Centralized charging platform cloud dynamic key distribution mechanism

Abstract

The invention discloses a cloud dynamic key distribution mechanism for a centralized charging platform, and the core of the mechanism is that a key is dynamically generated and distributed through an authentication center to ensure that a unique key is used in each communication, so that the safety is greatly improved. Compared with a traditional static secret key, the risk of secret key leakage is greatly reduced due to the fact that even if the secret key is intercepted in certain communication, the secret key cannot be used in the subsequent communication process, the core of the mechanism is that the secret key is dynamically generated and distributed through the authentication center so that it can be ensured that the unique secret key is used in each communication, and the communication efficiency is improved. Therefore, the safety is greatly improved. Compared with a traditional static secret key, the risk of secret key leakage is greatly reduced due to the fact that even if the secret key is intercepted in certain communication, the secret key cannot be used for the subsequent communication process.

Description

Technical Field

[0001] The present invention relates to the field of centralized charging platform security verification technology, and in particular to a centralized charging platform cloud dynamic key distribution method, system, computer equipment and computer-readable storage medium. Background Art

[0002] With the popularization of smart charging devices and the rapid development of charging networks, the security issues of data interaction between charging devices and operating platforms have become increasingly prominent. Although the current security verification mechanisms in the industry are diverse, including but not limited to symmetric encryption of software data, ESAM (Embedded Secure Access Module) chip encryption, etc., these mechanisms face many challenges in practical applications. Especially in the aspects of business interaction and protocol docking with different manufacturers, existing security measures are often difficult to adapt to the changing external environment and often expose security vulnerabilities. These vulnerabilities may be exploited by internal personnel, who can easily intercept or tamper with data, seriously threatening user data security and enterprise operation security. Summary of the invention

[0003] In order to overcome the shortcomings of the existing technology, a centralized charging platform cloud dynamic key distribution mechanism is proposed, which specifically includes:

[0004] A centralized charging platform cloud dynamic key distribution method includes an authentication center and multiple operating platforms and multiple charging devices communicating with the authentication center; the operating platforms and the charging devices are pre-configured with an encryption public key distributed by the authentication center;

[0005] Before initiating a data message requiring key encryption, either the operation platform or the charging device first requests a temporary session key from the authentication center through the encryption public key, and communicates with the other party after obtaining the temporary session key;

[0006] Among them, the temporary session key is valid only for one communication or a preset time period; before the party initiating the communication obtains the temporary session key, the authentication center performs multiple layers of verification on the party initiating the communication, and sends an encryption suite with a preset time limit to it after the multiple layers of verification are successful; the encryption suite is used to encrypt and decrypt data transmitted by the communicating parties.

[0007] A centralized charging platform cloud-based dynamic key distribution system comprises an authentication center and multiple operating platforms and multiple charging devices that communicate with the authentication center; the centralized charging platform cloud-based dynamic key distribution system uses the centralized charging platform cloud-based dynamic key distribution method as described above during operation.

[0008] A computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned centralized charging platform cloud dynamic key distribution method when executing the computer program.

[0009] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned centralized charging platform cloud dynamic key distribution method are implemented.

[0010] The core of the centralized charging platform cloud dynamic key distribution mechanism provided by the present invention is to dynamically generate and distribute keys through an authentication center to ensure that a unique key is used for each communication, thereby greatly improving security.

[0011] The authentication center of the present invention plays the role of a key manager, which is responsible for generating keys, distributing keys, and revoking keys after the key usage period ends. Before the device and the platform communicate, they first request a temporary session key from the authentication center. This session key is only valid for one communication or a preset period of time, and is discarded after the communication ends. In this way, even if an attacker intercepts the communication content, he cannot use the intercepted key to perform subsequent illegal operations.

[0012] In addition, the authentication center also has a multi-layer verification mechanism to ensure that only authorized devices and platforms can obtain keys and communicate. This includes but is not limited to device identity verification, operation permission verification, and timestamp verification. These verification steps further strengthen the security of the system and ensure that only legitimate requests can be responded to.

[0013] Compared with the existing technology, the use of dynamic keys greatly reduces the risk of key leakage, because even if the key is intercepted in a certain communication, it cannot be used in the subsequent communication process. At the same time, the platform and device software only need to add a small amount of code to achieve seamless integration with the existing system. This lightweight integration method not only reduces the implementation cost, but also ensures the compatibility and stability of the system. In this way, the security level of the entire interaction process between the charging equipment and the operation platform can be smoothly improved, effectively preventing potential security threats and ensuring the security and reliability of data transmission. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 It is a framework diagram of a centralized charging platform cloud dynamic key distribution system in an embodiment of the present invention;

[0015] Figure 2 A flowchart of an authentication center generating an encryption suite in an embodiment of the present invention;

[0016] Figure 3Flow chart of the cloud-based dynamic key distribution mechanism of a centralized charging platform in an embodiment of the present invention. DETAILED DESCRIPTION

[0017] In order to make the technical problems, technical solutions and beneficial effects to be solved by the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0018] The present invention proposes a centralized charging platform cloud-based dynamic key distribution mechanism, which aims to provide a more secure and flexible verification method for the communication between charging equipment and the operation platform; the core of the mechanism lies in the dynamic generation and update of keys to ensure that each communication uses a unique key, thereby greatly improving the difficulty of cracking and the cost of attack.

[0019] Specifically, the key usage process mainly includes the following parts:

[0020] 1. Key generation: Generate a one-time key based on the timestamp and unique identifier of the charging device, combined with the high-precision random number generator of the authentication center.

[0021] 2. Key distribution: The key is transmitted from the authentication center to the charging equipment and operation platform through a secure channel to ensure that the key is not intercepted or tampered with during the transmission process.

[0022] 3. Key update: The key becomes invalid after being used once. The authentication center will generate a new key before each communication to ensure the security of communication.

[0023] 4. Security verification: Before the two communicating parties exchange data, two-way verification is performed using a key to ensure the legitimacy of the identities of both parties and the integrity of the data.

[0024] 5. Exception handling: The authentication center system will monitor the communication status in real time. Once abnormal behavior or key usage errors are detected, the security response mechanism will be immediately activated, including but not limited to locking the device, cutting off communications, recording logs, etc.

[0025] In order to realize the above-mentioned cloud-based dynamic key distribution mechanism, only a small amount of code needs to be added to the operating platform and charging equipment software to achieve seamless integration with the existing system. The implementation mainly includes the following steps: 1) Add the "Authentication Center" domain name and platform public key configuration to the existing equipment; 2) The operating platform and charging equipment only need to issue restful requests according to the rules at regular intervals to obtain the latest key. At the same time, the above-mentioned communication protocol and other logic codes do not need to be modified.

[0026] Therefore, the technical solution provided by the present invention is expected to achieve the following effects:

[0027] 1. Significantly improve the communication security level and effectively prevent data leakage and illegal access.

[0028] 2. Reduce operational risks caused by security vulnerabilities and enhance user trust in the system.

[0029] 3. Improve the flexibility and scalability of the system to adapt to more diverse security needs in the future.

[0030] 4. Reduce potential maintenance costs and legal risks by reducing security vulnerabilities.

[0031] That is, the cloud-based dynamic key distribution mechanism of this centralized charging platform provides an innovative and effective solution for the communication security between charging equipment and the operation platform. Through simple code integration, enhanced protection of the existing system can be achieved, bringing higher security to users and enterprises.

[0032] The process of the cloud-based dynamic key distribution mechanism of this centralized charging platform is as follows: Figure 3 As shown, the authentication entity can be an operating platform or a charging device; the authentication center represents the offline security center management unit that provides the authentication center, and is used to provide cloud servers and other equipment. Note 1 in the figure: The information returned by non-peer device requests is symmetrically encrypted using the request random number according to the registration reservation algorithm. The encrypted information returned by other requests can be directly decrypted using the platform private key. Note 2 in the figure: In non-peer mode, the device only needs to configure the platform public key to request the center, and the peer mode also needs to configure the platform private key (that is, the authentication center treats the device as the same as the platform).

[0033] In one embodiment, a centralized charging platform cloud dynamic key distribution method and system are provided, such as Figure 1 As shown, there are three parties including an authentication center, an operating platform communicating with the authentication center, and a charging device, wherein there can be multiple operating platforms and charging devices.

[0034] As the cloud protocol security center, the authentication center is mainly responsible for dynamic key issuance and management, and publishes relevant cloud API documents. These documents will be publicly available for operation platforms or equipment manufacturers to obtain and implement. Through the cloud API documents, operation platforms and equipment manufacturers can understand how to interact with the security center, how to obtain and use encryption suites, and how to perform other security-related operations.

[0035] Specifically, the authentication center provides a cloud API interface and deploys a cloud dynamic key publishing service. The API interface is a restful API, or authentication API for short, which is used by all parties to dynamically obtain keys, and the platform manages device registration and policy adjustment and other functions. Through the API interface, the operating platform and charging equipment can directly register with the authentication center and become valid users. Alternatively, the charging device registers directly with the operating platform and indirectly registers with the authentication center through the operating platform, that is, the charging device registered under it is managed by the operating platform.

[0036] The registration process of the operation platform is as follows: the cloud dynamic key publishing service receives the registration of the operation platform;

[0037] During the registration process, the operating platform can configure a series of parameters, including but not limited to the selected encryption algorithm, key specifications, and dynamic key distribution strategy. The settings of these parameters will be customized according to the specific needs and security requirements of the operating platform. After successful registration, the certification center will assign a specific platform encryption public key to each operating platform. This public key will be used for subsequent encrypted communications to ensure that only devices with the corresponding private key can decrypt the information, thereby ensuring the security of data transmission.

[0038] The registration process of the charging device is as follows: the cloud dynamic key release service receives the registration from the operating platform; if the operating platform chooses to use the device registration function, the authentication center will be able to verify the legitimacy of the charging device through the registration information; if the operating platform skips the device registration step, the authentication center will regard the charging device and the operating platform as peers, and both parties only need to obtain the communication encryption suite in the same way to ensure the security of communication. After successful registration, the charging device obtains the encryption public key assigned by the authentication center.

[0039] When communicating between operating platforms, between charging devices, or between operating platforms and charging devices, the party initiating the communication first requests a temporary session key from the authentication center through an encrypted public key, and then communicates with the other party after obtaining the temporary session key. The temporary session key is only valid for one communication or a preset period of time, and is discarded after the communication ends. In this way, even if an attacker intercepts the communication content, he cannot use the intercepted key to perform subsequent illegal operations, thereby improving security.

[0040] In addition, the certification center also provides a multi-layer verification mechanism for the party initiating the communication to ensure that only authorized operating platforms and charging devices can obtain keys and communicate. The multi-layer verification mechanism includes but is not limited to device identity verification, operation permission verification, and timestamp verification. These verification steps further strengthen the security of the system and ensure that only legitimate requests can be responded to.

[0041] Corresponding to the multi-layer authentication, the authentication center provides the two communicating parties with an encryption suite with a preset validity period. The process of generating the encryption suite is as follows: Figure 2 As shown, the users to be registered include the application platform and the charging device. These encryption suites will be used to encrypt and decrypt the data in transmission to ensure the security and integrity of the data during transmission. The encryption suite includes but is not limited to the token randomly generated by the authentication center, the symmetric key, the validity and expiration time and other information.

[0042] The encryption suite is initiated by the operating platform and the charging device to the authentication center. The party initiating the communication initiates an encryption suite request to the authentication center. The authentication center performs multi-layer verification on the party initiating the communication, and sends it an encryption suite with a preset validity period after the multi-layer verification is successful. The encryption suite request includes any one or more of the organization code, serial number, pile code, and random number; and the party initiating the communication first encrypts the encryption suite request using the encrypted public key encryption, and then sends it to the authentication center.

[0043] When communication occurs between operating platforms, between charging devices, or between operating platforms and charging devices, the two parties in communication first use a temporary session key to conduct a temporary session. Then the party initiating the communication uses the encryption suite to send data, and the receiving party uses the private key corresponding to the encryption suite to decrypt it. As a result, the entire communication process is equivalent to having double encryption protection.

[0044] For ease of understanding, the interaction process between the operation platform and the certification center is as follows:

[0045] 1. The operation platform needs to confirm the cooperation needs offline with the security center management unit of the certification center, and then register its organization number as a valid user, and then obtain the public key assigned by the certification center.

[0046] 2. The operating platform registers or cancels the charging equipment under its name through the API interface. This step is required for use with a higher security level (non-peer mode).

[0047] 3. The operation platform sends a request for the encryption suite to the certification center to obtain or renew the encryption suite on a regular basis.

[0048] 4. When communicating with the charging device, use the valid symmetric key finally obtained to encrypt and decrypt the data domain.

[0049] After the charging device is registered on the operating platform, the interaction process between it and the certification center is as follows:

[0050] 1. Before the charging equipment is put into operation, the public key assigned to the operation platform by the certification center should be configured in advance.

[0051] 2. The charging device should use the public key to encrypt the serial number, pile number, and request random number, and then send encryption suite requests to the authentication center at regular intervals to obtain encryption suites within a certain period of time.

[0052] 3. If the charging device fails to pass the multi-layer verification and cannot obtain the encryption suite, it means that the operating platform has not registered this device, which can avoid the charging device from constantly logging in to the attack.

[0053] 4. After the charging device obtains the encryption suite, it first uses the request parameter signature as the private key to decrypt the encryption suite, and then encrypts and decrypts the protocol data during communication normally after obtaining a valid symmetric key. Among them, the request parameter signature originally refers to a fixed-length signature generated by a certain algorithm for all request parameters. To simplify the description, the random number generated by the device itself in the parameter can be directly used as the private key.

[0054] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the centralized charging platform cloud dynamic key distribution method in the above embodiment are implemented. To avoid repetition, they are not described here.

[0055] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the centralized charging platform cloud dynamic key distribution method in the above method embodiment is implemented. To avoid repetition, it will not be repeated here.

[0056] In summary, the centralized charging platform cloud-based dynamic key distribution mechanism provided by the present invention can perform centralized security management of various existing communication protocols. Only very little code needs to be added on the platform and device sides to quickly achieve more secure data communication, which can avoid high hardware encryption costs (such as ESAM, etc.) and complex interaction processes.

[0057] The above is an explanation of the present invention to help understand the present invention; however, the implementation mode of the present invention is not limited to the above-mentioned embodiments, and any changes, modifications, substitutions, combinations, and simplifications made without departing from the principles of the present invention should be equivalent replacement methods and are included in the protection scope of the present invention.

Claims

1. A centralized charging platform cloud dynamic key distribution method, characterized in that: It includes an authentication center and a plurality of operation platforms and a plurality of charging devices communicating with the authentication center; the operation platforms and the charging devices are pre-configured with an encryption public key assigned by the authentication center; Before initiating a data message requiring key encryption, either the operation platform or the charging device first requests a temporary session key from the authentication center using the encryption public key, and communicates with the other party after obtaining the temporary session key; Among them, the temporary session key is valid only for one communication or a preset time period; before the party initiating the communication obtains the temporary session key, the authentication center performs multiple layers of verification on the party initiating the communication, and sends an encryption suite with a preset time limit to it after the multiple layers of verification are successful; the encryption suite is used to encrypt and decrypt data transmitted by the communicating parties.

2. The centralized charging platform cloud dynamic key distribution method according to claim 1, characterized in that: The multi-layer verification includes any one or more of identity verification, operation authority verification, and timestamp verification.

3. The centralized charging platform cloud dynamic key distribution method according to claim 1, characterized in that: The encryption suite includes a token or a symmetric key randomly generated by the authentication center.

4. The centralized charging platform cloud dynamic key distribution method according to claim 1, characterized in that: The encryption suite request includes any one or more of an organization code, a serial number, a stub code, and a random number; and the party initiating the communication first encrypts the encryption suite request using the encryption public key encryption, and then sends it to the authentication center.

5. The centralized charging platform cloud dynamic key distribution method according to claim 1, characterized in that: The authentication center provides a cloud API interface; through the API interface, the operation platform and the charging device directly register with the authentication center; or, the charging device directly registers with the operation platform and indirectly registers with the authentication center through the operation platform.

6. A centralized charging platform cloud dynamic key distribution system, characterized in that: It includes an authentication center and multiple operating platforms and multiple charging devices that communicate with the authentication center; the centralized charging platform cloud-based dynamic key distribution system uses the centralized charging platform cloud-based dynamic key distribution method as described in any one of claims 1 to 5 during operation.

7. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the centralized charging platform cloud-based dynamic key distribution method as described in any one of claims 1 to 5 are implemented.

8. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the centralized charging platform cloud-based dynamic key distribution method as described in any one of claims 1 to 5 are implemented.

Images