设备、域控制器或者芯片)。该装置1800可实现对应于上文方法实施例中的车辆执行的步骤或者流程。
隐私中心模块1801用于获取隐私配置文件；根据隐私配置文件，获取隐私策略文件，隐私策略文件包括以下至少一项：第一配置信息，用于指示业务和服务之间的访问权限或者业务与业务之间的访问权限；第二配置信息，用于指示业务的访问权限；以及向隐私代理模块1802发送隐私策略文件，隐私策略文件用于中间件模块1803的访问控制，其中中间件模块1803被配置为向业务提供基于SOA的接口。
在一些示例中，隐私中心模块1801具体用于：根据隐私配置文件，通过显示界面向用户呈现隐私配置选项，隐私配置选项用于用户选择以下至少一项：是否授权业务调用至少一个服务的数据、是否授权业务调用至少一个其它业务的数据；获取用户对隐私配置选项的选择结果；以及根据选择结果，获取隐私策略文件。
在一些示例中，隐私中心模块1801具体用于：从隐私配置文件中获取第一业务对应的隐私声明文件；通过显示界面向用户呈现第一业务对应的隐私声明文件。
在一些示例中，隐私配置文件中包括隐私分级信息，隐私分级信息用于指示不同服务标识对应的数据的隐私等级，其中，服务标识是指示数据的提供方的标识。
在一些示例中，隐私分级信息使用量化数值区分数据的隐私等级。
在一些示例中，第一配置信息包括以下至少一项：指示允许提供数据的服务的服务标识和允许采集数据的业务的客户标识之间的第一关联关系的信息；指示允许提供共享数据的业务的服务标识和允许获取共享数据的业务的客户标识之间的第二关联关系的信息；其中，客户标识是指示数据的调用方的标识，服务标识是指示数据的提供方的标识。
在一些示例中，第二配置信息包括以下至少一项：允许采集数据的业务的客户标识；允许向车外传输数据的业务的客户标识或进程标识；允许提供数据的服务的服务标识；允许提供共享数据的业务的服务标识；其中，客户标识是指示数据的调用方的标识，服务标识是指示数据的提供方的标识，进程标识是业务作为进程运行时的标识。
在一些示例中，隐私配置文件中包括以下至少一项：定义业务的标识；定义服务的标识；定义不同数据生命周期阶段的标识；指示业务和服务之间的关联关系的信息；指示业务和业务之间的关联关系的信息。
在一些示例中，定义业务的标识包括以下至少一项：在不同数据生命周期阶段定义业务的标识；在不同通信协议中定义业务的标识；定义服务的标识包括以下至少一项：在不同数据生命周期阶段定义服务的标识；在不同通信协议中定义服务的标识。
图19是本申请一实施例提供的装置1900的结构示意图。如图19所示，该装置1900包括处理模块1901、隐私代理模块1902、中间件模块1903，该装置1900可以是前述实施例中的车辆，也可以是车辆的组成部件(如车载设备、域控制器或者芯片)。该装置1900可实现对应于上文方法实施例中的车辆执行的步骤或者流程。
处理模块1901用于向中间件模块1903发送第一请求信息，第一请求信息用于请求为第一业务调用第一数据，第一请求信息中包括第一标识，第一标识包括以下至少一项：第一业务的客户标识、第一业务的进程标识、第一数据的提供方的服务标识，其中，客户标识是指示数据的调用方的标识，服务标识是指示数据的提供方的标识，进程标识是业务作为进程运行时的标识；
中间件模块1903用于向隐私代理模块1902发送第一查询信息，第一查询信息用于查询是否同意为第一业务调用第一数据，第一查询信息中包括第一标识，其中，中间件模块1903被设置为向车载设备中的业务提供基于面向服务架构SOA的接口；
隐私代理模块1902用于向中间件模块1903发送第一响应信息，第一响应信息用于指示是否同意为第一业务调用第一数据，其中，第一响应信息是根据第一标识和隐私策略文件确定的，隐私策略文件包括以下至少一项：第一配置信息，用于指示业务和服务之间的访问权限或者业务与业务之间的访问权限；第二配置信息，用于指示业务的访问权限。
在一些示例中，第一配置信息包括以下至少一项：指示允许提供数据的服务的服务标识和允许采集数据的业务的客户标识之间的第一关联关系的信息；指示允许提供共享 数据的业务的服务标识和允许获取共享数据的业务的客户标识之间的第二关联关系的信息。
在一些示例中，第二配置信息包括以下至少一项：允许采集数据的业务的客户标识；允许向车外传输数据的业务的客户标识或进程标识；允许提供数据的服务的服务标识；允许提供共享数据的业务的服务标识。
在一些示例中，第一业务通过数据采集的方式调用第一数据，第一数据为第一服务的数据，第一标识包括第一业务的客户标识和第一服务的服务标识，隐私代理模块1902具体用于在第一业务的客户标识和第一服务的服务标识属于第一配置信息指示的第一关联关系的情况下，向中间件模块1903发送第一响应信息，第一响应信息用于指示同意为第一业务调用第一数据。
在一些示例中，第一业务通过数据共享的方式调用第一数据，第一数据为第二业务的数据，数据共享的类型为订阅发布，第一标识包括第一业务的客户标识和第二业务的服务标识，
隐私代理模块1902具体用于在第一业务的客户标识和第二服务的服务标识属于第一配置信息指示的第二关联关系的情况下，向中间件模块1903发送第一响应信息，第一响应信息用于指示同意为第一业务调用第一数据。
在一些示例中，第一业务通过以下方式中的任意一种调用第一数据：数据采集、数据向车外传输，第一标识包括第一业务的客户标识或第一业务的进程标识，隐私代理模块1902具体用于在第一标识属于第二配置信息指示的允许访问的范围内的情况下，向中间件模块1903发送第一响应信息，第一响应信息用于指示同意为第一业务调用第一数据。
在一些示例中，第一业务以数据共享的方式调用第一数据，第一数据为第二业务的数据，数据共享的类型为共享广播，第一标识包括第二业务的服务标识；隐私代理模块1902具体用于在第二业务的服务标识属于第二配置信息指示的允许访问的范围内的情况下，向中间件模块1903发送第一响应信息，第一响应信息用于指示同意为第一业务调用第一数据。
图20是本申请一实施例提供的装置2000的结构示意图。如图20所示，该装置2000包括数据存储管理模块2001。可选地，该装置2000还包括处理模块2002和/或隐私代理模块2003，该装置2000可以是前述实施例中的车辆，也可以是车辆的组成部件(如车载设备或者芯片)，也可为设置于云端服务器中的用于存储管理的设备。作为示例，若装置2000为车辆，则装置2000中可以包括数据存储管理模块2001、处理模块2002以及隐私代理模块2003。若装置2000为设置于服务器中的设备，则装置2000中可以包括数据存储管理模块2001以及隐私代理模块2003，而处理模块2002设置于车辆中。应理解，上述各模块也可以存在其它的分布形式，此处不再一一枚举。该装置2000可实现对应于上文方法实施例中的车辆执行的步骤或者流程。
处理模块2002用于向数据存储管理模块2001发送的第一业务的存储请求信息，相应地，数据存储管理模块2001接收处理模块2002发送的存储请求信息。存储请求信息中包括：待存储的第一数据、第一数据的数据标识、存储分级信息，其中，存储分级信息用于指示第一数据的数据标识对应的隐私等级；
数据存储管理模块2001用于存储第一数据；以及在第一数据的存储时长达到留存期之后，删除第一数据，其中，留存期是根据存储分级信息确定的。
在一些示例中，装置2000还包括隐私代理模块2003，数据存储管理模块2001还用于向隐私代理模块2003发送第二查询信息，第二查询信息用于查询第一数据的留存期，第二查询信息中包括第一数据的数据标识以及存储分级信息；隐私代理模块2003用于向数据存储管理模块2001发送第一指示信息，第一指示信息用于指示第一数据的留存期。
在一些示例中，装置2000还包括隐私代理模块2003，数据存储管理模块2001还用于向隐私代理模块2003发送第二查询信息，第二查询信息中包括第一数据的数据标识和存储分级信息；隐私代理模块2003用于根据存储分级信息，确定留存期；以及在第一数据的存储时长达到留存期的情况下，向数据存储管理模块2001发送删除指示信息，删除指示信息用于指示删除第一数据。
在一些示例中，存储请求信息中还包括第一标识，第一标识包括以下至少一项：客户标识和进程标识，其中，客户标识是指示数据的调用方的标识，进程标识是业务作为进程运行时的标识，数据存储管理模块2001还用于根据第一标识，确定第一业务是否具有存储权限；数据存储管理模块2001具体用于在确定第一业务具有存储权限的情况下，将数据落盘。
图21是本申请又一实施例提供的装置2100的示意性框图。该装置2100包括处理器2110，处理器2110用于执行存储器2120存储的计算机程序或指令，或读取存储器2120存储的数据，以执行上文各方法实施例中的方法。可选地，处理器2110为一个或多个。
可选地，如图21所示，该装置2100还包括存储器2120，存储器2120用于存储计算机程序或指令和/或数据。该存储器2120可以与处理器2110集成在一起，或者也可以分离设置。可选地，存储器2120为一个或多个。
可选地，如图21所示，该装置2100还包括通信接口2130，通信接口2130用于信号的接收和/或发送。例如，处理器2110用于控制通信接口2130进行信号的接收和/或发送。
可选地，该装置2100用于实现上文各个方法实施例中设置于车辆或者云端服务器中的各个模块执行的操作。
例如，处理器2110用于执行存储器2120存储的计算机程序或指令，以实现上文各个方法实施例的车辆中的各个模块的相关操作。例如，图6、图7、图11-图17所示实施例中由车辆中的模块执行的方法。
例如，处理器2110用于执行存储器2120存储的计算机程序或指令，以实现上文各个方法实施例的云端服务器的各个模块的相关操作。例如，图6、图7、图11-图17所示实施例中由数据存储管理模块、隐私代理模块执行的方法。
需要指出的是，图21中的装置2100可以是前述实施例中的车辆，也可以是车辆的组成部件(如车载设备或者芯片)，或者是云端服务器，或者云端服务器的组成部件(例如用于存储管理的设备或者芯片)在此不做限定。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术 人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本说明书中使用的术语“部件”、“模块”、“系统”等用于表示计算机相关的实体、硬件、固件、硬件和软件的组合、软件、或执行中的软件。例如，部件可以是但不限于，在处理器上运行的进程、处理器、对象、可执行文件、执行线程、程序和/或计算机。通过图示，在计算设备上运行的应用和计算设备都可以是部件。一个或多个部件可驻留在进程和/或执行线程中，部件可位于一个计算机上和/或分布在2个或更多个计算机之间。此外，这些部件可从在上面存储有各种数据结构的各种计算机可读介质执行。部件可例如根据具有一个或多个数据分组(例如来自与本地系统、分布式系统和/或网络间的另一部件交互的二个部件的数据，例如通过信号与其它系统交互的互联网)的信号通过本地和/或远程进程来通信。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理模块中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以 存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (43)

  1. 一种数据管理方法，其特征在于，所述方法应用于车辆，所述车辆包括隐私中心模块、隐私代理模块和中间件模块，其中，所述隐私中心模块用于实现隐私配置功能，所述隐私代理模块用于实现隐私控制功能，所述中间件模块用于为业务提供基于面向服务架构SOA的接口，所述方法包括：
    所述隐私中心模块获取隐私配置文件；
    所述隐私中心模块根据所述隐私配置文件，获取隐私策略文件，所述隐私策略文件包括以下至少一项：第一配置信息，用于指示业务和服务之间的访问权限或者业务与业务之间的访问权限；第二配置信息，用于指示业务的访问权限；
    所述隐私中心模块向所述隐私代理模块发送所述隐私策略文件，所述隐私策略文件用于所述中间件模块的访问控制。
  2. 如权利要求1所述的方法，其特征在于，所述隐私中心模块根据所述隐私配置文件，获取隐私策略文件，包括：
    所述隐私中心模块根据所述隐私配置文件，通过显示界面向用户呈现隐私配置选项，所述隐私配置选项用于所述用户选择以下至少一项：是否授权业务调用至少一个服务的数据、是否授权所述业务调用至少一个其它业务的数据；
    所述隐私中心模块获取所述用户对所述隐私配置选项的选择结果；
    所述隐私中心模块根据所述选择结果，获取所述隐私策略文件。
  3. 如权利要求1或2所述的方法，其特征在于，所述隐私配置文件中包括隐私分级信息，所述隐私分级信息用于指示不同服务标识对应的数据的隐私等级，其中，所述服务标识是指示数据的提供方的标识。
  4. 如权利要求3所述的方法，其特征在于，所述隐私分级信息使用量化数值区分数据的隐私等级。
  5. 如权利要求1至4中任一项所述的方法，其特征在于，所述第一配置信息包括以下至少一项：
    指示允许提供数据的服务的服务标识和允许采集数据的业务的客户标识之间的第一关联关系的信息；
    指示允许提供共享数据的业务的服务标识和允许获取共享数据的业务的客户标识之间的第二关联关系的信息；
    其中，所述客户标识是指示数据的调用方的标识，所述服务标识是指示数据的提供方的标识。
  6. 如权利要求1至5中任一项所述的方法，其特征在于，所述第二配置信息包括以下至少一项：
    允许采集数据的业务的客户标识；
    允许向车外传输数据的业务的客户标识或进程标识；
    允许提供数据的服务的服务标识；
    允许提供共享数据的业务的服务标识；
    其中，所述客户标识是指示数据的调用方的标识，所述服务标识是指示数据的提供方的标识，所述进程标识是业务作为进程运行时的标识。
  7. 如权利要求1至6中任一项所述的方法，其特征在于，所述隐私配置文件中包括以下至少一项：
    定义业务的标识；
    定义服务的标识；
    定义不同数据生命周期阶段的标识；
    指示业务和服务之间的关联关系的信息；
    指示业务和业务之间的关联关系的信息。
  8. 如权利要求7中任一项所述的方法，其特征在于，所述定义业务的标识包括以下至少一项：在不同数据生命周期阶段业务的标识；在不同通信协议中定义业务的标识；
    所述定义服务的标识包括以下至少一项：在不同数据生命周期阶段定义服务的标识；在不同通信协议中定义服务的标识。
  9. 一种数据管理方法，其特征在于，所述方法应用于车辆，所述车辆中包括处理模块、隐私代理模块、中间件模块，其中，所述处理模块用于处理业务，所述隐私代理模块用于实现隐私控制功能，所述中间件模块用于为业务提供基于面向服务架构SOA的接口，所述方法包括：
    所述处理模块向所述中间件模块发送第一请求信息，所述第一请求信息用于请求为第一业务调用第一数据，所述第一请求信息中包括第一标识，所述第一标识包括以下至少一项：所述第一业务的客户标识、所述第一业务的进程标识、所述第一数据的服务标识，其中，所述客户标识是指示数据的调用方的标识，所述服务标识是指示数据的提供方的标识，所述进程标识是业务作为进程运行时的标识；
    所述中间件模块向所述隐私代理模块发送第一查询信息，所述第一查询信息用于查询是否同意为所述第一业务调用所述第一数据，所述第一查询信息中包括所述第一标识；
    所述隐私代理模块向所述中间件模块发送第一响应信息，所述第一响应信息用于指示是否同意为所述第一业务调用所述第一数据，其中，所述第一响应信息是根据所述第一标识和隐私策略文件确定的，所述隐私策略文件包括以下至少一项：第一配置信息，用于指示业务和服务之间的访问权限或者业务与业务之间的访问权限；第二配置信息，用于指示业务的访问权限。
  10. 如权利要求9所述的方法，其特征在于，所述第一配置信息包括以下至少一项：
    指示允许提供数据的服务的服务标识和允许采集数据的业务的客户标识之间的第一关联关系的信息；
    指示允许提供共享数据的业务的服务标识和允许获取共享数据的业务的客户标识之间的第二关联关系的信息。
  11. 如权利要求9或10所述的方法，其特征在于，所述第二配置信息包括以下至少一项：
    允许采集数据的业务的客户标识；
    允许向车外传输数据的业务的客户标识或进程标识；
    允许提供数据的服务的服务标识；
    允许提供共享数据的业务的服务标识。
  12. 如权利要求10所述的方法，其特征在于，所述第一业务通过数据采集的方式调用所述第一数据，所述第一数据为第一服务的数据，所述第一标识包括所述第一业务的客户标识和所述第一服务的服务标识，
    所述隐私代理模块向所述中间件模块发送第一响应信息，包括：
    所述隐私代理模块在所述第一业务的客户标识和所述第一服务的服务标识属于所述第一配置信息指示的所述第一关联关系的情况下，向所述中间件模块发送所述第一响应信息，所述第一响应信息用于指示同意为所述第一业务调用所述第一数据。
  13. 如权利要求10所述的方法，其特征在于，所述第一业务通过数据共享的方式调用所述第一数据，所述第一数据为第二业务的数据，所述数据共享的类型为订阅发布，所述第一标识包括所述第一业务的客户标识和所述第二业务的服务标识，所述方法还包括：
    所述隐私代理模块向所述中间件模块发送第一响应信息，包括：
    所述隐私代理模块在所述第一业务的客户标识和所述第二服务的服务标识属于所述第一配置信息指示的所述第二关联关系的情况下，向所述中间件模块发送所述第一响应信息，所述第一响应信息用于指示同意为所述第一业务调用所述第一数据。
  14. 如权利要求11所述的方法，其特征在于，所述第一业务通过以下方式中的任意一种调用所述第一数据：数据采集、数据向车外传输，所述第一标识包括所述第一业务的客户标识或所述第一业务的进程标识，
    所述隐私代理模块向所述中间件模块发送第一响应信息，包括：
    所述隐私代理模块在所述第一标识属于所述第二配置信息指示的允许访问的范围内的情况下，向所述中间件模块发送所述第一响应信息，所述第一响应信息用于指示同意为所述第一业务调用所述第一数据。
  15. 如权利要求11所述的方法，其特征在于，所述第一业务以数据共享的方式调用所述第一数据，所述第一数据为第二业务的数据，所述数据共享的类型为共享广播，所述第一标识包括所述第二业务的服务标识；
    所述隐私代理模块向所述中间件模块发送第一响应信息，包括：
    所述隐私代理模块在所述第二业务的服务标识属于所述第二配置信息指示的允许访问的范围内的情况下，向所述中间件模块发送所述第一响应信息，所述第一响应信息用于指示同意为所述第一业务调用所述第一数据。
  16. 一种数据管理方法，其特征在于，所述方法包括：
    数据存储管理模块从处理模块接收第一业务的存储请求信息，所述存储请求信息中包括：待存储的第一数据、所述第一数据的数据标识、存储分级信息，其中，所述存储分级信息用于指示所述第一数据的数据标识对应的隐私等级，其中，所述处理模块设置于车辆中，所述数据存储管理模块用于实现数据的存储管理功能，所述处理模块用于处理业务；
    所述数据存储管理模块存储所述第一数据；
    所述数据存储管理模块在所述第一数据的存储时长达到留存期之后，删除所述第一 数据，其中，所述留存期是根据所述存储分级信息确定的。
  17. 如权利要求16所述的方法，其特征在于，所述方法还包括：
    所述数据存储管理模块向隐私代理模块发送第二查询信息，所述第二查询信息用于查询所述第一数据的留存期，所述第二查询信息中包括所述第一数据的数据标识以及所述存储分级信息，所述隐私代理模块用于实现隐私控制功能；
    所述隐私代理模块向所述数据存储管理模块发送第一指示信息，所述第一指示信息用于指示所述第一数据的留存期。
  18. 如权利要求16所述的方法，其特征在于，所述方法还包括：
    所述数据存储管理模块向隐私代理模块发送第二查询信息，所述第二查询信息中包括所述第一数据的数据标识和所述存储分级信息，所述隐私代理模块用于实现隐私控制功能；
    所述隐私代理模块根据所述存储分级信息，确定所述留存期；
    在所述第一数据的存储时长达到所述留存期的情况下，所述隐私代理模块向所述数据存储管理模块发送删除指示信息，所述删除指示信息用于指示删除所述第一数据。
  19. 如权利要求16至18中任一项所述的方法，其特征在于，所述数据存储管理模块设置于所述车辆中。
  20. 一种车载设备，其特征在于，所述车载设备包括隐私中心模块、隐私代理模块和中间件模块，
    所述隐私中心模块用于获取隐私配置文件；根据所述隐私配置文件，获取隐私策略文件，所述隐私策略文件包括以下至少一项：第一配置信息，用于指示业务和服务之间的访问权限或者业务与业务之间的访问权限；第二配置信息，用于指示业务的访问权限；以及向所述隐私代理模块发送所述隐私策略文件，所述隐私策略文件用于所述中间件模块的访问控制，其中所述中间件模块被配置为向业务提供基于面向服务架构SOA的接口。
  21. 如权利要求20所述的车载设备，其特征在于，所述隐私中心模块具体用于：根据所述隐私配置文件，通过显示界面向用户呈现隐私配置选项，所述隐私配置选项用于所述用户选择以下至少一项：是否授权业务调用至少一个服务的数据、是否授权所述业务调用至少一个其它业务的数据；获取所述用户对所述隐私配置选项的选择结果；以及根据所述选择结果，获取所述隐私策略文件。
  22. 如权利要求20或21所述的车载设备，其特征在于，所述隐私配置文件中包括隐私分级信息，所述隐私分级信息用于指示不同服务标识对应的数据的隐私等级，其中，所述服务标识是指示数据的提供方的标识。
  23. 如权利要求22所述的方法，其特征在于，所述隐私分级信息使用量化数值区分数据的隐私等级。
  24. 如权利要求20至23中任一项所述的车载设备，其特征在于，所述第一配置信息包括以下至少一项：
    指示允许提供数据的服务的服务标识和允许采集数据的业务的客户标识之间的第一关联关系的信息；
    指示允许提供共享数据的业务的服务标识和允许获取共享数据的业务的客户标识之 间的第二关联关系的信息；
    其中，所述客户标识是指示数据的调用方的标识，所述服务标识是指示数据的提供方的标识。
  25. 如权利要求20至24中任一项所述的车载设备，其特征在于，所述第二配置信息包括以下至少一项：
    允许采集数据的业务的客户标识；
    允许向车外传输数据的业务的客户标识或进程标识；
    允许提供数据的服务的服务标识；
    允许提供共享数据的业务的服务标识；
    其中，所述客户标识是指示数据的调用方的标识，所述服务标识是指示数据的提供方的标识，所述进程标识是业务作为进程运行时的标识。
  26. 如权利要求20至25中任一项所述的车载设备，其特征在于，所述隐私配置文件中包括以下至少一项：
    定义业务的标识；
    定义服务的标识；
    定义不同数据生命周期阶段的标识；
    指示业务和服务之间的关联关系的信息；
    指示业务和业务之间的关联关系的信息。
  27. 如权利要求26中任一项所述的车载设备，其特征在于，所述定义业务的标识包括以下至少一项：在不同数据生命周期阶段定义业务的标识；在不同通信协议中定义业务的标识；
    所述定义服务的标识包括以下至少一项：在不同数据生命周期阶段定义服务的标识；在不同通信协议中定义服务的标识。
  28. 一种车载设备，其特征在于，所述车载设备包括处理模块、隐私代理模块、中间件模块，
    所述处理模块用于向所述中间件模块发送第一请求信息，所述第一请求信息用于请求为第一业务调用第一数据，所述第一请求信息中包括第一标识，所述第一标识包括以下至少一项：所述第一业务的客户标识、所述第一业务的进程标识、所述第一数据的提供方的服务标识，其中，所述客户标识是指示数据的调用方的标识，所述服务标识是指示数据的提供方的标识，所述进程标识是业务作为进程运行时的标识；
    所述中间件模块用于向所述隐私代理模块发送第一查询信息，所述第一查询信息用于查询是否同意为所述第一业务调用所述第一数据，所述第一查询信息中包括所述第一标识，其中，所述中间件模块被设置为向所述车载设备中的业务提供基于面向服务架构SOA的接口；
    所述隐私代理模块用于向所述中间件模块发送第一响应信息，所述第一响应信息用于指示是否同意为所述第一业务调用所述第一数据，其中，所述第一响应信息是根据所述第一标识和隐私策略文件确定的，所述隐私策略文件包括以下至少一项：第一配置信息，用于指示业务和服务之间的访问权限或者业务与业务之间的访问权限；第二配置信息，用于指示业务的访问权限。
  29. 如权利要求28所述的车载设备，其特征在于，所述第一配置信息包括以下至少一项：
    指示允许提供数据的服务的服务标识和允许采集数据的业务的客户标识之间的第一关联关系的信息；
    指示允许提供共享数据的业务的服务标识和允许获取共享数据的业务的客户标识之间的第二关联关系的信息。
  30. 如权利要求28或29所述的车载设备，其特征在于，所述第二配置信息包括以下至少一项：
    允许采集数据的业务的客户标识；
    允许向车外传输数据的业务的客户标识或进程标识；
    允许提供数据的服务的服务标识；
    允许提供共享数据的业务的服务标识。
  31. 如权利要求29所述的车载设备，其特征在于，所述第一业务通过数据采集的方式调用所述第一数据，所述第一数据为第一服务的数据，所述第一标识包括所述第一业务的客户标识和所述第一服务的服务标识，
    所述隐私代理模块具体用于在所述第一业务的客户标识和所述第一服务的服务标识属于所述第一配置信息指示的所述第一关联关系的情况下，向所述中间件模块发送所述第一响应信息，所述第一响应信息用于指示同意为所述第一业务调用所述第一数据。
  32. 如权利要求29所述的车载设备，其特征在于，所述第一业务通过数据共享的方式调用所述第一数据，所述第一数据为第二业务的数据，所述数据共享的类型为订阅发布，所述第一标识包括所述第一业务的客户标识和所述第二业务的服务标识，
    所述隐私代理模块具体用于在所述第一业务的客户标识和所述第二服务的服务标识属于所述第一配置信息指示的所述第二关联关系的情况下，向所述中间件模块发送所述第一响应信息，所述第一响应信息用于指示同意为所述第一业务调用所述第一数据。
  33. 如权利要求30所述的车载设备，其特征在于，所述第一业务通过以下方式中的任意一种调用所述第一数据：数据采集、数据向车外传输，所述第一标识包括所述第一业务的客户标识或所述第一业务的进程标识，
    所述隐私代理模块具体用于在所述第一标识属于所述第二配置信息指示的允许访问的范围内的情况下，向所述中间件模块发送所述第一响应信息，所述第一响应信息用于指示同意为所述第一业务调用所述第一数据。
  34. 如权利要求30所述的车载设备，其特征在于，所述第一业务以数据共享的方式调用所述第一数据，所述第一数据为第二业务的数据，所述数据共享的类型为共享广播，所述第一标识包括所述第二业务的服务标识；
    所述隐私代理模块具体用于在所述第二业务的服务标识属于所述第二配置信息指示的允许访问的范围内的情况下，向所述中间件模块发送所述第一响应信息，所述第一响应信息用于指示同意为所述第一业务调用所述第一数据。
  35. 一种用于数据管理的设备，其特征在于，包括：
    数据存储管理模块，所述数据存储管理模块用于从处理模块接收第一业务的存储请求信息，所述存储请求信息中包括：待存储的第一数据、所述第一数据的数据标识、存 储分级信息，其中，所述存储分级信息用于指示所述第一数据的数据标识对应的隐私等级，其中，所述处理模块设置于车辆中，所述数据存储管理模块用于实现数据的存储管理功能，所述处理模块用于处理业务；
    所述数据存储管理模块还用于存储所述第一数据；以及在所述第一数据的存储时长达到留存期之后，删除所述第一数据，其中，所述留存期是根据所述存储分级信息确定的。
  36. 如权利要求35所述的设备，其特征在于，所述设备中还包括隐私代理模块，
    所述数据存储管理模块还用于向所述隐私代理模块发送第二查询信息，所述第二查询信息用于查询所述第一数据的留存期，所述第二查询信息中包括所述第一数据的数据标识以及所述存储分级信息；
    所述隐私代理模块用于向所述数据存储管理模块发送第一指示信息，所述第一指示信息用于指示所述第一数据的留存期。
  37. 如权利要求35所述的设备，其特征在于，所述设备中还包括隐私代理模块，
    所述数据存储管理模块还用于向所述隐私代理模块发送第二查询信息，所述第二查询信息中包括所述第一数据的数据标识和所述存储分级信息；
    所述隐私代理模块用于根据所述存储分级信息，确定所述留存期；以及在所述第一数据的存储时长达到所述留存期的情况下，向所述数据存储管理模块发送删除指示信息，所述删除指示信息用于指示删除所述第一数据。
  38. 如权利要求35至37中任一项所述的设备，其特征在于，所述设备为所述车辆。
  39. 一种车载设备，其特征在于，包括处理器，所述处理器用于从存储器调用计算机程序，当所述计算机程序被执行时，所述处理器用于执行如权利要求1至8中任一项所述的方法，或者用于执行如权利要求9至15中任一项所述的方法。
  40. 一种用于数据管理的设备，其特征在于，包括处理器，所述处理器用于从存储器调用计算机程序，当所述计算机程序被执行时，所述处理器用于执行如权利要求16至19中任一项所述的方法。
  41. 一种车辆，其特征在于，包括如权利要求20至27中任一项所述的车载设备，或者包括如权利要求28至34中任一项所述的车载设备，或者包括如权利要求35至38中任一项所述的用于数据管理的设备。
  42. 一种计算机可读存储介质，其特征在于，用于存储计算机程序，所述计算机程序包括用于执行权利要求1至8中任一项所述的方法的代码，或者包括用于执行如权利要求9至15中任一项所述的方法的代码,或者包括用于执行如权利要求16至19中任一项所述的方法的代码。
  43. 一种计算机程序产品，其特征在于，所述计算机程序产品包括用于执行权利要求1至8中任一项所述的方法的代码，或者包括用于执行如权利要求9至15中任一项所述的方法的代码,或者包括用于执行如权利要求16至19中任一项所述的方法的代码。
PCT/CN2021/144004 2021-12-31 2021-12-31 数据管理方法及装置 WO2023123493A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
CN202180046943.6A CN116686307A (zh) 2021-12-31 2021-12-31 数据管理方法及装置
PCT/CN2021/144004 WO2023123493A1 (zh) 2021-12-31 2021-12-31 数据管理方法及装置

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/CN2021/144004 WO2023123493A1 (zh) 2021-12-31 2021-12-31 数据管理方法及装置

Publications (1)

Publication Number Publication Date
WO2023123493A1 true WO2023123493A1 (zh) 2023-07-06

Family

ID=86997213

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/144004 WO2023123493A1 (zh) 2021-12-31 2021-12-31 数据管理方法及装置

Country Status (2)

Country Link
CN (1) CN116686307A (zh)
WO (1) WO2023123493A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116913132A (zh) * 2023-09-12 2023-10-20 武汉理工大学 基于域集中式架构的前向碰撞预警系统

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105531980A (zh) * 2013-07-25 2016-04-27 康维达无线有限责任公司 服务层设备位置管理和隐私控制
WO2017166689A1 (zh) * 2016-03-31 2017-10-05 宇龙计算机通信科技(深圳)有限公司 一种隐私保护的方法及装置
CN107347114A (zh) * 2017-06-21 2017-11-14 努比亚技术有限公司 语音信息收发控制方法及终端
CN109639758A (zh) * 2018-10-31 2019-04-16 中国科学院信息工程研究所 内容中心网络中用户行为隐私的保护方法及装置
CN112219383A (zh) * 2018-06-07 2021-01-12 康维达无线有限责任公司 用于服务订户的隐私的数据匿名化

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN105531980A (zh) * 2013-07-25 2016-04-27 康维达无线有限责任公司 服务层设备位置管理和隐私控制
WO2017166689A1 (zh) * 2016-03-31 2017-10-05 宇龙计算机通信科技(深圳)有限公司 一种隐私保护的方法及装置
CN107347114A (zh) * 2017-06-21 2017-11-14 努比亚技术有限公司 语音信息收发控制方法及终端
CN112219383A (zh) * 2018-06-07 2021-01-12 康维达无线有限责任公司 用于服务订户的隐私的数据匿名化
CN109639758A (zh) * 2018-10-31 2019-04-16 中国科学院信息工程研究所 内容中心网络中用户行为隐私的保护方法及装置

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116913132A (zh) * 2023-09-12 2023-10-20 武汉理工大学 基于域集中式架构的前向碰撞预警系统
CN116913132B (zh) * 2023-09-12 2024-01-09 武汉理工大学 基于域集中式架构的前向碰撞预警系统

Also Published As

Publication number Publication date
CN116686307A (zh) 2023-09-01

Similar Documents

Publication Publication Date Title
US20230298398A1 (en) System, method, and apparatus for managing vehicle data collection
CN110618671B (zh) 空中（ota）移动服务平台
US8793359B1 (en) Systems and/or methods for intelligently detecting API key domains
US10216485B2 (en) Computer platform for development and deployment of sensor data based applications and services
CN107729139B (zh) 一种并发获取资源的方法和装置
CN110933187A (zh) 基于区块链共识加密机制的物联网数据传输系统
CN115443637A (zh) 用于管理车辆数据收集的系统、方法和装置
US10033695B2 (en) Reducing data connections for transmitting secured data
Gao et al. Big data sensing and service: A tutorial
US20160149854A1 (en) Framework for Application to Application Interworking in the M2M World
WO2023123493A1 (zh) 数据管理方法及装置
CN114254336A (zh) 用于通过使用边界标签来实施数据边界的方法、装置和系统
US11379416B1 (en) Systems and methods for common data ingestion
JP7458377B2 (ja) フォグベースのデータ処理を有効にするためのデータサンプルテンプレート（Ｄａｔａ Ｓａｍｐｌｅ Ｔｅｍｐｌａｔｅ：ＤＳＴ）管理
WO2020114310A1 (en) Method, network node and network for recording and providing data,
CN112084247B (zh) 一种应用程序服务扩展的方法和装置
CN110880099B (zh) 基于工作流引擎的任务事件处理方法、装置、设备和介质
CN113986965A (zh) 一种基于监控运维系统的数据处理方法和监控运维系统
Rocha et al. CNS-AOM: design, implementation and integration of an architecture for orchestration and management of cloud-network slices
Casola et al. An SLA-based approach to manage sensor networks as-a-service
Pradhan et al. Generic architecture for edge computing based on SPF for military HADR operations
Manasseh et al. Middleware for cooperative vehicle-infrastructure systems
CN116244359B (zh) 一种试验数据汇聚装置、方法及设备
Serón Esnal A novel Edge Computing framework for automotive data processing
Yan et al. A Dispatch Method of Complex Information System Based on Service-Oriented Architecture

Legal Events

Date Code Title Description
WWE Wipo information: entry into national phase

Ref document number: 202180046943.6

Country of ref document: CN

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 21969836

Country of ref document: EP

Kind code of ref document: A1