Charging interaction authentication method and system, non-volatile storage medium and electronic equipment

Abstract

The invention discloses a charging interaction authentication method and system, a nonvolatile storage medium and electronic equipment. The method comprises the following steps: in response to a charging request sent based on a target account, verifying account identity information of the target account; under the condition that verification of the account identity information is passed, a first random number and a public key are combined to obtain a first secret key, the first random number is selected from a mathematical space where a predetermined generator is located, the predetermined generator is a base point in an elliptical encryption curve, and the public key is generated by the cloud server and shared to the charging pile and the fog server; the fog server and the cloud server cooperatively verify the account identity information; encrypting the account identity information and the fog server identifier by adopting a first key to obtain first encrypted information; and starting charging processing on the target account based on the received charging response information. According to the invention, the technical problem that the charging interaction authentication efficiency is not ideal in the prior art is solved.

Description

Technical Field

[0001] The present invention relates to the field of encryption technology and the field of charging piles, and in particular to a charging interactive authentication system, a non-volatile storage medium and an electronic device. Background Art

[0002] In the context of the booming new energy vehicle industry, charging piles, as an important infrastructure for electric vehicles, have become the focus of users' attention for their safety, convenience and efficiency. With the continuous advancement of technology, the charging pile system has gradually achieved intelligent upgrades. Through user identity authentication, it can ensure that only legitimate users can use the charging piles, which is conducive to combining charging with convenient payment, effectively preventing illegal use and abuse of charging resources, and reducing safety hazards during charging.

[0003] The surge in demand for charging pile networks has increased the complexity of network traffic and potential security risks. In order to protect the charging pile network from attacks and ensure the security verification and privacy protection of user identities, related technologies rely on complex encryption algorithms, which also bring about communication delay issues that cannot be ignored. The complexity of encryption algorithms increases the time cost of data processing, especially in real-time scenarios where electric vehicles and charging piles interact frequently. The increase in communication delay will directly affect user experience and charging efficiency.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide a charging interaction authentication, a system, a non-volatile storage medium and an electronic device, so as to at least solve the technical problem of unsatisfactory charging interaction authentication efficiency existing in the related art.

[0006] According to one aspect of an embodiment of the present invention, a charging interaction method is provided, comprising: verifying the account identity information of the target account based on a charging request sent by a target account, wherein the charging request is used to request charging using a charging pile; when the verification of the account identity information is passed, combining a first random number and a public key to obtain a first key, wherein the first random number is selected in a mathematical space where a predetermined generator is located, the predetermined generator is a base point in an elliptic encryption curve, and the public key is generated by a cloud server and shared with the charging pile and a fog server, the fog server and the cloud server jointly verify the account identity information; using the first key, encrypting the account identity information and a fog server identifier to obtain first encrypted information, wherein the fog server identifier corresponds to the fog server, the fog server is used to encrypt the first encrypted information after receiving the first encrypted information to obtain second encrypted information, and send the second encrypted information to the cloud server, the cloud server is used to send charging response information to the charging pile based on the second encrypted information; based on the received charging response information, start charging processing for the target account.

[0007] Optionally, the verification of the account identity information of the target account includes: based on the account identity information, using a hash algorithm to obtain a first verification identifier; performing modulo processing based on the first verification identifier to obtain a first value to be detected; and when the first value to be detected matches a predetermined verification value, determining that the verification of the account identity information is passed.

[0008] Optionally, the use of the first key to encrypt the account identity information and the fog server identifier to obtain first encrypted information includes: encrypting based on the account identity information, the fog server identifier, and a fuzzy verification factor, using the first key to obtain initial encrypted information, wherein the fuzzy verification factor is generated by the cloud server and sent to the target account; determining a first generator in combination with the first random number and the predetermined generator; based on the first generator, a first timestamp, and an authentication secret value, using a hash algorithm to obtain a first verification value, wherein the authentication secret value is generated by a secret parameter generated by the cloud server in response to an account registration process; generating the first encrypted information based on the initial encryption information, the first generator, the first verification value, and the first timestamp.

[0009] Optionally, the executor of the following processing is the fog server: combining a second random number and the public key to obtain a second key, wherein the second random number is selected in the mathematical space; adding the second random number to the predetermined generator to obtain a second generator; based on the first generator carried in the first encrypted information, the fog server identifier, and the second random number, obtaining intermediate encrypted information; based on the shared key, the second generator, the first check value carried in the first encrypted information, and the second timestamp, using a hash algorithm to obtain a second check value, wherein the shared key is generated by the cloud server and shared by the cloud server and the fog server; based on the second generator, the intermediate encrypted information, the second check value, and the second timestamp, encrypting the first encrypted information to obtain the second encrypted information.

[0010] Optionally, before obtaining the second key by combining the second random number and the public key, the method also includes: verifying whether the first timestamp carried in the first encrypted information belongs to a valid time range; if the first timestamp belongs to the valid time range, allowing the first encrypted information to be processed; if the first timestamp does not belong to the valid time range, discarding the first encrypted information.

[0011] Optionally, the executor of the following processing is the cloud server: using the master key to decrypt the intermediate encrypted information carried in the second encrypted information to obtain the fog server identifier, wherein the master key is used as the basic key for the cloud server to generate keys; determining a third random number corresponding to the fog server identifier, wherein the third random number is determined by the fog server when registering with the cloud server; based on the third random number, the master key, and the fog server identifier, using a hash algorithm to obtain a third verification value; when the third verification value matches the second verification value carried in the second encrypted information, determining that the verification of the fog server corresponding to the fog server identifier has passed; when the verification of the fog server has passed, allowing the second encrypted information to be decrypted.

[0012] Optionally, the method also includes: using the master key to decrypt the account identification information carried in the second encrypted information to obtain decrypted account identity information; verifying whether the decrypted account identity information matches the pre-registration information, wherein the pre-registration information is; and if the account identity information matches the pre-registration information, determining to send charging response information to the charging pile.

[0013] According to another aspect of an embodiment of the present invention, a charging interactive authentication system is provided, including: a charging pile, a fog server, and a cloud server, wherein the charging pile is used to verify the account identity information of the target account based on a charging request sent by the target account, wherein the charging request is used to request charging using the charging pile; when the verification of the account identity information is passed, a first random number and a public key are combined to obtain a first key, wherein the first random number is selected in the mathematical space where a predetermined generator is located, the predetermined generator is a base point in an elliptic encryption curve, the public key is generated by the cloud server and shared with the charging pile and the fog server, and the The fog server and the cloud server cooperate to verify the account identity information; use the first key to encrypt the account identity information and the fog server identifier to obtain first encrypted information, wherein the fog server identifier corresponds to the fog server; the fog server is used to encrypt the first encrypted information after receiving the first encrypted information to obtain second encrypted information, and send the second encrypted information to the cloud server; the cloud server is used to send charging response information to the charging pile based on the second encrypted information; the charging pile is used to start charging processing for the target account based on the received charging response information.

[0014] According to another aspect of an embodiment of the present invention, a non-volatile storage medium is provided, wherein the non-volatile storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing any one of the charging interaction authentication methods.

[0015] According to another aspect of an embodiment of the present invention, an electronic device is provided, comprising: one or more processors and a memory, the memory being used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement any one of the charging interaction authentication methods described.

[0016] In an embodiment of the present invention, the account identity information of the target account is verified by a charging request sent based on the target account, wherein the charging request is used to request charging using a charging pile; when the verification of the account identity information is passed, a first key is obtained by combining a first random number and a public key, wherein the first random number is selected in a mathematical space where a predetermined generator is located, the predetermined generator is a base point in an elliptic encryption curve, and the public key is generated by a cloud server and shared with the charging pile and a fog server, and the fog server and the cloud server collaborate to verify the account identity information; the account identity information and a fog server identifier are encrypted using the first key to obtain first encrypted information, wherein the fog server identifier corresponds to the fog server, and the fog server is used to encrypt the first encrypted information after receiving the first encrypted information to obtain second encrypted information, and send the second encrypted information to the cloud server, and the cloud server is used to send charging response information to the charging pile based on the second encrypted information; based on the received charging response information, the charging process for the target account is started. The purpose of utilizing the computing resources of the fog server to improve the efficiency and security of charging interaction authentication is achieved, and the technical effect of providing low-latency and high-security charging services is realized, thereby solving the technical problem of unsatisfactory charging interaction authentication efficiency existing in related technologies. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0018] Figure 1 is a flowchart of an optional charging interaction authentication method provided according to an embodiment of the present invention;

[0019] Figure 2 is an architecture diagram of an optional charging interaction authentication method provided according to an embodiment of the present invention;

[0020] Figure 3 It is a schematic diagram of account registration of an optional charging interactive authentication method provided according to an embodiment of the present invention;

[0021] Figure 4 It is a schematic diagram of fog server registration of an optional charging interactive authentication method provided according to an embodiment of the present invention;

[0022] Figure 5 is a schematic flow chart of an optional charging interaction authentication method provided according to an embodiment of the present invention;

[0023] Figure 6is a schematic diagram of an optional charging interaction authentication system provided according to an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] For the convenience of description, some nouns or terms involved in the embodiments of the present application are explained below:

[0027] Elliptic Curve Cryptography (ECC) is a public key encryption algorithm based on elliptic curve mathematics. Its main idea is to use the difficulty of discrete logarithm problem on elliptic curve to achieve encryption, decryption and digital signature.

[0028] Generator, in elliptic curve cryptography, refers to a base point on an elliptic curve. By continuously adding this point to itself (i.e., scalar multiplication), all other points on the curve can be "generated". In the practical application of elliptic curve cryptography, the selection of generators is crucial to the security of the system. In addition, generators are also used to generate public and private key pairs.

[0029] Fog Node (FN) is a server device that supports edge computing. It is located at the edge of the edge computing network and cooperates with cloud servers to provide computing, storage and network services. Fog servers achieve efficient data processing and low-latency service response by placing data and computing tasks as close to terminal devices as possible.

[0030] Cloud Server Provider (CSP) is a server located in the cloud and built using virtualization technology. These servers can be remotely accessed and managed over the network to implement various computing tasks and application deployments.

[0031] At present, the identity authentication and privacy protection schemes in the charging pile system network have been studied, including privacy protection authentication, entity authentication, electric vehicle charging batch verification and related physical layer protection. However, many security issues in the charging pile system network have not been well resolved. The most important point is that the introduction of the Internet of Things (IoT) in the charging pile network has led to the need for IP (Internet Protocol Address), which allows traffic transmission between devices. Therefore, the charging pile network is more vulnerable. In order to protect the entire charging pile network, a series of security and privacy requirements such as identity authentication, secure key management, message confidentiality, integrity, anonymity and non-traceability are proposed. In a related technology, a V2G (Vehicle-to-Grid) certificateless ring signcryption privacy protection scheme based on blockchain is proposed to address the data security problem in the V2G network. The scheme uses ring signcryption technology to ensure the anonymity of vehicle users during the service process, the authenticity and integrity of data transmission, and the fairness of transactions. In another related technology, the authenticated key exchange protocol with conditional privacy protection aims to negotiate the session key through secure three-party authentication for subsequent communication between users, while also enabling tracking of malicious vehicles in the system.

[0032] The above-mentioned related technologies have proposed many security protection schemes for charging pile networks, but most of them are based on anonymous encryption. Due to the complexity of the encryption algorithm, this will greatly increase the communication delay between electric vehicles and charging pile systems.

[0033] In response to the above problems, an embodiment of the present invention provides a method embodiment of charging interaction authentication. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0034] Figure 1 is a flowchart of an optional charging interaction authentication method provided according to an embodiment of the present invention. Figure 1 As shown, the method comprises the following steps:

[0035] Step S102, verifying the account identity information of the target account based on the charging request sent by the target account, wherein the charging request is used to request charging using a charging pile;

[0036] It can be understood that based on the charging request sent by the target account, the account identity information is verified to prevent unauthorized access and unauthorized charging behavior.

[0037] Optionally, the executing entity is a charging pile.

[0038] In an optional embodiment, the account identity information of the target account is verified, including: based on the account identity information, using a hash algorithm to obtain a first verification identifier; performing modulo processing based on the first verification identifier to obtain a first value to be detected; when the first value to be detected matches a predetermined check value, determining that the account identity information has been verified.

[0039] It can be understood that the account identity information (such as user name, password, etc.) sent by the target account is obtained, and the account identity information is processed using a hash algorithm. The hash algorithm is a method of transforming an input of any length (through a hash algorithm) into an output of a fixed length. After being processed by the hash algorithm, a fixed-length string is obtained, namely the first verification identifier, which can be regarded as a unique and irreversible identifier of the account identity information. After obtaining the first verification identifier, a modulus process is performed. The modulus operation (usually expressed as mod) is to find the remainder of the division of two numbers, and the result obtained is the first value to be detected. When the first value to be detected matches the predetermined check value, it is determined that the verification of the account identity information has passed. The predetermined check value can be stored in the user smart card. It is generated during the initial configuration of the user registration and is associated with specific account identity information or hash algorithm parameters. The first value to be detected is compared with the stored predetermined check value. If the first value to be detected matches the predetermined check value, the charging pile considers that the verification of the account identity information has passed, and subsequent encryption processing and interaction with the fog server can be performed. In the above manner, the irreversibility of the hash algorithm and the randomness of the modulus operation are combined to increase the security of the account identity information verification.

[0040] Optionally, when the i-th user U i When you need to charge the charging pile system, enter the ID into the charging pile. i PW i (i.e. account identity information), calculate the first verification identifier RID i =h1(ID i ||PW i ), h1 represents the hash algorithm, which is processed by taking the modulus of n i * =RID imod n, the first value to be detected is recorded as V i * , the charging pile verification equation V i * =V i Is it true, where V i is the predetermined calibration value, V i * =V i When established, the charging station confirms that the account identity information has been verified.

[0041] In an optional embodiment, a first key is used to encrypt the account identity information and the fog server identifier to obtain first encrypted information, including: encrypting based on the account identity information, the fog server identifier, and the fuzzy verification factor, using the first key to obtain initial encrypted information, wherein the fuzzy verification factor is generated by the cloud server and sent to the target account; determining the first generator in combination with the first random number and the predetermined generator; obtaining a first verification value based on the first generator, the first timestamp, and the authentication secret value using a hash algorithm, wherein the authentication secret value is generated by a secret parameter generated by the cloud server in response to the account registration process; generating the first encrypted information based on the initial encrypted information, the first generator, the first verification value, and the first timestamp.

[0042] It can be understood that the account identity information, fog server identification and fuzzy verification factor are encrypted using the first key to generate initial encrypted information. The fuzzy verification factor is a special value generated by the cloud server and specially issued to the target account (which can be stored in the smart card of the target account), which is used to increase the complexity and security of the encryption process, and can prevent attackers from obtaining account information by simple guessing or cracking. The first generator is determined by combining the first random number and the predetermined generator. The first random number is used to increase uncertainty each time encryption is performed, and the mathematical space where the predetermined generator is located limits the selection range of the first random number. Based on the first generator, the first timestamp and the authentication secret value, the first check value is calculated using a hash algorithm. The authentication secret value is a secret parameter generated by the cloud server during the account registration process, which is further processed to ensure the uniqueness and security of the first check value. The addition of the first timestamp allows each encryption process to contain time information, which helps prevent replay attacks. The initial encrypted information, the first generator, the first check value and the first timestamp are combined to generate the final first encrypted information, which is a complex encryption package that contains both encrypted data and verification information, greatly improving the security of data transmission and storage. By introducing multiple security elements such as fuzzy verification factors, the first random number, authentication secret value and timestamp, and adopting encryption technologies such as hash algorithm, a multi-level and multi-factor encryption and verification system is constructed to effectively protect the security of account identity information and fog server identification.

[0043] Optionally, the first random number is denoted as r1, and the mathematical space where the predetermined generator is located is denoted as Pick the first random number For the predetermined generator P and public key P pub Add the first random number r1. The first generator is B. i =r1P, P is the generator, add the public key after the first random number, and get the first key C i =r1·P pub . The public key (first key) C after adding the first random number i User ID i , ID j (Fog server identifier) ​​is encrypted to obtain the initial encrypted information Among them, x i is the fuzzy verification factor. Authentication secret value Among them, R i Represents the secret parameter, and the first check value G is calculated i =h1(A i ||B i ||T1), and send this information to the corresponding fog server, where T1 is the current timestamp (i.e., the first timestamp).

[0044] Step S104: when the verification of the account identity information is passed, a first key is obtained by combining the first random number and the public key, wherein the first random number is selected in the mathematical space where the predetermined generator is located, and the predetermined generator is the base point in the elliptic encryption curve. The public key is generated by the cloud server and shared with the charging pile and the fog server. The fog server and the cloud server jointly verify the account identity information;

[0045] It can be understood that after the account identity information is verified, the first random number and the public key are combined to generate the first key. The first random number is selected in the mathematical space where the predetermined generator of the elliptic encryption curve is located, ensuring the randomness and security of the key. The public key is generated by the cloud server and shared with the charging pile and fog server, ensuring that all participants can use the same key system for encryption and decryption operations, providing a secure foundation for subsequent encrypted communications.

[0046] It should be noted that in the charging pile system, although the charging pile has preliminarily verified the user information, it still needs to be verified again by the fog server (FS) and the cloud server (CSP). The three-layer verification mechanism of the charging pile, fog server and cloud server can significantly enhance the security of the system. Even if the verification at the charging pile level is bypassed or forged in some way, the subsequent fog server and cloud server verification can still intercept potential security threats. Through their own independent verification mechanisms, the user's identity and the authenticity of the data can be further confirmed to prevent impersonation of users or tampering with data.

[0047] In an optional embodiment, the executor of the following processing is a fog server: combining a second random number and a public key to obtain a second key, wherein the second random number is selected in a mathematical space; adding the second random number to a predetermined generator to obtain a second generator; based on the first generator carried in the first encrypted information, a fog server identifier, and a second random number, obtaining intermediate encrypted information; based on a shared key, a second generator, a first check value carried in the first encrypted information, and a second timestamp, a hash algorithm is used to obtain a second check value, wherein the shared key is generated by the cloud server and shared by the cloud server and the fog server; based on the second generator, the intermediate encrypted information, the second check value, and the second timestamp, the first encrypted information is encrypting to obtain second encrypted information.

[0048] It can be understood that the charging pile will send the first encrypted message to the fog server for processing. The fog server selects a second random number in the mathematical space, and then combines the second random number and the known public key (obtained from the cloud server) to generate a second key. The fog server adds the second random number to the predetermined generator to obtain the second generator. The fog server generates intermediate encrypted information based on the first generator carried in the first encrypted information, the fog server's own identification, and the second random number, in order to combine the specific information of the fog server with the first encrypted information to facilitate subsequent verification and decryption processes. The fog server uses the shared key as one of the inputs of the hash algorithm, and combines the second generator, the first check value carried in the first encrypted information, and the second timestamp to calculate the second check value for verifying the integrity and authenticity of the subsequent encrypted information. The above-mentioned shared key is generated by the cloud server and shared with the fog server. The fog server further encrypts the first encrypted information based on the second generator, the intermediate encrypted information, the second check value and the second timestamp to obtain the second encrypted information. By combining multiple security elements such as the second random number, the second timestamp and the second check value, further encryption is performed on the basis of the first encrypted information to ensure the high security of the encrypted information.

[0049] In an optional embodiment, before combining the second random number and the public key to obtain the second key, the method also includes: verifying whether the first timestamp carried in the first encrypted information belongs to a valid time range; if the first timestamp belongs to the valid time range, allowing the first encrypted information to be processed; if the first timestamp does not belong to the valid time range, discarding the first encrypted information.

[0050] It can be understood that the fog server first needs to extract the first timestamp from the received first encrypted information. The first timestamp is added when the encrypted information is generated and is used to record the time point of the encryption operation. The fog server needs to have a preset valid time range, which is a reasonable interval based on the current time. The setting of the valid time range can be adjusted according to the actual situation, such as a few minutes, hours or days. The fog server compares the extracted first timestamp with the valid time range to determine whether the first timestamp falls within the valid time range. If the first timestamp belongs to the valid time range, it means that the first encrypted information was generated within a recent period of time, so the fog server will allow the subsequent processing of this encrypted information, including combining the second random number and the public key to generate the second key, and other necessary encryption steps. If the first timestamp does not belong to the valid time range, it means that the encrypted information is outdated or may have been tampered with. In order to ensure the security of the system and the accuracy of the data, the fog server will choose to discard this encrypted information without any subsequent processing. By verifying the timestamp, the fog server can ensure that the received encrypted information is not a replay of the old information, thereby improving the system's defense against replay attacks.

[0051] Optionally, the fog server F N Receive the first encrypted message from the charging station {B i , F i , G i , T1}, verify the validity of T1, if T1 is valid, add the second random number r2 to the predetermined generator L i = r2P, and add the second random number to the public key to obtain the second key N i =r2·P pub , using the public key (second key) N after adding the random number i Fog server ID j Encrypt and obtain intermediate encrypted information Calculate the second check value M i =h1(k j ||L i ||G i || T2), where T2 is the current timestamp (second timestamp).

[0052] Fog Server FN Send information to the cloud server,

[0053] Step S106, using the first key to encrypt the account identity information and the fog server identifier to obtain first encrypted information, wherein the fog server identifier corresponds to the fog server, and the fog server is used to encrypt the first encrypted information after receiving the first encrypted information to obtain second encrypted information, and send the second encrypted information to the cloud server, and the cloud server is used to send charging response information to the charging pile based on the second encrypted information;

[0054] It can be understood that the account identity information and the fog server identifier are encrypted using the first key to generate the first encrypted information. The addition of the fog server identifier enables each fog server to identify and process encrypted information from a specific source, such as a specific fog server is responsible for all charging piles in an area. After receiving the first encrypted information, the fog server further encrypts it to obtain the second encrypted information and sends it to the cloud server. After the cloud server verifies the integrity and source of the information based on the second encrypted information, it sends the charging response information to the charging pile. In this process, the fog server, as an intermediate node, not only shares the processing pressure of the cloud server, but also improves the security of data transmission by adding a layer of encryption protection.

[0055] In an optional embodiment, the executor of the following processing is a cloud server: using a master key to decrypt the intermediate encrypted information carried in the second encrypted information to obtain a fog server identifier, wherein the master key is used as a basic key for the cloud server to generate keys; determining a third random number corresponding to the fog server identifier, wherein the third random number is determined when the fog server registers with the cloud server; using a hash algorithm based on the third random number, the master key, and the fog server identifier to obtain a third verification value; when the third verification value matches the second verification value carried in the second encrypted information, determining that the fog server corresponding to the fog server identifier has been verified; when the fog server has been verified, allowing the second encrypted information to be decrypted.

[0056] It can be understood that the cloud server uses the master key it holds to decrypt the intermediate encrypted information carried in the second encrypted information. The master key is the basic key used by the cloud server for key generation. It may be used to generate multiple derived keys, which are used for different encryption and decryption tasks. When the fog server registers with the cloud server, each fog server will be assigned a third random number, which is stored on the cloud server as a part corresponding to the fog server. When the cloud server needs to verify the identity of the fog server, it will find the corresponding third random number according to the fog server identifier. The cloud server uses a hash algorithm, takes the third random number, the master key and the fog server identifier as input, and calculates a hash value as the third check value. The cloud server compares the calculated third check value with the second check value carried in the second encrypted information. If the third check value matches the second check value, it means that the second encrypted information has not been tampered with during transmission and is indeed from the fog server with the corresponding third random number. Subsequently, the cloud server can allow further decryption operations on the second encrypted information to obtain the account identity information therein to continue the verification process.

[0057] Optionally, after receiving the second encrypted information, the cloud service verifies whether the second timestamp included therein is valid. If the second timestamp is within a predetermined valid time range, the second timestamp is deemed valid and the second encrypted information is allowed to be processed. Otherwise, the second encrypted information is discarded and it is deemed that a replay attack may have occurred.

[0058] Optionally, using a shared key k j Authentication fog server, hash value comparison. Cloud server CSP receives the second encrypted information {B i , F i , G i , T1, L i , O i , M i , T2}, verify the validity of the second timestamp T2. If T2 is valid, use the master key s to authenticate the fog server ID j Decrypt and decrypt the second key N i =s·L i , and then use the second key to decrypt the intermediate encrypted information: Get the fog server ID j .

[0059] Cloud server based on ID j Retrieve {ID j ,y j}, determine the third random number corresponding to the fog server identifier, k j =h1(ID j ||s||y j), calculate the third check value Verify the equation Is it true, where M i is the second verification value carried in the second encrypted information. If the equation holds, the cloud server CSP successfully authenticates the fog server F N .

[0060] In an optional embodiment, the method also includes: using a master key to decrypt the account identification information carried in the second encrypted information to obtain the decrypted account identity information; verifying whether the decrypted account identity information matches the pre-registration information, wherein the pre-registration information is; and when the account identity information matches the pre-registration information, determining to send a charging response information to the charging pile.

[0061] It can be understood that the cloud server uses the master key (to decrypt the account identification information carried in the second encrypted information. The decryption process ensures that only the cloud server holding the correct key can access this information, thereby protecting user privacy and data security. After decryption, the cloud server obtains the decrypted account identity information, and the cloud server matches and verifies the decrypted account identity information with the pre-registration information. Pre-registration information refers to the information provided by the user when pre-registering in the cloud server or related system, and is stored in the database of the cloud server for subsequent verification. If the account identity information matches the pre-registration information, it means that the user requesting charging is a legitimate user and his account status allows charging operations. The cloud server will determine to send charging response information to the charging pile. The charging response information may include instructions to allow charging, charging parameters (such as charging time, charging amount, etc.), user account information, etc., so that the charging pile can correctly perform the charging operation.

[0062] Alternatively, if the account identity information does not match the pre-registration information, it means that the user requesting charging may not be allowed to perform charging operations by account permissions. The cloud server will not send charging response information to the charging pile, and may record an error log or send a charging rejection notification to the target account as a prompt.

[0063] Optionally, the cloud server uses the master key s to identify the target account ID i Decryption is performed, and the cloud server CSP calculates C i =s·B i , based on the master key and the first generator, the first key is obtained. Then the first key is used for decryption Get the factor to be tested Cloud server based on ID i Search in the database by {ID i , x i} Find the fuzzy verification factor x corresponding to the target account ID i , verify the equation If the equation holds, calculate the authentication secret value A. i =h1(ID i ||s||x i ), Indicates the check value to be verified, G i Represents the first check value, verifying the equation If the equation is not true, it means that the user's smart card is likely to be captured by the attacker. CSP successfully authenticates user U i .

[0064] Step S108: Based on the received charging response information, start charging processing for the target account.

[0065] It is understandable that after receiving the charging response information, the charging pile will start the charging process for the target account. Since the account identity information has been authenticated at multiple levels, the virtual assets associated with the target account can be directly deducted based on the charging amount after the charging process, which is conducive to realizing fast payment processing and improving the user's charging experience.

[0066] Through the above step S102, the account identity information of the target account is verified based on the charging request sent by the target account, wherein the charging request is used to request charging using a charging pile; step S104, when the verification of the account identity information is passed, the first key is obtained by combining the first random number and the public key, wherein the first random number is selected in the mathematical space where the predetermined generator is located, the predetermined generator is the base point in the elliptic encryption curve, and the public key is generated by the cloud server and shared with the charging pile and the fog server, and the fog server and the cloud server jointly verify the account identity information; step S106, using the first key, the account identity information and the fog server identifier are encrypted to obtain the first encrypted information, wherein the fog server identifier corresponds to the fog server, and the fog server is used to encrypt the first encrypted information after receiving the first encrypted information to obtain the second encrypted information, and send the second encrypted information to the cloud server, and the cloud server is used to send charging response information to the charging pile based on the second encrypted information; step S108, based on the received charging response information, start the charging process for the target account. The purpose of utilizing the computing resources of the fog server to improve the efficiency and security of charging interaction authentication is achieved, and the technical effect of providing low-latency and high-security charging services is realized, thereby solving the technical problem of unsatisfactory charging interaction authentication efficiency existing in related technologies.

[0067] Based on the above embodiments and optional embodiments, the present invention proposes an optional implementation mode: Figure 2The figure is an architecture diagram of an optional charging interaction authentication method provided according to an embodiment of the present invention. In the architecture, the first layer is the charging pile device, the second layer is the fog server (FS), and the third layer is the cloud server CSP). In addition, there are three communication modes between the layers: (1) communication between charging pile devices, (2) communication between charging piles and fog servers, and (3) communication between fog servers and upper-layer cloud servers.

[0068] There are three important entities in the above framework: cloud server, fog server and charging pile. The cloud server CSP is mainly responsible for the registration of various entities and the distribution of keys, and analyzes and reviews the data information uploaded by the fog server FS. The fog server FS is responsible for user identity authentication and uploads relevant data information to the cloud server CSP.

[0069] The messages sent by the fog server FS to the cloud server CSP mainly include the authentication information of itself and the user. The messages from the charging piles can include the charging information, passwords, biometrics, etc. of the electric vehicle users. The messages sent by the fog server FS to the charging piles are mainly the authentication information encrypted by the cloud server CSP. Since there are a large number of message exchanges between the cloud server CSP, the fog server FS and the charging piles, the security requirements of the charging pile system network include identity authentication, message confidentiality, data integrity, privacy protection, etc.

[0070] Step S1, during the system initialization phase, input the security parameter l, and the cloud server CSP selects a finite field F p An elliptic curve E on p (a, b), where p is a large prime number. P is E p The cloud server CSP selects the system master key s and calculates the public key P pub =sP, select a secure hash function h1(·), and select the symmetric encryption AES-128 algorithm Ek(·) / Dk(·).

[0071] Step S2, the registration phase, is divided into the following two sub-steps. Figure 3 is a schematic diagram of an account registration of an optional charging interactive authentication method provided according to an embodiment of the present invention, such as Figure 3 As shown, in step S21, user registration phase, (1) user U i When connected to a charging pile, the charging pile receives a registration request message containing an identity ID i and password PW i , calculate the verification identifier RID i =h1(ID i ||PW i ), sent to the cloud server CSP,

[0072] (2) CSP receives the message {ID i , RID i}, select a random number x i , x i It is a fuzzy authentication factor used to detect online guessing attacks after the user obtains the smart card. CSP calculates the authentication secret value A i =h1(ID i ||s||x i ), master key s, combined verification identifier and secret value to form a secret parameter And the parameter {R i , x i} Stored in smart card and sent to charging pile, which distributes it to user U i , set the parameter {ID i , x i}Save into the database,

[0073] (3)U i After receiving the smart card, calculate the predetermined check value V i =h(ID i ||PW i )mod n, where n satisfies 2 8 ≤n≤2 10 An integer, the predetermined check value {V i}Store in smart card.

[0074] Figure 4 is a schematic diagram of fog server registration of an optional charging interactive authentication method provided according to an embodiment of the present invention, such as Figure 4 As shown, step S22: fog server registration, (1) fog server F N Select an identity ID j , replace {ID j} is sent to the cloud server CSP through a secure channel. (2) CSP receives {ID j}, select the third random number Calculate the shared key k j =h l (ID j ||s||y j ), CSP will parameter {ID j ,y j}Save into the database, The CSP writes the key to the fog server.

[0075] Step S3, user charging interaction stage, Figure 5 is a schematic flow chart of an optional charging interaction authentication method provided according to an embodiment of the present invention, such as Figure 5As shown, it is mainly divided into the following 6 sub-steps.

[0076] Step S31: the i-th user U i When you need to charge the charging pile system, enter the ID into the charging pile. i PW i (i.e. account identity information), calculate the first verification identifier RID i =h1(ID i ||PW i ), h1 represents the hash algorithm, which is processed by taking the modulus of n i * =RID i mod n, the first value to be detected is recorded as V i * , the charging pile verification equation V i * =V i Is it true, where V i is the predetermined calibration value, V i * =V i When established, the charging station confirms that the account identity information has been verified.

[0077] Step S32, the first random number is recorded as r1, and the mathematical space where the predetermined generator is located is recorded as Pick the first random number For the predetermined generator P and public key P pub Add the first random number r1. The first generator is B. i =r1P, P is the generator, add the public key after the first random number, and get the first key C i =r1·P pub . The public key (first key) C after adding the first random number i User ID i , ID j (Fog server identifier) ​​is encrypted to obtain the initial encrypted information Among them, x i is the fuzzy verification factor. Authentication secret value Among them, R i Represents the secret parameter, and the first check value G is calculated i =h1(A i ||B i ||T1), and send this information to the corresponding fog server, where T1 is the current timestamp (i.e., the first timestamp),

[0078] Step S33, fog server F N Receive the first encrypted message from the charging station {Bi , F i , G i , T1}, verify the validity of T1, if T1 is valid, add the second random number r2 to the predetermined generator L i = r2P, and add the second random number to the public key to obtain the second key N i =r2·P pub , using the public key (second key) N after adding the random number i Fog server ID j Encrypt and obtain intermediate encrypted information Calculate the second check value M i =h1(k j ||L i ||G i || T2), where T2 is the current timestamp (second timestamp).

[0079] Fog Server F N Send information to the cloud server,

[0080] Step S34, using the shared key k j Authentication fog server, hash value comparison. Cloud server CSP receives the second encrypted information {B i , F i , G i , T1, L i , O i , M i , T2}, verify the validity of the second timestamp T2. If T2 is valid, use the master key s to authenticate the fog server ID j Decrypt and decrypt the second key N i =s·L i , and then use the second key to decrypt the intermediate encrypted information: Get the fog server ID j .

[0081] Cloud server based on ID j Retrieve {ID j ,y j}, determine the third random number corresponding to the fog server identifier, k j =h1(ID j ||s||y j ), calculate the third check value Verify the equation Is it true, where M i is the second verification value carried in the second encrypted information. If the equation holds, the cloud server CSP successfully authenticates the fog server F N .

[0082] Step S35: The cloud server uses the master key s to identify the target account ID i Decryption is performed, and the cloud server CSP calculates C i =s·B i , based on the master key and the first generator, the first key is obtained. Then the first key is used for decryption Get the factor to be tested Cloud server based on ID i Search in the database by {ID i , x i} Find the fuzzy verification factor x corresponding to the target account ID i , verify the equation If the equation holds, calculate the authentication secret value A. i =h1(ID i ||s||x i ), Indicates the check value to be verified, G i Represents the first check value, verifying the equation If the equation is not true, it means that the user's smart card is likely to be captured by the attacker. CSP successfully authenticates user U i .

[0083] The above optional implementation method achieves at least the following effects: adding fog computing to the charging pile system greatly improves the speed of electric vehicle charging request and response management, thereby avoiding the communication delay caused by the charging pile frequently uploading charging data to the cloud server. In order to ensure the security and privacy of the charging transaction process, the cloud server authenticates the fog node and user node by using the key exchange idea based on the elliptic curve Diffie-Hellman. Only the charging pile, fog node, and cloud server that generate the random number r1, r2, and P can calculate r1r2P, thereby realizing the secure transmission of three-party data between the charging pile, fog node, and cloud server. To solve the communication delay problem caused by a large number of electric vehicles accessing the charging pile system, it is necessary to upload data to the remote cloud server and meet the high security requirements in the charging transaction process.

[0084] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0085] A charging interactive authentication system is also provided in an embodiment of the present invention. The charging interactive authentication system provided in an embodiment of the present invention is introduced below.

[0086] Figure 6 is a structural block diagram of a charging interactive authentication system provided according to an embodiment of the present invention. Figure 6 As shown, the system includes: a charging pile 602, a fog server 604, and a cloud server 606, wherein the charging pile 602 is used to verify the account identity information of the target account based on the charging request sent by the target account, wherein the charging request is used to request charging using the charging pile 602; when the verification of the account identity information is passed, a first key is obtained by combining a first random number and a public key, wherein the first random number is selected in the mathematical space where a predetermined generator is located, the predetermined generator is a base point in an elliptic encryption curve, and the public key is generated by the cloud server 606 and shared with the charging pile 602 and the fog server 604, and the fog server 604 and the cloud server 606 cooperate to verify the account identity information; the first key is used to encrypt the account identity information and the fog server 604 identifier to obtain the first encrypted information, wherein the fog server 604 identifier corresponds to the fog server 604;

[0087] The fog server 604 is used to encrypt the first encrypted information after receiving the first encrypted information to obtain second encrypted information, and send the second encrypted information to the cloud server 606;

[0088] The cloud server 606 is used to send charging response information to the charging pile 602 based on the second encrypted information;

[0089] The charging station 602 is used to start charging processing for the target account based on the received charging response information.

[0090] In a charging interactive authentication system provided by an embodiment of the present invention, by setting a charging pile 602, a fog server 604, and a cloud server 606, the purpose of utilizing the computing resources added to the fog server to improve the efficiency and security of charging interactive authentication is achieved, and the technical effect of providing low-latency and high-security charging services is achieved, thereby solving the technical problem of unsatisfactory charging interactive authentication efficiency existing in related technologies.

[0091] It should be noted that the optional or preferred implementation of this embodiment can refer to the relevant description in the embodiment, which will not be repeated here.

[0092] An embodiment of the present invention provides a non-volatile storage medium on which a program is stored. When the program is executed by a processor, a charging interaction authentication method is implemented.

[0093] An embodiment of the present invention provides an electronic device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the charging interaction authentication method provided in any embodiment is implemented. The device in this article may be a server, a PC, etc.

[0094] The present invention also provides a computer program product, which, when executed on a data processing device, is suitable for executing a program for initializing a charging interactive authentication method as provided in any embodiment.

[0095] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0096] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0097] These computer program instructions may also be stored in a computer readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer readable memory produce an article of manufacture including an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0098] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0099] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0100] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0101] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0102] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0103] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0104] The above are only embodiments of the present invention and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent substitution, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of the claims of the present invention.

Claims

1. A charging interactive authentication method, characterized in that: include: Verifying the account identity information of the target account based on a charging request sent by the target account, wherein the charging request is used to request charging using a charging pile; In the case where the verification of the account identity information is passed, a first key is obtained by combining a first random number and a public key, wherein the first random number is selected in a mathematical space where a predetermined generator is located, and the predetermined generator is a base point in an elliptic encryption curve, and the public key is generated by a cloud server and shared with the charging pile and the fog server, and the fog server and the cloud server cooperate to verify the account identity information; The account identity information and the fog server identifier are encrypted using the first key to obtain first encrypted information, wherein the fog server identifier corresponds to the fog server, and the fog server is used to encrypt the first encrypted information after receiving the first encrypted information to obtain second encrypted information, and send the second encrypted information to the cloud server, and the cloud server is used to send charging response information to the charging pile based on the second encrypted information; Based on the received charging response information, a charging process for the target account is initiated.

2. The method according to claim 1, characterized in that The verifying the account identity information of the target account includes: Based on the account identity information, a hash algorithm is used to obtain a first verification identifier; Performing modulo processing based on the first verification identifier to obtain a first value to be detected; When the first value to be detected matches the predetermined verification value, it is determined that the verification of the account identity information is passed.

3. The method according to claim 2, characterized in that The using the first key to encrypt the account identity information and the fog server identifier to obtain first encrypted information includes: Encrypting based on the account identity information, the fog server identifier, and the fuzzy verification factor, using the first key, to obtain initial encrypted information, wherein the fuzzy verification factor is generated by the cloud server and sent to the target account; Determine a first generator by combining the first random number and the predetermined generator; Obtaining a first verification value using a hash algorithm based on the first generator, a first timestamp, and an authentication secret value, wherein the authentication secret value is generated by a secret parameter generated by the cloud server in response to an account registration process; The first encrypted information is generated based on the initial encrypted information, the first generator, the first check value, and the first timestamp.

4. The method according to claim 1, characterized in that: The following processing is performed by the fog server: Combining a second random number and the public key to obtain a second key, wherein the second random number is selected in the mathematical space; Adding the second random number to the predetermined generator to obtain a second generator; Obtaining intermediate encrypted information based on the first generator carried in the first encrypted information, the fog server identifier, and the second random number; Based on the shared key, the second generator, the first check value carried in the first encrypted information, and the second timestamp, a hash algorithm is used to obtain a second check value, wherein the shared key is generated by the cloud server and shared by the cloud server and the fog server; The first encrypted information is encrypted based on the second generator, the intermediate encrypted information, the second check value, and the second timestamp to obtain the second encrypted information.

5. The method according to claim 4, characterized in that Before combining the second random number and the public key to obtain the second key, the method further includes: Verifying whether the first timestamp carried in the first encrypted information belongs to a valid time range; In the case where the first timestamp belongs to the valid time range, allowing the first encrypted information to be processed; In the case that the first timestamp does not belong to the valid time range, the first encrypted information is discarded.

6. The method according to claim 1, characterized in that The following processing is performed by the cloud server: Using a master key, decrypting the intermediate encrypted information carried in the second encrypted information to obtain the fog server identifier, wherein the master key is used as a basic key for the cloud server to generate a key; Determine a third random number corresponding to the fog server identifier, wherein the third random number is determined when the fog server registers with the cloud server; Based on the third random number, the master key, and the fog server identifier, a hash algorithm is used to obtain a third check value; In a case where the third verification value matches the second verification value carried in the second encrypted information, determining that the verification of the fog server corresponding to the fog server identifier passes; When the fog server passes the verification, the second encrypted information is allowed to be decrypted.

7. The method according to claim 6, characterized in that The method further comprises: Using the master key, decrypting the account identification information carried in the second encrypted information to obtain decrypted account identity information; Verifying whether the decrypted account identity information matches the pre-registration information, wherein the pre-registration information is; In a case where the account identity information matches the pre-registration information, it is determined to send charging response information to the charging pile.

8. A charging interactive authentication system, characterized in that: include: Charging piles, fog servers, cloud servers, among which, A charging pile, used to verify the account identity information of a target account based on a charging request sent by a target account, wherein the charging request is used to request charging using a charging pile; when the verification of the account identity information is passed, a first key is obtained by combining a first random number and a public key, wherein the first random number is selected in a mathematical space where a predetermined generator is located, the predetermined generator is a base point in an elliptic encryption curve, and the public key is generated by a cloud server and shared with the charging pile and a fog server, and the fog server and the cloud server cooperate to verify the account identity information; the account identity information and a fog server identifier are encrypted using the first key to obtain first encrypted information, wherein the fog server identifier corresponds to the fog server; The fog server is configured to, after receiving the first encrypted information, encrypt the first encrypted information to obtain second encrypted information, and send the second encrypted information to the cloud server; The cloud server is used to send charging response information to the charging pile based on the second encrypted information; The charging pile is used to start charging processing for the target account based on the received charging response information.

9. A non-volatile storage medium, characterized in that: The non-volatile storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the charging interaction authentication method described in any one of claims 1 to 7.

10. An electronic device, characterized in that: include: One or more processors and a memory, wherein the memory is used to store one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the charging interaction authentication method described in any one of claims 1 to 7.

Images