A method for implementing HAN network management using smart energy meters

Abstract

A method for implementing HAN network management using smart energy meters. This management method uses the smart meter as a gateway to proactively detect newly powered devices, initiate registration inquiries, and complete the registration of new devices. This management method establishes a common registration protocol between the smart meter and home appliances, enabling mutual authentication and service security negotiation between the two. This method enables appliances to automatically access the HAN network upon power-up, without user intervention or other server support. The registration process and all subsequent communications are protected by various security policies.

Description

Technical Field

[0001] The present invention relates to the technical field of smart electric meters, and in particular to a method for implementing HAN network management using smart electric energy meters. Background Art

[0002] At present, the energy crisis is an important issue. All countries are working hard to implement the dual-carbon strategic goals. The management of household electrical appliances, especially high-power load electrical appliances, can provide great support for energy conservation and emission reduction. Smart electricity meters, as energy gateways between power companies and users, can not only measure and settle user loads but also play a greater role. By designing a HAN functional module on the smart electricity meter to specifically manage indoor electrical appliances, the smart electricity meter can provide electricity consumption guidance for indoor electrical appliances based on the real-time data obtained from the background of the power consumption system and certain calculations, quickly find energy-saving options, realize electricity consumption planning, and guide peak shaving and valley filling.

[0003] The intelligence of current electrical appliances is already very mature, but it is still imperfect in terms of networking and data security. Smart devices generally require directional gateway configuration before they can access the HAN network. Smart home devices must have dedicated configuration interfaces, which have high manufacturing costs. In addition, for users, the manual configuration process is complicated and the user experience is poor.

[0004] When smart home devices join the HAN network, there's no strong identity authentication between the gateway and the smart home, making the networking process transparent and vulnerable to attacks. The gateway doesn't provide any management functions for the smart home, only communication functions. It doesn't provide security protection for smart home device communications within the HAN network. Data directly communicated between the smart home and the gateway includes information such as power equipment usage and basic household information. If an attacker attacks the HAN, user privacy information could be leaked. In severe cases, attackers could even illegally control and hijack smart home devices through the HAN, leading to unpredictable consequences.

[0005] Therefore, it is necessary to conduct in-depth research on the networking and data security of electricity meters and smart homes to provide support for the practical promotion and application of HAN network management and contribute to energy conservation and emission reduction. Summary of the Invention

[0006] This invention addresses the interaction issues between users and power companies by proposing a method for implementing HAN network management using smart energy meters. Using the smart meter as a gateway, it proactively detects new powered devices, initiates registration queries, and completes the new device's network registration. This method establishes a common registration protocol between the smart meter and home appliances, enabling mutual authentication and service security negotiation between them. This method enables appliances to automatically access the HAN network upon power-up, without user intervention or other server support. The registration process and all subsequent communications are protected by various security policies.

[0007] The technical solution of the present invention is:

[0008] A method for implementing HAN network management using a smart electric energy meter, the method comprising the following steps:

[0009] S1. The smart meter identifies the device power-on information and initiates a broadcast registration query for the new device;

[0010] S1′, when the new device is a smart device and belongs to the smart meter, the smart device authenticates the smart meter. After confirming that the smart meter is a legitimate gateway, the smart device sends a registration request to the smart meter;

[0011] S2. The smart meter receives the registration request from the smart device, identifies the smart device, selects a key negotiation algorithm, and responds with the selected key negotiation algorithm and the corresponding public key.

[0012] S2′: The smart device verifies the signature of the public key information. After the signature verification is passed, it generates its own public-private key pair for key negotiation, derives the symmetric key used in the registration process, uses the symmetric algorithm and the symmetric key used in the registration process to encrypt the service list and send it to the smart meter.

[0013] S3. The smart meter receives the service list of the smart device, adds the security policy requirements of each service response, and sends it to the smart device;

[0014] S3′: After receiving the service list with security policy requirements in the service reply, the smart device uses the registration process symmetric key and symmetric algorithm to decrypt and save it, derives the application layer symmetric key, and generates a network access confirmation information frame, which is encrypted with the application layer key and sent to the smart meter.

[0015] S4. The smart meter receives the network access information frame, derives the application layer symmetric key, parses the network access information frame, and if decryption is successful, the smart device is added to the HAN network of the smart meter.

[0016] S5. The smart meter manages the smart devices according to the smart device service list.

[0017] Furthermore, step S1 is specifically as follows: after the smart meter recognizes that a device is powered on, it submits the power-on characteristics of the connected device to the HAN management module of the smart meter. The HAN module initiates a broadcast registration query. The steps are as follows:

[0018] S1-1. After the smart meter load identification module identifies that a device is powered on, it submits the power-on time and power-on feature group to the smart meter HAN management module;

[0019] S1-2. After receiving the device power-on signature group, the smart meter HAN management module determines whether the device with the power-on load signature is within the managed HAN network. For new devices that are not recorded, the module encodes them according to the codec protocol used by the home devices and issues a broadcast query.

[0020] Furthermore, the power-on feature group includes: power transition absolute value Power, fundamental current absolute value, and edge feature;

[0021] The broadcast inquiry content includes: command word - registration inquiry; smart meter X509 certificate; power-on time, power-on feature group; digital signature of the power-on time and power-on feature group, and the private key used in the digital signature matches the public key information in the smart meter X509 certificate.

[0022] Furthermore, in step S1′, the registration request content includes the target gateway ID, the smart device X509 certificate, and the key agreement algorithm list;

[0023] If the new device is a non-intelligent device and the smart meter does not receive the registration request, it will resend the request after a period of time. It will stop when no response is received after the preset number of resends.

[0024] If the new device is a smart device, it receives the broadcast query and determines whether the power-on time and power-on feature group in the broadcast query are consistent with its own. If they are consistent, it confirms that it belongs to the smart meter; further verify the legitimacy of the smart meter's X509 certificate, and use the public key in the certificate to verify the signature of the power-on time and power-on feature group. After the verification is passed, the smart device initiates a registration request to the smart meter and goes to S2.

[0025] Furthermore, step S2 is specifically as follows:

[0026] S2-1. The smart meter receives a registration request from a smart device, where the registration request includes a target gateway ID, a smart device X509 certificate, and a key agreement algorithm list.

[0027] S2-2, the smart meter identifies whether the target gateway ID is consistent with the smart meter;

[0028] If they are inconsistent, ignore the request and continue waiting; if they are consistent, continue;

[0029] S2-3. The smart meter verifies the authenticity of the smart device's X509 certificate based on the trust anchor in the internal OTP zone:

[0030] If it is an illegal certificate, ignore the request and continue waiting. Otherwise, parse the user information in the certificate and use it as the unique ID of the smart device.

[0031] S2-4. The smart meter selects a key negotiation algorithm based on the internal algorithm list and the key negotiation algorithm list in the registration request.

[0032] Generate a temporary key pair for key agreement based on the selected key agreement algorithm, and digitally sign the key agreement algorithm and the generated key agreement public key. The private key used in the digital signature matches the public key information in the smart meter's X509 certificate.

[0033] S2-5. The smart meter sends the smart device ID, the smart meter ID, the selected key agreement algorithm, the public key for key agreement, and the digital signature to the smart device.

[0034] Furthermore, step S2′ is specifically as follows:

[0035] S2′-1, the smart device uses the public key in the smart meter certificate to verify the digital signature. If the verification is successful, the device continues; otherwise, the frame information is ignored.

[0036] S2′-2. The smart device generates its own temporary key pair for key negotiation according to the key negotiation algorithm, and calculates the shared key Z using the public key for key negotiation of the smart meter and the private key in its own temporary key pair for key negotiation.

[0037] S2′-3. The smart device uses the shared key Z and the key derivation algorithm specified in the protocol to derive the symmetric key used in the registration process;

[0038] S2′-4. The smart device exports its own service list and encrypts it using a symmetric algorithm and the symmetric key used in the registration process. The service list includes:

[0039] object;

[0040] Actions, including read, write, and execute;

[0041] The security policies required for each service access execution include: one or more of encryption, authentication, and signing;

[0042] S2′-5. The smart device frames the key agreement algorithm, the temporary public key for key agreement, the signature, and the ciphertext service list and sends them to the smart meter.

[0043] Furthermore, S3-1 and the smart meter verify the signature, use their own temporary key negotiation private key and the temporary public key of the smart device for key negotiation, calculate the shared key Z, and use the key derivation algorithm specified in the protocol to obtain the symmetric key used in the registration process. The symmetric key is then used to decrypt the ciphertext service list to obtain the plaintext service list.

[0044] S3-2. The smart meter adds the security policy requirements of each service reply based on the original service list of the smart device, encrypts it using the symmetric key and symmetric algorithm of the registration process, and then frames it and sends it to the smart device.

[0045] Furthermore, step S4 is specifically as follows:

[0046] The smart meter receives the network access information frame encrypted by the application layer and decrypts it using the application layer symmetric key and symmetric algorithm;

[0047] If decryption fails, registration fails;

[0048] If the decryption is successful, the plaintext network access information frame is obtained, the smart device is added to the HAN network, and the smart device information is recorded, including: smart device ID, registration time, power-on feature group, service list with security policy requirements, smart device certificate public key information, and smart device application layer symmetric key information.

[0049] Furthermore, the application layer key includes the application layer encryption key and decryption key. In the key derivation algorithm, HKDF-Extract uses the shared key as input, and HKDF-expand uses the device ID as input. When the device ID is itself, the encryption key is derived, and when the device ID is the other party, the decryption key is derived.

[0050] Furthermore, step S5 is specifically as follows:

[0051] S5-1. When the smart meter receives a service item command for any smart device from the master station, it re-encodes the command and processes it according to the service list security policy requirements before sending it to the smart device.

[0052] S5-2. After receiving the command, the smart device parses and obtains the service item, determines whether the command request sent by the smart meter complies with the security policy requirements, and responds with a security violation response if not. Otherwise, the smart device executes the action and securely processes the response data according to the security policy requirements before sending it to the smart meter.

[0053] S5-3. After receiving the reply from the smart device, the smart meter performs signature verification, data verification, and decryption on the command, and verifies whether the reply meets the security requirements. If it meets the requirements, it replies to the master station. If it is wrong, it reports the corresponding error to the master station.

[0054] S5-4. Data is exchanged between the master station and the user, so that the user can understand and control the smart device in real time.

[0055] Beneficial effects of the present invention:

[0056] The present invention establishes a common registration protocol between smart meters and home appliances, enabling mutual authentication and service security negotiation between the two. This method enables home appliances to automatically enter the HAN network after powering on, without user intervention or support from other servers. The registration process and all subsequent communications are protected by various security policies.

[0057] The smart meter of this invention detects the addition of new devices through load changes and proactively initiates registration inquiries. This overcomes the problem of conventional gateways failing to proactively detect new devices or mistakenly adding devices from other households to the network. The network access process requires no user intervention. A customized registration process enables bidirectional identity authentication between the smart meter and slave devices, as well as symmetric key negotiation during the registration process, ensuring communication security during the registration process. The security level of each slave device's services is negotiated during the registration process, achieving hierarchical protection for various services.

[0058] When using the management method of the present invention, users can interact with the power grid master station and obtain various data or related instructions from slave devices in the HAN network through smart meters, without having to build an additional service platform. In addition, the smart meters monitor the usage of devices in the HAN network in real time. In an emergency, they can turn slave devices on or off and provide timely feedback to users through the master station. The smart meters achieve energy conservation and emission reduction by managing electrical devices in the HAN network.

[0059] Other features and advantages of the present invention will be described in detail in the following detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] The above and other objects, features and advantages of the present invention will become more apparent through a more detailed description of exemplary embodiments of the present invention with reference to the accompanying drawings, wherein like reference numerals generally represent like components throughout the exemplary embodiments of the present invention.

[0061] Figure 1 It is a system block diagram of an embodiment of the present invention.

[0062] Figure 2 This is a flowchart of HAN network management according to an embodiment of the present invention. DETAILED DESCRIPTION

[0063] The preferred embodiment of the present invention will be described in more detail below with reference to the accompanying drawings. Although the preferred embodiment of the present invention is shown in the accompanying drawings, it should be understood that the present invention can be implemented in various forms and should not be limited to the embodiments set forth herein.

[0064] Example 1:

[0065] In this embodiment, if Figure 1 FIG. 1 is a system block diagram of an embodiment of the present invention. The smart energy meter based on HAN network management includes:

[0066] Load identification module: used to identify device power-on information by sensing load changes, and then notify the HAN network management module to initiate a broadcast registration query;

[0067] HAN network management module, which includes the following functions:

[0068] Two-way identity authentication function: used to provide smart meter identity information to smart devices and authenticate smart devices;

[0069] Key negotiation function: used to negotiate the symmetric key of the registration process and the application layer symmetric key with the smart device;

[0070] Service list policy selection function: used to negotiate with smart devices the request and response security policies for each service in the smart device service list.

[0071] Network management function: Add smart devices to the HAN network of smart meters and manage smart devices according to the smart device service list.

[0072] Example 2:

[0073] In this embodiment, if Figure 2 The figure shows the HAN network management flow chart. The method for implementing HAN network management using smart energy meters includes the following steps:

[0074] S1. The smart meter identifies the device power-on information and initiates a broadcast registration query for the new device. Specifically, after the smart meter identifies that a device is powered on, it submits the power-on characteristics of the connected device to the HAN management module of the smart meter. The HAN module initiates a broadcast registration query. The steps are as follows:

[0075] S1-1. After the smart meter load identification module recognizes that a device is powered on, it submits the power-on time and power-on feature group, including the absolute value of power transition, the absolute value of fundamental current, and edge characteristics, to the smart meter HAN management module.

[0076] S1-2. After receiving the device power-on signature group, the smart meter HAN management module determines whether the device with the power-on load signature is within the managed HAN network. For new devices that are not recorded, the module encodes them according to the codec protocol used by the home devices and issues a broadcast query.

[0077] The broadcast inquiry content includes: command word - registration inquiry; smart meter X509 certificate; power-on time, power-on feature group; digital signature of the power-on time and power-on feature group, and the private key used in the digital signature matches the public key information in the smart meter X509 certificate.

[0078] S1′, when the new device is a smart device and belongs to the smart meter, the smart device authenticates the smart meter. After confirming that the smart meter is a legitimate gateway, the smart device sends a registration request to the smart meter, including the target gateway ID, the smart device X509 certificate, and the key negotiation algorithm list;

[0079] If the new device is a non-intelligent device and the smart meter does not receive the registration request, it will resend the request after a period of time. It will stop when no response is received after the preset number of resends.

[0080] If the new device is a smart device, it receives the broadcast query and determines whether the power-on time and power-on feature group in the broadcast query are consistent with its own. If they are consistent, it confirms that it belongs to the smart meter; further verify the legitimacy of the smart meter's X509 certificate, and use the public key in the certificate to verify the signature of the power-on time and power-on feature group. After the verification is passed, the smart device initiates a registration request to the smart meter and goes to S2.

[0081] S2. The smart meter receives the registration request from the smart device, identifies the smart device, selects a key negotiation algorithm, and responds with the selected key negotiation algorithm and the corresponding public key. Specifically:

[0082] S2-1. The smart meter receives a registration request from a smart device, where the registration request includes a target gateway ID, a smart device X509 certificate, and a key agreement algorithm list.

[0083] S2-2, the smart meter identifies whether the target gateway ID is consistent with the smart meter;

[0084] If they are inconsistent, ignore the request and continue waiting; if they are consistent, continue;

[0085] S2-3. The smart meter verifies the authenticity of the smart device's X509 certificate based on the trust anchor in the internal OTP zone:

[0086] If it is an illegal certificate, ignore the request and continue waiting. Otherwise, parse the user information in the certificate and use it as the unique ID of the smart device.

[0087] S2-4. The smart meter selects a key negotiation algorithm based on the internal algorithm list and the key negotiation algorithm list in the registration request. The key negotiation algorithm acquisition steps are as follows: starting from the first algorithm in the smart meter's own algorithm list, the algorithm option of the smart device is matched. If a match is found, it is the optimal key negotiation algorithm. If the first algorithm in the smart meter's own algorithm list has no matching item in the smart device, the second one is used for matching, and the matching is carried out in sequence until the first matching item is obtained, which is the optimal solution.

[0088] Generate a temporary key pair for key agreement based on the selected key agreement algorithm, and digitally sign the key agreement algorithm and the generated key agreement public key. The private key used in the digital signature matches the public key information in the smart meter's X509 certificate.

[0089] S2-5. The smart meter sends the smart device ID, the smart meter ID, the selected key agreement algorithm, the public key for key agreement, and the digital signature to the smart device.

[0090] S2′, the smart device verifies the signature of the public key information. After the signature verification is passed, it generates its own public and private key pair for key negotiation, derives the symmetric key used in the registration process, uses the symmetric algorithm and the symmetric key used in the registration process, encrypts the service list, and sends it to the smart meter. Specifically:

[0091] S2′-1, the smart device uses the public key in the smart meter certificate to verify the digital signature. If the verification is successful, the device continues; otherwise, the frame information is ignored.

[0092] S2′-2. The smart device generates its own temporary key pair for key negotiation according to the key negotiation algorithm, and calculates the shared key Z using the public key for key negotiation of the smart meter and the private key in its own temporary key pair for key negotiation.

[0093] S2′-3, the smart device uses the shared key Z and the key derivation algorithm KDF specified in the protocol to derive the symmetric key used in the registration process;

[0094] S2′-4. The smart device exports its own service list and encrypts it using a symmetric algorithm and the symmetric key used in the registration process. The service list includes:

[0095] object;

[0096] Actions, including read, write, and execute;

[0097] The security policies required for each service access execution include: one or more of encryption, authentication, and signing;

[0098] S2′-5. The smart device frames the key agreement algorithm, the temporary public key for key agreement, the signature, and the ciphertext service list and sends them to the smart meter.

[0099] S3. The smart meter receives the service list of the smart device, adds the security policy requirements of each service response, and sends it to the smart device; specifically:

[0100] S3-1. The smart meter verifies the signature, uses its own temporary key to negotiate the private key and the temporary public key used for key negotiation on the smart device, calculates the shared key Z, and uses the key derivation algorithm KDF specified in the protocol to obtain the symmetric key used in the registration process. It then uses the symmetric key to decrypt the ciphertext service list to obtain the plaintext service list.

[0101] S3-2. The smart meter adds the security policy requirements of each service reply based on the original service list of the smart device, encrypts it using the symmetric key and symmetric algorithm of the registration process, and then frames it and sends it to the smart device.

[0102] S3′: After receiving the service list with security policy requirements in the service reply, the smart device uses the registration process symmetric key and symmetric algorithm to decrypt and save it, derives the application layer symmetric key, and generates a network access confirmation information frame, which is encrypted with the application layer key and sent to the smart meter.

[0103] S4. The smart meter receives the network access information frame, derives the application layer symmetric key, parses the network access information frame, and if decryption is successful, the smart device is added to the HAN network of the smart meter. Specifically:

[0104] The smart meter receives the network access information frame encrypted by the application layer and decrypts it using the application layer symmetric key and symmetric algorithm;

[0105] If decryption fails, registration fails;

[0106] If the decryption is successful, the plaintext network access information frame is obtained, the smart device is added to the HAN network, and the smart device information is recorded, including: smart device ID, registration time, power-on feature group, service list with security policy requirements, smart device certificate public key information, and smart device application layer symmetric key information.

[0107] S5. The smart meter manages the smart devices according to the smart device service list, specifically:

[0108] S5-1. When the smart meter receives a service item (including read, write, and execute) command for any smart device from the master station, it re-encodes the command and processes it according to the security policy requirements of the service list before sending it to the smart device.

[0109] S5-2: After receiving the command, the smart device parses and obtains the service items (including read, write, and execute), and determines whether the command request sent by the smart meter complies with the security policy requirements. If not, it responds with a security violation response. Otherwise, it executes the action and securely processes the response data according to the security policy requirements before sending it to the smart meter.

[0110] S5-3. After receiving the reply from the smart device, the smart meter performs signature verification, data verification, decryption and security analysis on the command, and verifies whether the reply meets the security requirements. If it meets the security requirements, it replies to the master station. If it is wrong, it reports the corresponding error to the master station;

[0111] S5-4. Data is exchanged between the master station and the user, achieving the purpose of the user understanding and controlling the smart device in real time. The above description of various embodiments of the present invention is exemplary and not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments.

[0112] In this embodiment, a symmetric algorithm (the registration process encryption algorithm specified in the protocol, the application layer encryption algorithm specified in the protocol); the registration process symmetric key is derived through the registration process symmetric key derivation algorithm specified in the protocol, and the application layer symmetric key is derived through the application layer symmetric key derivation algorithm specified in the protocol; when the key derivation algorithm is used, HKDF-Extract uses the shared key as input, and HKDF-expand uses the device ID as input. When the device ID is itself, the encryption key is derived, and when the device ID is the other party, the decryption key is derived.

Claims

1. A method for implementing HAN network management using a smart energy meter, characterized in that: The method comprises the following steps: S1. The smart meter identifies the device power-on information and initiates a broadcast registration query for the new device; S1′, when the new device is a smart device and belongs to the smart meter, the smart device authenticates the smart meter. After confirming that the smart meter is a legitimate gateway, the smart device sends a registration request to the smart meter; S2. The smart meter receives the registration request from the smart device, identifies the smart device, selects a key negotiation algorithm, and responds with the selected key negotiation algorithm and the corresponding public key. S2′: The smart device verifies the signature of the public key information. After the signature verification is passed, it generates its own public-private key pair for key negotiation, derives the symmetric key used in the registration process, uses the symmetric algorithm and the symmetric key used in the registration process to encrypt the service list and send it to the smart meter. S3. The smart meter receives the service list of the smart device, adds the security policy requirements of each service response, and sends it to the smart device; S3′: After receiving the service list with the security policy requirements of the service reply, the smart device uses the registration process symmetric key and symmetric algorithm to decrypt and save it, derives the application layer symmetric key, and generates a network access confirmation information frame, which is encrypted with the application layer key and sent to the smart meter. S4. The smart meter receives the network access information frame, derives the application layer symmetric key, parses the network access information frame, and if decryption is successful, the smart device is added to the HAN network of the smart meter. S5. The smart meter manages the smart devices according to the smart device service list.

2. The method for implementing HAN network management using a smart electric energy meter according to claim 1, wherein: Step S1 is as follows: after the smart meter recognizes that a device is powered on, it submits the power-on characteristics of the connected device to the HAN management module of the smart meter. The HAN management module initiates a broadcast registration query. The steps are as follows: S1-1. After the smart meter load identification module identifies that a device is powered on, it submits the power-on time and power-on feature group to the smart meter HAN management module; S1-2. After receiving the device power-on signature group, the smart meter HAN management module determines whether the device is in the managed HAN network. For new devices that are not recorded, the module encodes them according to the codec protocol that is used by home devices and issues a broadcast registration query.

3. The method for implementing HAN network management using a smart electric energy meter according to claim 2, wherein: The power-on feature group includes: power transition absolute value Power, fundamental current absolute value, and edge characteristics; The broadcast registration inquiry content includes: command word-registration inquiry, smart meter X509 certificate, power-on time, power-on feature group, digital signature of the power-on time and power-on feature group, and the private key used in the digital signature matches the public key information in the smart meter X509 certificate.

4. The method for implementing HAN network management using a smart electric energy meter according to claim 3, wherein: In step S1′, the registration request content includes the target gateway ID, the smart device X509 certificate and the key agreement algorithm list; If the new device is a non-intelligent device and the smart meter does not receive the registration request, the smart meter will resend the broadcast registration query after a period of time. It will stop after the preset number of resends have been reached and no response has been received. If the new device is a smart device, it receives the broadcast registration query and determines whether the power-on time and power-on feature group in the broadcast registration query are consistent with its own. If they are consistent, it confirms that it belongs to the smart meter; further verify the legitimacy of the smart meter's X509 certificate, and use the public key in the certificate to verify the signature of the power-on time and power-on feature group. After the verification is passed, the smart device initiates a registration request to the smart meter and goes to S2.

5. The method for implementing HAN network management using a smart electric energy meter according to claim 1, wherein: Step S2 is specifically as follows: S2-1. The smart meter receives a registration request from a smart device, where the registration request includes a target gateway ID, a smart device X509 certificate, and a key agreement algorithm list. S2-2, the smart meter identifies whether the target gateway ID is consistent with the smart meter; If they are inconsistent, ignore the request and continue waiting; if they are consistent, continue; S2-3. The smart meter verifies the authenticity of the smart device's X509 certificate based on the trust anchor in the internal OTP zone: If it is an illegal certificate, ignore the request and continue waiting. Otherwise, parse the user information in the certificate and use it as the unique ID of the smart device. S2-4. The smart meter selects a key negotiation algorithm based on the internal algorithm list and the key negotiation algorithm list in the registration request. Generate a temporary key pair for key agreement based on the selected key agreement algorithm, and digitally sign the key agreement algorithm and the generated key agreement public key. The private key used in the digital signature matches the public key information in the smart meter's X509 certificate. S2-5. The smart meter sends the smart device ID, the smart meter ID, the selected key agreement algorithm, the public key for key agreement, and the digital signature to the smart device.

6. The method for implementing HAN network management using a smart electric energy meter according to claim 1, wherein: Step S2′ is specifically as follows: S2′-1, the smart device uses the public key in the smart meter certificate to verify the digital signature. If the verification is successful, the device continues; otherwise, the frame information is ignored. S2′-2. The smart device generates its own temporary key pair for key negotiation according to the key negotiation algorithm, and calculates the shared key Z using the public key for key negotiation of the smart meter and the private key in its own temporary key pair for key negotiation. S2′-3. The smart device uses the shared key Z and the key derivation algorithm specified in the protocol to derive the symmetric key used in the registration process; S2′-4. The smart device exports its own service list and encrypts it using a symmetric algorithm and the symmetric key used in the registration process. The service list includes: object; Actions, including read, write, and execute; The security policies required for each service access execution include: one or more of encryption, authentication, and signing; S2′-5. The smart device frames the key agreement algorithm, the temporary public key for key agreement, the signature, and the ciphertext service list and sends them to the smart meter.

7. The method for implementing HAN network management using a smart electric energy meter according to claim 1, wherein: S3-1. The smart meter verifies the signature, uses its own temporary key negotiation private key and the temporary public key of the smart device for key negotiation, calculates the shared key Z, and uses the key derivation algorithm specified in the protocol to obtain the symmetric key used in the registration process. It then uses the symmetric key to decrypt the ciphertext service list to obtain the plaintext service list. S3-2. The smart meter adds the security policy requirements of each service reply based on the original service list of the smart device, encrypts it using the symmetric key and symmetric algorithm of the registration process, and then frames it and sends it to the smart device.

8. The method for implementing HAN network management using a smart electric energy meter according to claim 1, wherein: Step S4 is specifically as follows: The smart meter receives the network access information frame encrypted by the application layer and decrypts it using the application layer symmetric key and symmetric algorithm; If decryption fails, registration fails; If the decryption is successful, the plaintext network access information frame is obtained, the smart device is added to the HAN network, and the smart device information is recorded, including: smart device ID, registration time, power-on feature group, service list with security policy requirements, smart device certificate public key information, and smart device application layer symmetric key information.

9. The method for implementing HAN network management using a smart electric energy meter according to claim 8, wherein: Application-layer keys include application-layer encryption keys and decryption keys. In the key derivation algorithm, HKDF-Extract uses the shared key as input, and HKDF-Expand uses the device ID as input. When the device ID is the device itself, the encryption key is derived; when the device ID is the other party's, the decryption key is derived.

10. The method for implementing HAN network management using a smart electric energy meter according to claim 1, wherein: Step S5 is specifically as follows: S5-1. When the smart meter receives a service item command for any smart device from the master station, it re-encodes the command and processes it according to the service list security policy requirements before sending it to the smart device. S5-2. After receiving the command, the smart device parses and obtains the service item, determines whether the command request sent by the smart meter complies with the security policy requirements, and responds with a security violation response if not. Otherwise, the smart device executes the action and securely processes the response data according to the security policy requirements before sending it to the smart meter. S5-3. After receiving the reply from the smart device, the smart meter performs signature verification, data verification, and decryption on the command, and verifies whether the reply meets the security requirements. If it meets the requirements, it replies to the master station. If it is wrong, it reports the corresponding error to the master station. S5-4. Data is exchanged between the master station and the user, so that the user can understand and control the smart device in real time.

Images