Photovoltaic terminal data transmission protection method and system based on trusted computing

Abstract

The invention discloses a photovoltaic terminal data transmission protection method and system based on trusted computing, and the method comprises the steps: constructing a terminal protection frame based on a trusted technology, and the terminal protection frame comprises a user space, a kernel space, a monitoring space and a hardware space; the user space interacts with a user and performs data interaction with the kernel space; the kernel space calls and distributes data resources according to the security evaluation result of the monitoring space; and the hardware space provides a bottom layer support service for other spaces so as to realize transmission protection of photovoltaic terminal data. According to the invention, by creating a secure trusted space and a terminal equipment trusted chain at the photovoltaic system terminal, the high credibility of the terminal system is ensured in the data transmission process, the overall security performance of the photovoltaic system is improved, and all security policies are stored in a special database of a trusted digital identity chip, so that the security of the terminal system is improved. The method does not occupy memory resources of a terminal system, and can provide various trusted functions under the condition of terminal equipment with limited resources.

Description

Technical Field

[0001] The present invention relates to the technical field of network data security, and in particular to a photovoltaic terminal data transmission protection method and system based on trusted computing. Background Art

[0002] As we all know, the traditional coal mines used for power generation have limited reserves and are increasingly damaging the environment. At the same time, the supply of electric energy still cannot meet the needs. In recent years, with the continuous development of science and technology and the protection of the environment, the world has turned its attention to renewable energy. Among them, solar energy, as a cheap and inexhaustible energy source, and its zero-pollution characteristics, is expected to change the energy structure of mankind. The domestic photovoltaic power generation industry has ushered in a new stage of rapid development. In 2022, my country's newly added photovoltaic power generation capacity reached 87.41GW. It is estimated that by 2050, China's renewable energy power generation capacity will account for 25% of the country's total power generation capacity. Today, there is a trend of intelligent power grids, and the basic functions such as the operation and management of photovoltaic systems are also tending to be intelligent, requiring the use of a large amount of data for analysis. Once these terminal data are tampered with or attacked, it will seriously affect the normal operation of the photovoltaic system.

[0003] At present, conventional security protection measures often lack coverage in the terminal part, making it difficult to deal with attacks against the terminal. Trusted computing technology fundamentally improves system security. Trusted computing is a technical innovation in terms of logical correctness verification, computing architecture and computing mode, in order to solve the problem of logical defects not being exploited by attackers, forming a unity of attack and defense contradictions, and ensuring that security protection can achieve full coverage. In summary, how to build a terminal data security system for photovoltaic systems is a key to maintaining the stable operation of photovoltaic systems. Summary of the invention

[0004] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0005] In view of the above existing problems, the present invention is proposed.

[0006] Therefore, the present invention provides a photovoltaic terminal data transmission protection method and system based on trusted computing to solve the problems mentioned in the background technology.

[0007] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0008] In a first aspect, an embodiment of the present invention provides a photovoltaic terminal data transmission protection method based on trusted computing, including: constructing a terminal protection framework based on trusted technology, the terminal protection framework including a user space, a kernel space, a monitoring space, and a hardware space;

[0009] The user space includes a common execution space and a trusted execution space, wherein the common execution space and the trusted execution space interact with the user and perform data interaction with the kernel space;

[0010] The kernel space works in coordination with the monitoring space, and the kernel space calls and allocates data resources according to the security assessment result of the monitoring space;

[0011] The hardware space provides underlying support services for the other spaces to achieve transmission protection of photovoltaic terminal data.

[0012] As a preferred solution of the photovoltaic terminal data transmission protection method based on trusted computing described in the present invention, it also includes: the monitoring space includes a proof agent module, a measurement agent module and a power management service; the hardware space includes photovoltaic system hardware and a trusted digital identity chip; the kernel space includes thread management, file management, system calls and inter-process communication.

[0013] As a preferred solution of the photovoltaic terminal data transmission protection method based on trusted computing described in the present invention, wherein: the user space also includes: a normal execution space and a trusted execution space separated by execution environments; the normal execution space contains normal applications; the trusted execution space contains multiple trusted applications and a trusted service module; the trusted service module is used to provide security management functions.

[0014] As a preferred solution of the photovoltaic terminal data transmission protection method based on trusted computing described in the present invention, wherein: the kernel space calls and allocates data resources according to the security assessment result of the monitoring space, including: when any terminal transmits data with the photovoltaic system, it is authenticated according to the proxy module in the monitoring space, generates a measurement root and uploads it to the trusted service platform;

[0015] The trusted service platform provides an access interface to the trusted computing chip. The proxy module initiates a request to the trusted digital identity chip to access the photovoltaic system and establish a transmission channel. After the trusted platform module verifies it, it allocates a specific channel to the terminal device to establish a transmission link for data transmission.

[0016] As a preferred solution of the photovoltaic terminal data transmission protection method based on trusted computing described in the present invention, wherein: authentication is performed according to the proxy module in the monitoring space, and the measurement root is generated and uploaded to the trusted service platform, including: the proxy module is a certification proxy module and a measurement proxy module;

[0017] The proof agent module is used to determine whether the device has been attacked at the physical level and to confirm that the terminal device has not been tampered with or forged; the measurement agent module is responsible for the integrity of the terminal device itself, and calculates and submits the measurement root.

[0018] As a preferred solution of the photovoltaic terminal data transmission protection method based on trusted computing described in the present invention, it also includes:

[0019] When the terminal device is running, the certification agent module verifies that the physical layer of the device has not been tampered with or forged by requesting the device certificate from a trusted third party, generates a device identity certification report, and provides it to the server;

[0020] When a user requests to access the system, based on its own integrity report as a link in the trust chain, the measurement agent module performs an integrity check on the terminal device and generates a measurement report, thereby participating in the establishment of the trust chain.

[0021] As a preferred solution of the photovoltaic terminal data transmission protection method based on trusted computing described in the present invention, wherein: trusted service platform authentication includes: the trusted service module is based on the trusted digital identity chip to establish and manage a complete trust chain, the trusted digital identity chip includes a hardware module and a control module; the hardware module includes at least a policy implementation component, a policy judgment component, and a storage component; the control module is responsible for coordinating the collaborative operation between various components;

[0022] The trusted service module provides an interactive interface for the terminal device, as well as access rights to the trusted computing function of the trusted digital identity chip; after the trusted digital identity chip receives the authentication request sent by the proxy module and the measurement root generated by the proxy, it compares the trusted root and authorizes the terminal device to prove its own credibility. After the proof is completed, the trusted service module allows the terminal device to use the allocated channel to transmit data with the photovoltaic system, and generates a log and saves it to the database.

[0023] In a second aspect, the present invention provides a photovoltaic terminal data transmission protection system based on trusted computing, comprising:

[0024] A framework building module, used to build a terminal protection framework based on trusted technology, wherein the terminal protection framework includes user space, kernel space, monitoring space and hardware space;

[0025] A user space module, used for the user space including a common execution space and a trusted execution space, wherein the common execution space and the trusted execution space interact with the user and perform data interaction with the kernel space;

[0026] A kernel and monitoring space module, used for the kernel space and the monitoring space to work together, and the kernel space calls and allocates data resources according to the security assessment result of the monitoring space;

[0027] The hardware space module is used for the hardware space to provide underlying support services for the other spaces to achieve transmission protection of photovoltaic terminal data.

[0028] In a third aspect, the present invention provides a computing device, comprising:

[0029] Memory and processor;

[0030] The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions. When the computer executable instructions are executed by the processor, the steps of the photovoltaic terminal data transmission protection method based on trusted computing are implemented.

[0031] In a fourth aspect, the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the photovoltaic terminal data transmission protection method based on trusted computing.

[0032] Compared with the prior art, the present invention has the following beneficial effects: the present invention uses trusted computing technology to create a secure trusted space in the photovoltaic system terminal, and at the same time uses the proxy module to build a reliable terminal device trusted chain, thereby ensuring the high credibility of the terminal system during data transmission and improving the overall security performance of the photovoltaic system. In addition, all security policies are stored in the dedicated database of the trusted digital identity chip, which will not occupy the terminal system memory resources, and can provide multiple trusted functions under the condition of limited resource terminal devices, ensuring the stable operation of the photovoltaic system. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0034] Figure 1 A schematic diagram of a photovoltaic terminal protection framework of a photovoltaic terminal data transmission protection method and system based on trusted computing according to an embodiment of the present invention;

[0035] Figure 2 A schematic diagram of a terminal device data transmission process of a photovoltaic terminal data transmission protection method and system based on trusted computing according to an embodiment of the present invention;

[0036] Figure 3 The present invention is a flow chart of a trusted platform module authentication method and system for photovoltaic terminal data transmission protection based on trusted computing according to an embodiment of the present invention. DETAILED DESCRIPTION

[0037] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0038] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0039] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0040] The present invention is described in detail with reference to schematic diagrams. When describing the embodiments of the present invention, for the sake of convenience, the cross-sectional diagrams showing the device structure will not be partially enlarged according to the general scale, and the schematic diagrams are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional dimensions of length, width and depth should be included.

[0041] At the same time, in the description of the present invention, it should be noted that the directions or positional relationships indicated by the terms "upper, lower, inner and outer" are based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention. In addition, the terms "first, second or third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0042] In the present invention, unless otherwise clearly specified and limited, the terms "install, connect, connect" should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection or an integral connection; it can also be a mechanical connection, an electrical connection or a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0043] Example 1

[0044] Reference Figure 1 to Figure 3 , is an embodiment of the present invention, which provides a photovoltaic terminal data transmission protection method based on trusted computing. It should be noted that there is a large amount of data transmission in the photovoltaic system terminal, and these data may contain a lot of critical information. Once leaked, the normal operation of the system will be affected or even unable to operate normally. However, there is currently a relative lack of special protection schemes for photovoltaic system terminal equipment, and there are many means to attack them, which makes these devices easily become targets of malicious attacks, which may eventually lead to a series of problems such as data leakage, malicious tampering or service interruption. This application uses trusted computing technology to ensure the security of photovoltaic terminal data.

[0045] The current security protection methods have many vulnerabilities in the field of terminal data transmission protection. Aiming at the security issues of photovoltaic system terminal data transmission, this application improves the existing photovoltaic system terminal framework, adds a trusted digital identity chip, a certification agent module, a measurement agent module, etc., and separates the normal execution environment NEE from the trusted execution environment TEE, such as Figure 1 As shown, including:

[0046] S100: Building a terminal protection framework based on trusted technology, the terminal protection framework includes user space, kernel space, monitoring space and hardware space;

[0047] S200: The user space includes a common execution space and a trusted execution space, and the common execution space and the trusted execution space interact with the user and perform data exchange with the kernel space;

[0048] S300: The kernel space and the monitoring space work together, and the kernel space calls and allocates data resources according to the security assessment results of the monitoring space;

[0049] S400: The hardware space provides underlying support services for other spaces to achieve transmission protection of photovoltaic terminal data.

[0050] It should be noted that the present invention uses trusted computing technology to create a secure trusted space in the photovoltaic system terminal, and at the same time builds a reliable terminal device trusted chain by using an agent module, thereby ensuring the high credibility of the terminal system during data transmission and improving the overall security performance of the photovoltaic system. In addition, all security policies are stored in a dedicated database of the trusted digital identity chip, which will not occupy the terminal system memory resources, and can provide multiple trusted functions under the condition of limited resource terminal devices, ensuring the stable operation of the photovoltaic system.

[0051] In an embodiment of the present application, it also includes: the monitoring space includes a proof agent module, a measurement agent module and a power management service; the hardware space includes photovoltaic system hardware and a trusted digital identity chip; the kernel space includes thread management, file management, system calls and inter-process communication.

[0052] In an embodiment of the present application, the user space also includes: a normal execution space and a trusted execution space separated by execution environments; the normal execution space contains normal applications; the trusted execution space contains multiple trusted applications and a trusted service module; the trusted service module is used to provide security management functions, such as authorization management, device management, key management, signature verification and secure storage.

[0053] It should be noted that the terminal protection framework is composed of multiple spaces. The user space provides an interactive interface, and the general execution space is separated from the trusted execution space; the kernel space is responsible for resource management, and reasonable resource calls improve efficiency; the monitoring space manages the stable operation of the terminal device and judges the security of the device; the hardware space provides underlying support services for other spaces. By using the above modules to work together, the protection needs of terminal data transmission can be met.

[0054] In the embodiment of the present application, the kernel space calls the allocation of data resources according to the security assessment result of the monitoring space, including: when any terminal transmits data with the photovoltaic system, it performs authentication according to the proxy module in the monitoring space, generates a measurement root and uploads it to the trusted service platform;

[0055] The trusted service platform provides an access interface to the trusted computing chip. The proxy module initiates a request to the trusted digital identity chip to access the photovoltaic system and establish a transmission channel. After the trusted platform module verifies it, it allocates a specific channel to the terminal device to establish a transmission link for data transmission.

[0056] Specifically, Figure 2 As shown, before any terminal transmits data to the photovoltaic system, the steps for authentication through the proxy module in the monitoring space are as follows:

[0057] A1: The terminal device first sends an authentication request to the trusted service module through the proof agent module and the measurement agent module to prove its identity and integrity. The trusted service module decides whether to grant access rights based on the information received.

[0058] A2: If the authentication is successful, the trusted service module will allocate a specific channel for the terminal device and establish a data transmission link.

[0059] A3: The terminal device sends data to the photovoltaic system through the designated channel.

[0060] A4: After receiving the data, the photovoltaic system performs corresponding processing according to business needs.

[0061] A5: After completing the data transmission, the trusted service module will generate a log and save it to the database to record key operations for subsequent troubleshooting and security auditing.

[0062] In the embodiment of the present application, authentication is performed according to the agent module in the monitoring space, and the measurement root is generated and uploaded to the trusted service platform, including: the agent module is a certification agent module and a measurement agent module;

[0063] The proof agent module is used to determine whether the device has been attacked at the physical level and to confirm that the terminal device has not been tampered with or forged; the measurement agent module is responsible for the integrity of the terminal device itself, and calculates and submits the measurement root.

[0064] In the embodiment of the present application, it also includes:

[0065] When the terminal device is running, the certification agent module verifies that the physical layer of the device has not been tampered with or forged by requesting the device certificate from a trusted third party, generates a device identity certification report, and provides it to the server;

[0066] When a user requests to access the system, the measurement agent module performs an integrity check on the terminal device based on its own integrity report as a link in the trust chain, and generates a measurement report to participate in the establishment of the trusted chain.

[0067] Furthermore, as the starting point of the trust chain, the proof agent module and the measurement agent module can transform the space mode from the insecure ordinary execution space to the secure trusted execution space mode, generate the measurement root, and connect with the trusted service module to realize the subsequent trusted computing related functions. The measurement root must follow the rules:

[0068] PCR inew =Hash(PCR iold value)

[0069] Among them, PCR inew Indicates the new PCR value, PCR ioldvalue represents the old PCR value, and Hash(·) represents the hash function

[0070] In the embodiment of the present application, the trusted service platform authentication includes: the trusted service module is based on the trusted digital identity chip to establish and manage a complete trust chain, the trusted digital identity chip includes a hardware module and a control module; the hardware module includes at least a policy implementation component, a policy judgment component, and a storage component; the control module is responsible for coordinating the collaborative operation between the various components;

[0071] The trusted service module provides an interactive interface for the terminal device, as well as access rights to the trusted computing function of the trusted digital identity chip; after the trusted digital identity chip receives the authentication request sent by the proxy module and the measurement root generated by the proxy, it compares the trusted root and authorizes the terminal device to prove its own credibility. After the proof is completed, the trusted service module allows the terminal device to use the allocated channel to transmit data with the photovoltaic system, and generates a log and saves it to the database.

[0072] Specifically, Figure 3 As shown, the trusted digital identity chip authentication device and channel allocation steps are as follows:

[0073] B1: The control module TPCM sends a request to the policy judgment component to obtain the integrity report of the current policy; the policy judgment component responds to the request of TPCM and returns the integrity report of the policy.

[0074] B2: The policy judgment component receives the policy integrity report request from TPCM and returns the policy integrity report to TPCM.

[0075] B3: The policy judgment component sends the policy to the policy implementation component.

[0076] B4: Receive the strategy from the strategy judgment component, execute the strategy, generate a verification report; feed back the verification report to TPCM, generate a log record and store it in the database.

[0077] B5: Log records generated by the storage policy enforcement component.

[0078] B6: The policy implementation component interacts with the terminal device through the transmission management module.

[0079] B7: Submit the trusted root to TPCM and interact with the terminal device for authentication.

[0080] B8: Perform authentication interaction with the proxy module to obtain channel allocation results.

[0081] Example 2

[0082] In an exemplary embodiment, a photovoltaic terminal data transmission protection system based on trusted computing is also provided in this embodiment, including:

[0083] The framework building module is used to build a terminal protection framework based on trusted technology. The terminal protection framework includes user space, kernel space, monitoring space and hardware space.

[0084] User space module, used for user space including normal execution space and trusted execution space, which interact with users and exchange data with kernel space;

[0085] The kernel and monitoring space module is used for the kernel space and the monitoring space to work together. The kernel space calls and allocates data resources according to the security assessment results of the monitoring space.

[0086] The hardware space module is used for the hardware space to provide underlying support services for other spaces to achieve transmission protection of photovoltaic terminal data.

[0087] Furthermore, the photovoltaic terminal data transmission protection system also includes: the monitoring space includes a proof agent module, a measurement agent module and a power management service; the hardware space includes photovoltaic system hardware and a trusted digital identity chip; the kernel space includes thread management, file management, system calls and inter-process communication.

[0088] Furthermore, the user space also includes: a normal execution space and a trusted execution space separated by execution environments; the normal execution space includes normal applications; the trusted execution space includes multiple trusted applications and a trusted service module; the trusted service module is used to provide security management functions.

[0089] In an optional embodiment, the photovoltaic terminal data transmission protection system based on trusted computing may perform the following steps:

[0090] When any terminal transmits data with the PV system, it is authenticated according to the proxy module in the monitoring space, generates a measurement root and uploads it to the trusted service platform;

[0091] The trusted service platform provides an access interface to the trusted computing chip. The proxy module initiates a request to the trusted digital identity chip to access the photovoltaic system and establish a transmission channel. After the trusted platform module verifies it, it allocates a specific channel to the terminal device to establish a transmission link for data transmission.

[0092] The proxy modules are the proof proxy module and the measurement proxy module; the proof proxy module is used to determine whether the device has been attacked at the physical level and to confirm that the terminal device has not been tampered with or forged; the measurement proxy module is responsible for the integrity of the terminal device itself, and calculates and submits the measurement root.

[0093] When the terminal device is running, the certification agent module verifies that the physical layer of the device has not been tampered with or forged by requesting the device certificate from a trusted third party, generates a device identity certification report, and provides it to the server;

[0094] When a user requests to access the system, the measurement agent module performs an integrity check on the terminal device based on its own integrity report as a link in the trust chain, and generates a measurement report to participate in the establishment of the trusted chain.

[0095] The trusted service module is based on the trusted digital identity chip to establish and manage a complete trust chain. The trusted digital identity chip includes a hardware module and a control module. The hardware module includes at least a policy implementation component, a policy judgment component, and a storage component. The control module is responsible for coordinating the collaborative operation between various components.

[0096] The trusted service module provides an interactive interface for the terminal device, as well as access rights to the trusted computing function of the trusted digital identity chip; after the trusted digital identity chip receives the authentication request sent by the proxy module and the measurement root generated by the proxy, it compares the trusted root and authorizes the terminal device to prove its own credibility. After the proof is completed, the trusted service module allows the terminal device to use the allocated channel to transmit data with the photovoltaic system, and generates a log and saves it to the database.

[0097] This embodiment further provides a computing device, which is applicable to the photovoltaic terminal data transmission protection method based on trusted computing, including:

[0098] Memory and processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the photovoltaic terminal data transmission protection method based on trusted computing as proposed in the above embodiment.

[0099] This embodiment further provides a storage medium on which a computer program is stored. When the program is executed by a processor, the photovoltaic terminal data transmission protection method based on trusted computing as proposed in the above embodiment is implemented.

[0100] The storage medium proposed in this embodiment and the method for implementing photovoltaic terminal data transmission protection based on trusted computing proposed in the above embodiment belong to the same inventive concept. The technical details not fully described in this embodiment can be found in the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0101] Through the above description of the implementation methods, the technicians in the relevant field can clearly understand that the present invention can be implemented by means of software and necessary general hardware, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ReadOnly, Memory, ROM), random access memory (RandomAccess Memory, RAM), flash memory (FLASH), hard disk or optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform the methods of various embodiments of the present invention.

[0102] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A photovoltaic terminal data transmission protection method based on trusted computing, characterized in that: include: Building a terminal protection framework based on trusted technology, the terminal protection framework includes user space, kernel space, monitoring space and hardware space; The user space includes a common execution space and a trusted execution space, wherein the common execution space and the trusted execution space interact with the user and perform data interaction with the kernel space; The kernel space works in coordination with the monitoring space, and the kernel space calls and allocates data resources according to the security assessment result of the monitoring space; The hardware space provides underlying support services for the other spaces to achieve transmission protection of photovoltaic terminal data.

2. The photovoltaic terminal data transmission protection method based on trusted computing according to claim 1, characterized in that: Also includes: The monitoring space includes a proof agent module, a measurement agent module and a power management service; The hardware space includes photovoltaic system hardware and a trusted digital identity chip; The kernel space includes thread management, file management, system calls and inter-process communication.

3. The photovoltaic terminal data transmission protection method based on trusted computing according to claim 1, characterized in that: The user space also includes: a common execution space and a trusted execution space separated by execution environments; the common execution space includes common applications; the trusted execution space includes multiple trusted applications and a trusted service module; the trusted service module is used to provide security management functions.

4. The photovoltaic terminal data transmission protection method based on trusted computing according to claim 2 or 3, characterized in that: The kernel space calls and allocates data resources according to the security assessment result of the monitoring space, including: when any terminal transmits data with the photovoltaic system, it performs authentication according to the proxy module in the monitoring space, generates a measurement root and uploads it to the trusted service platform; The trusted service platform provides an access interface to the trusted computing chip. The proxy module initiates a request to the trusted digital identity chip to access the photovoltaic system and establish a transmission channel. After the trusted platform module verifies it, it allocates a specific channel to the terminal device to establish a transmission link for data transmission.

5. The photovoltaic terminal data transmission protection method based on trusted computing according to claim 4, characterized in that: Authentication is performed according to the agent modules in the monitoring space, and the measurement root is generated and uploaded to the trusted service platform, including: the agent modules are the certification agent module and the measurement agent module; The proof agent module is used to determine whether the device has been attacked at the physical level and to confirm that the terminal device has not been tampered with or forged; the measurement agent module is responsible for the integrity of the terminal device itself, and calculates and submits the measurement root.

6. The photovoltaic terminal data transmission protection method based on trusted computing according to claim 5, characterized in that: Also includes: When the terminal device is running, the certification agent module verifies that the physical layer of the device has not been tampered with or forged by requesting a device certificate from a trusted third party, generates a device identity certification report, and provides it to the server; When a user requests to access the system, based on its own integrity report as a link in the trust chain, the measurement agent module performs an integrity check on the terminal device and generates a measurement report, thereby participating in the establishment of the trust chain.

7. The photovoltaic terminal data transmission protection method based on trusted computing according to claim 6, characterized in that: Trusted service platform authentication includes: the trusted service module is based on the trusted digital identity chip to establish and manage a complete trust chain, the trusted digital identity chip includes a hardware module and a control module; the hardware module includes at least a policy implementation component, a policy judgment component, and a storage component; the control module is responsible for coordinating the collaborative operation between various components; The trusted service module provides an interactive interface for the terminal device, as well as access rights to the trusted computing function of the trusted digital identity chip; after the trusted digital identity chip receives the authentication request sent by the proxy module and the measurement root generated by the proxy, it compares the trusted root and authorizes the terminal device to prove its own credibility. After the proof is completed, the trusted service module allows the terminal device to use the allocated channel to transmit data with the photovoltaic system, and generates a log and saves it to the database.

8. A photovoltaic terminal data transmission protection system based on trusted computing, characterized in that: include: A framework building module, used to build a terminal protection framework based on trusted technology, wherein the terminal protection framework includes user space, kernel space, monitoring space and hardware space; A user space module, used for the user space including a common execution space and a trusted execution space, wherein the common execution space and the trusted execution space interact with the user and perform data interaction with the kernel space; A kernel and monitoring space module, used for the kernel space and the monitoring space to work together, and the kernel space calls and allocates data resources according to the security assessment result of the monitoring space; The hardware space module is used for the hardware space to provide underlying support services for the other spaces to achieve transmission protection of photovoltaic terminal data.

9. An electronic device, comprising: Memory and processor; The memory is used to store computer executable instructions, and the processor is used to execute the computer executable instructions. When the computer executable instructions are executed by the processor, the steps of the photovoltaic terminal data transmission protection method based on trusted computing as described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the photovoltaic terminal data transmission protection method based on trusted computing as described in any one of claims 1 to 7.

Images