Charging facility data security protection method and system, electronic equipment and storage medium

Abstract

The invention discloses a charging facility data security protection method and system, electronic equipment and a storage medium, and relates to the technical field of information security. The method comprises the following steps: verifying the identity of a vehicle based on a charging request to obtain a verification result; when the verification result is successful, obtaining a charging parameter of a control layer of the target charging pile and a billing parameter of a service layer based on the charging request; generating a first key of a control layer and a second key of a service layer based on the vehicle information of the vehicle and the charging request; performing first encryption processing on the charging parameter based on the first key to obtain first encrypted data, and performing second encryption processing on the charging parameter based on the second key to obtain second encrypted data; and the first encrypted data and the second encrypted data are transmitted to a vehicle terminal of the vehicle after time sequence identifiers are added to the first encrypted data and the second encrypted data. By implementing the technical scheme provided by the invention, the confidentiality of the charging parameter and the billing parameter can be improved, the risks of data leakage, tampering and the like are reduced, and the data security of the charging station is further improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and specifically to a charging facility data security protection method, system, electronic device and storage medium. Background Art

[0002] With the rapid popularization of new energy vehicles, the construction scale of intelligent charging facilities is constantly expanding. Intelligent charging facilities not only need to complete the charging function, but also need to process a large amount of data interaction including charging control instructions, billing data, etc. The security of these data is directly related to the reliability of the charging process and the safety of user property.

[0003] At present, when processing vehicle charging requests, the existing charging facility network usually starts the charging process after a simple identity verification of the vehicle, and the processing of data such as charging parameters and billing parameters is relatively extensive. In terms of data transmission, most of them use plain text or simple encryption, lacking effective security protection mechanisms. Especially in the face of increasingly complex network attacks and security threats, the confidentiality, integrity and availability of charging parameters and billing parameters cannot be guaranteed, which easily leads to data leakage, tampering and other problems, resulting in low data security protection of charging stations. Summary of the invention

[0004] The present application provides a charging facility data security protection method, system, electronic device and storage medium, which can improve the confidentiality of charging parameters and billing parameters, reduce the risks of data leakage and tampering, and further enhance the data security of charging stations.

[0005] In a first aspect, the present application provides a charging facility data security protection method, the method comprising: When receiving a charging request from a vehicle to a target charging pile in a charging station, verifying the identity of the vehicle based on the charging request and obtaining a verification result; When the verification result is successful, the charging parameters of the target charging pile control layer and the billing parameters of the business layer are obtained based on the charging request; Generate a first key of the control layer and a second key of the business layer based on vehicle information and a charging request of the vehicle; Performing a first encryption process on the charging parameter based on the first key to obtain first encrypted data, and performing a second encryption process on the charging parameter based on the second key to obtain second encrypted data; The first encrypted data and the second encrypted data are respectively added with timing identifiers and then transmitted to a vehicle terminal of the vehicle.

[0006] By adopting the above technical solution, when receiving the charging request of the vehicle, the vehicle identity is first verified to ensure the legitimacy of the request source; after the verification, the charging parameters of the control layer and the billing parameters of the business layer are obtained respectively to realize the hierarchical management of data; at the same time, the keys of the control layer and the business layer are generated respectively based on the vehicle information and the charging request, and these keys are used to encrypt the parameters of the corresponding layers to obtain encrypted data, thereby realizing differentiated security protection of data at different levels; finally, by adding a time sequence mark to the encrypted data before transmission, while ensuring the security of data transmission, it also provides the traceability of the data transmission process. This method of combining layered encryption with time sequence transmission not only improves the confidentiality of charging parameters and billing parameters, effectively prevents data leakage and tampering, but also enhances the reliability and integrity of data transmission through the introduction of time sequence marks, thereby comprehensively improving the data security protection level of the charging station.

[0007] In a second aspect of the present application, a charging facility data security protection system is provided, the system comprising: An identity verification module is used to verify the identity of the vehicle based on the charging request when receiving a charging request from the vehicle to the target charging pile in the charging station, and obtain a verification result; A data acquisition module, used to acquire charging parameters of the target charging pile control layer and billing parameters of the business layer based on the charging request when the verification result is successful; A key generation module, used to generate a first key of a control layer and a second key of a business layer based on vehicle information and a charging request of the vehicle; An encryption processing module, configured to perform a first encryption processing on the charging parameter based on the first key to obtain first encrypted data, and perform a second encryption processing on the charging parameter based on the second key to obtain second encrypted data; The data transmission module is used to add timing marks to the first encrypted data and the second encrypted data respectively and then transmit them to the vehicle terminal of the vehicle.

[0008] In a third aspect of the present application, a computer storage medium is provided, wherein the computer storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the above method steps.

[0009] In a fourth aspect of the present application, an electronic device is provided, comprising: a processor and a memory; wherein the memory stores a computer program, and the computer program is suitable for being loaded by the processor and executing the above-mentioned method steps.

[0010] In summary, one or more technical solutions provided in the embodiments of the present application have at least the following technical effects or advantages: This application verifies the identity of the vehicle first upon receiving the charging request from the vehicle to ensure the legitimacy of the source of the request; after the verification, the charging parameters of the control layer and the billing parameters of the business layer are obtained respectively to achieve hierarchical management of data; at the same time, the keys of the control layer and the business layer are generated respectively based on the vehicle information and the charging request, and these keys are used to encrypt the parameters of the corresponding layers to obtain encrypted data, thereby achieving differentiated security protection for data at different levels; finally, by adding a timing mark to the encrypted data before transmitting it, while ensuring the security of data transmission, it also provides the ability to trace the data transmission process. This method of combining layered encryption with timing transmission not only improves the confidentiality of charging parameters and billing parameters, effectively prevents data leakage and tampering, but also enhances the reliability and integrity of data transmission through the introduction of timing marks, thereby comprehensively improving the data security protection level of the charging station. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 It is a flow chart of a charging facility data security protection method provided in an embodiment of the present application; Figure 2 It is a module schematic diagram of a charging facility data security protection system provided by an embodiment of the present application; Figure 3 It is a structural schematic diagram of an electronic device provided in an embodiment of the present application.

[0012] Description of reference numerals: 300, electronic device; 301, processor; 302, communication bus; 303, user interface; 304, network interface; 305, memory. DETAILED DESCRIPTION

[0013] In order to enable technicians in this field to better understand the technical solutions in this specification, the technical solutions in the embodiments of this specification will be clearly and completely described below in conjunction with the drawings in the embodiments of this specification. Obviously, the described embodiments are only part of the embodiments of this application, not all of the embodiments.

[0014] In the description of the embodiments of the present application, words such as "for example" or "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "for example" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "for example" or "for example" is intended to present related concepts in a specific way.

[0015] In the description of the embodiments of the present application, the meaning of the term "multiple" refers to two or more. For example, multiple systems refer to two or more systems, and multiple screen terminals refer to two or more screen terminals. In addition, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance or implicitly indicating the indicated technical features. Thus, the features defined as "first" and "second" may explicitly or implicitly include one or more of the features. The terms "include", "comprise", "have" and their variations all mean "including but not limited to", unless otherwise specifically emphasized.

[0016] The following will provide a clear and complete description of the technical solutions in the embodiments of the present application in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments.

[0017] Please refer to Figure 1 , a flowchart of a charging facility data security protection method is proposed, the method can be implemented by a computer program, can be implemented by a single-chip microcomputer, and can also be run on a charging facility data security protection system. The computer program can be integrated in a computer device, or can be run as an independent tool application. Specifically, the method includes steps 10 to 50, and the above steps are as follows: Step 10: When a charging request from a vehicle to a target charging pile in a charging station is received, the identity of the vehicle is verified based on the charging request to obtain a verification result.

[0018] In the embodiment of the present application, the target charging pile refers to a specific charging pile at which the vehicle requests to charge. The charging pile has two functional levels: a control layer and a business layer. The control layer is used to manage charging parameters during the charging process, and the business layer is used to manage billing parameters during the charging process.

[0019] In the embodiment of the present application, a charging request refers to a data request sent by a vehicle to a charging station. The request includes information such as a vehicle identification code, charging port type, charging mode, target charge amount, and user identification, and is used to apply to the charging station for the use of a specific charging pile for charging.

[0020] Specifically, when the charging station receives a charging request sent by a vehicle through an on-board terminal, it is necessary to first confirm the legitimacy of the requester to prevent illegal users from using charging facilities or malicious attacks. When a charging request from a vehicle to a target charging pile in the charging station is received, two key information, the vehicle identification code and the charging port type, are extracted from the charging request. Among them, the vehicle identification code is the unique identifier of each vehicle, which is used to confirm the true identity of the vehicle; the charging port type contains the specification parameters of the vehicle charging interface, which is used to determine whether the vehicle matches the target charging pile. After obtaining this information, the extracted vehicle identification code is first compared and verified with the vehicle identity database pre-stored in the charging station system. The database stores the identity information of all registered vehicles, and the first verification result can be obtained by querying and comparing. At the same time, the charging port type in the charging request is matched and verified with the charging port type supported by the target charging pile to ensure the physical compatibility of the charging equipment, thereby obtaining the second verification result. Only when both verifications are passed, the system will confirm that the current verification result is verified and allow subsequent charging operations.

[0021] Based on the above embodiment, as an optional embodiment, the identity of the vehicle is verified based on the charging request to obtain a verification result. This step may also include the following steps: Step 101: Obtain the vehicle identification code and charging port type of the vehicle from the charging request.

[0022] Specifically, in order to accurately identify the identity of the vehicle requesting charging, it is first necessary to parse the received charging request. The charging request is encapsulated in a preset data format, which contains multiple data fields. By reading the data header information of the charging request, the storage location of the vehicle identification code field and the charging port type field is located, thereby extracting these two key information. Specifically, the vehicle identification code is usually a 17-digit alphanumeric combination, such as "LVGDM4A58DN071249", and the charging port type may be a standard type such as "GB / T", "CHAdeMO" or "CCS".

[0023] Step 102: Verify the vehicle identification code with a preset vehicle identity database to obtain a first verification result.

[0024] Specifically, after obtaining the vehicle identification code, the preset vehicle identity database in the charging station system is accessed for verification. The database adopts a key-value pair storage structure, in which the vehicle identification code is used as the primary key, which is associated with the vehicle's registration status, charging authority and other information. The verification process first performs a query operation in the database through the vehicle identification code. If a matching record is found, it further checks whether the vehicle's registration status is valid and whether the charging authority is normal. For example, when the record corresponding to the vehicle identification code "LVGDM4A58DN071249" is found to show that the vehicle is in a normal registration state and has charging authority, the system marks the first verification result as verification passed; conversely, if no record is found, or the vehicle status is abnormal, or the authority is restricted, the first verification result is marked as verification failed.

[0025] Step 103: Verify the charging port type and the charging port type supported by the target charging pile to obtain a second verification result.

[0026] Specifically, in order to ensure the physical compatibility and charging safety of the charging equipment, after completing the vehicle identity authentication, the matching of the charging interface needs to be verified. First, the list of charging port types supported by the target charging pile is read from the device configuration information of the target charging pile. The list contains all the charging standard types that the charging pile can support and their corresponding technical parameters, such as voltage level, maximum charging power and other information. Subsequently, the charging port type obtained from the charging request is compared with the list. The verification process is carried out in a multi-dimensional matching manner, which not only confirms the consistency of the charging standard type, but also verifies whether the specific technical parameters meet the requirements. For example, when the charging port type of the vehicle is "GB / T", the system will first check whether the target charging pile supports the "GB / T" standard. If it does, it will further compare whether the voltage level is within the output range of the charging pile. Only when all technical parameters meet the requirements will the system mark the second verification result as passed; if any mismatched parameters are found, the second verification result will be marked as failed.

[0027] Step 104: When both the first verification result and the second verification result are verified to be passed, determine that the verification result is verified to be passed.

[0028] Specifically, the final verification confirmation will be performed only after the first verification result and the second verification result are obtained. The system determines the status of the two verification results through logical AND operations. Only when the vehicle identity verification (first verification result) and the charging port type verification (second verification result) are both in the passed state, the final verification result will be determined as the verification passed. This double verification mechanism ensures that only legal vehicles with matching technical parameters can obtain charging authorization.

[0029] Step 20: When the verification result is successful, the charging parameters of the target charging pile control layer and the billing parameters of the business layer are obtained based on the charging request.

[0030] Specifically, in order to achieve a safe and controllable charging process and accurate cost calculation, after completing identity authentication, it is necessary to extract charging-related parameters from the charging request and perform hierarchical processing. First, the parameter information in the charging request is parsed, including control layer parameters such as target charging amount, maximum charging current, and expected charging time, as well as business layer parameters such as the billing method selected by the user and coupon information. For the control layer parameters, the system will match the target charging amount with the remaining battery capacity fed back by the battery management system, determine the actual executable charging current curve, and dynamically adjust the charging power according to the temperature change during the charging process to ensure charging efficiency and safety. For example, when the target charging amount is set to 40 kWh, the system will formulate a segmented charging strategy based on the current state of the battery, and automatically reduce the charging power after the battery capacity reaches 80% to protect the battery life. For the business layer parameters, the system will combine the billing method selected by the user (such as peak and valley time-of-use billing, prepaid, postpaid, etc.) and the currently applicable preferential policies to calculate the estimated charging cost, and update the billing data in real time during the charging process. For example, when a user chooses peak-valley time-of-use billing and uses a discount coupon, the system will dynamically calculate the fee according to the electricity price and discount rules of different time periods. This hierarchical parameter processing mechanism not only ensures precise control of the charging process, but also provides a flexible billing plan, while improving charging efficiency and user experience through real-time adjustment of parameters.

[0031] Based on the above embodiment, as an optional embodiment, the step of obtaining the charging parameters of the control layer of the target charging pile and the billing parameters of the business layer based on the charging request may also include the following steps: Step 201: Obtain a charging mode and a target charging amount from a charging request, and determine a charging index based on historical charging information of a target charging pile.

[0032] Specifically, in order to achieve scientific and reasonable charging control, it is first necessary to obtain the basic parameters in the charging request and evaluate the performance status of the charging pile. By parsing the data structure of the charging request, the charging mode (such as fast charging mode, standard mode or economic mode) and the target charging amount information set by the user are extracted. At the same time, the historical database of the target charging pile is accessed to obtain the charging records in the recent period, including the number of charging times, the duration of a single charging, the charging power fluctuation and other information. Based on these historical data, the preset evaluation model is used to calculate the charging index, which reflects the current usage status and performance level of the charging pile. For example, when the historical data shows that the charging pile has completed 10 charges in the past 24 hours and the power fluctuation is within the normal range, the system will assess the charging index as an excellent state; on the contrary, if it is found that the charging power often fluctuates abnormally, the charging index will be reduced accordingly. This performance evaluation mechanism based on historical data can timely discover potential problems of charging equipment and provide an important reference for subsequent charging parameter configuration.

[0033] Step 202: Determine charging parameters of the target charging pile after charging according to the charging mode based on the charging index.

[0034] Specifically, in order to ensure the safety and efficiency of the charging process, the charging parameters need to be intelligently adjusted according to the charging index. The system first determines the benchmark charging parameters based on the charging mode, including charging voltage, charging current, power curve, etc., and then dynamically optimizes them in combination with the charging index. For example, when the charging index is in an excellent state, the charging current in the fast charging mode can reach the rated value of the device; when the charging index is low, the system will reduce the upper limit of the charging current accordingly and adjust the climbing rate of the power curve. Through this adaptive parameter adjustment mechanism, the performance of the charging equipment can be fully utilized, and the equipment can be effectively prevented from overloading and the service life of the equipment can be extended.

[0035] Step 203: Determine the charging time required to reach the target charging amount based on the charging mode, and calculate the charging parameters based on the charging time and the unit price corresponding to the charging mode.

[0036] Specifically, in order to accurately calculate the charging cost, it is necessary to scientifically estimate the charging time and determine the cost in combination with the billing strategy. The system first calculates the estimated charging time through an algorithm model based on the power curve and target charging amount corresponding to the charging mode. For example, in fast charging mode, if the target charging amount is 40 kWh, the system will consider the power changes during the charging process and estimate that the charging time will be approximately 40 minutes. Subsequently, combined with the billing standards of different charging modes (such as 1.5 yuan / kWh for fast charging mode and 1.2 yuan / kWh for standard mode), the estimated charging cost and other service fees are calculated to form a complete billing parameter. This intelligent billing method based on the charging mode not only ensures the rationality of billing, but also improves the accuracy of fee calculation.

[0037] Step 204: Store the charging parameters in the control layer, and store the billing parameters in the service layer.

[0038] Specifically, charging parameters such as charging voltage and charging current are written into the parameter table of the control layer for subsequent charging process control; at the same time, charging parameters such as charging fees and billing methods are saved in the database of the business layer for fee settlement and bill generation. This hierarchical storage mechanism not only improves the modularity of the system, but also facilitates the independent maintenance and upgrade of each functional module, improving the scalability and maintainability of the system.

[0039] Step 30: Generate a first key of the control layer and a second key of the business layer based on the vehicle information and the charging request of the vehicle.

[0040] Specifically, in order to ensure the security of the charging process and the reliability of transactions, it is necessary to establish independent encryption mechanisms for the control layer and the business layer. First, based on the vehicle information (including vehicle identification code, charging port type, etc.) and the timestamp, request serial number and other information in the charging request, a preset encryption algorithm is used to generate a key pair. For the control layer, the system uses the vehicle identification code and charging parameters as seeds, and generates the first key through a secure hash algorithm such as SHA-256. The key is used to encrypt the control instructions during the charging process to ensure the security of instruction transmission. For example, when the vehicle identification code is "LVGDM4A58DN071249", the system will combine it with parameters such as charging voltage and current to generate a unique control layer key. For the business layer, the system uses an asymmetric encryption algorithm such as RSA based on the serial number and billing parameters of the charging request to generate a second key to protect the security of transaction data. For example, the system combines the charging request serial number with data such as billing standards and preferential information to generate a business layer key dedicated to this charging transaction. This double-layer encryption mechanism not only achieves the secure isolation of control instructions and transaction data, but also provides differentiated security protection levels through different encryption algorithms, effectively preventing data tampering and illegal access, and improving the safety and reliability of the entire charging process.

[0041] Based on the above embodiment, as another optional embodiment, the step of generating the first key of the control layer and the second key of the business layer based on the vehicle information and the charging request of the vehicle may further include the following steps: Step 301: Extract the vehicle identification code from the vehicle information of the vehicle and obtain the timestamp of the charging request.

[0042] Specifically, in order to generate a unique and secure key, the vehicle's unique identification and time information must first be obtained. By parsing the data structure of the vehicle information, the 17-digit vehicle identification code, such as "LVGDM4A58DN071249", is located and extracted. At the same time, the timestamp information when the request is initiated is read from the data header of the charging request. The timestamp is in Unix timestamp format and is accurate to milliseconds. This combination of vehicle unique identification and precise time provides a unique input source for subsequent key generation.

[0043] Step 302: concatenate the vehicle identification code and the timestamp to obtain a first original key, and perform a hash calculation on the first original key to obtain a first key.

[0044] Specifically, in order to ensure the security of the control layer key, the original information needs to be processed multiple times. First, the extracted vehicle identification code and timestamp are concatenated in a preset format to generate the first original key. For example, "LVGDM4A58DN071249" and "1676438400000" are concatenated to form the original key string. Subsequently, the original key is calculated using a secure hash algorithm such as SHA-256 to generate a hash value of a fixed length as the first key. This processing method based on the hash algorithm not only ensures the uniqueness of the key, but also improves the security strength of the key.

[0045] Step 303: extract the user identifier from the charging request, and obtain the device serial number of the target charging pile.

[0046] Specifically, by parsing the user information field of the charging request, the user's unique identification code is extracted, which may be a mobile phone number or membership number, etc. At the same time, the unique device serial number of the target charging pile is obtained from its device information. This combination of dual identifications ensures the uniqueness and traceability of the business layer key.

[0047] Step 304: perform an XOR operation on the user identification and the device serial number to obtain a second original key, and perform asymmetrical encryption on the second original key to obtain a second key.

[0048] Specifically, in order to improve the security of the business layer key, a combination of XOR operation and asymmetric encryption is adopted. First, a bit-level XOR operation is performed on the user ID and the device serial number to generate the second original key. For example, the user ID "13800138000" is XORed with the device serial number "CP20240215001". Subsequently, the second original key is encrypted using an asymmetric encryption algorithm such as RSA to generate the final second key. This multi-level encryption process ensures the security and non-tamperability of business data.

[0049] Step 305: Store the first key and the second key in the key table of the control layer and the key table of the business layer respectively.

[0050] Specifically, in order to achieve effective management and use of keys, a hierarchical key storage mechanism needs to be established. The system writes the generated first key into the key table of the control layer for encryption and verification of subsequent charging control instructions; at the same time, the second key is stored in the key table of the business layer for encryption and security verification of transaction data. This hierarchical storage method not only achieves the security isolation of the control layer and the business layer, but also facilitates the update and management of keys, improving the security and maintainability of the system.

[0051] Step 40: Perform a first encryption process on the charging parameters based on the first key to obtain first encrypted data, and perform a second encryption process on the billing parameters based on the second key to obtain second encrypted data.

[0052] Specifically, in order to ensure the safe transmission of control instructions and transaction data during the charging process, the charging parameters and billing parameters need to be encrypted separately. For the charging parameters of the control layer, the first key is first read from the key table of the control layer, and then the parameters such as the charging voltage and charging current are serialized according to the preset data format to form a data packet to be encrypted. Subsequently, a symmetric encryption algorithm such as AES-256 is used to encrypt the data packet with the first key as the encryption key to generate the first encrypted data. For example, when the charging parameters contain information such as "voltage 220V, current 10A", the system will convert it into a binary data stream, and then generate ciphertext through the symmetric encryption algorithm. For the billing parameters of the business layer, the system obtains the second key from the key table of the business layer, and encapsulates the billing information such as the charging rate and the discount amount in a structured manner, and then uses an asymmetric encryption algorithm such as RSA to encrypt the data with the public key part of the second key to generate the second encrypted data. For example, when the billing parameters contain information such as "unit price 1.5 yuan / kWh, discount amount 10 yuan", the system will convert it into a data structure in a standard format, and then generate ciphertext through an asymmetric encryption algorithm. This layered encryption mechanism not only achieves the secure isolation of control data and business data, but also provides differentiated security protection levels through different encryption algorithms, effectively preventing data from being stolen or tampered with during transmission, and improving the safety and reliability of the entire charging process. At the same time, due to the use of efficient encryption algorithms, the encryption process has a small time overhead and will not affect the normal operation of the charging business.

[0053] Based on the above embodiment, as another optional embodiment, the step of performing a first encryption process on the charging parameter based on the first key to obtain the first encrypted data, and performing a second encryption process on the billing parameter based on the second key to obtain the second encrypted data may also include the following steps: Step 401: Calculate the data entropy values ​​of charging parameters and billing parameters.

[0054] Specifically, in order to evaluate the complexity of the data and select a suitable encryption strategy, it is necessary to perform entropy analysis on the parameter data. The system first converts the charging parameters (such as charging voltage, current, etc.) and billing parameters (such as rates, discounts, etc.) into binary sequences, and then uses the information entropy calculation formula to analyze the data. For example, for the charging parameters "voltage 220V, current 10A", the system will count the probability distribution of different bits and calculate its information entropy value according to the Shannon entropy formula; the same method is also used to calculate the entropy value of the billing parameters. This information entropy-based evaluation method can accurately reflect the randomness and complexity of the data, and provide a scientific basis for the subsequent selection of encryption strategies.

[0055] Step 402: When the data entropy value is greater than a preset threshold, the first key and the second key are processed in segments to obtain multiple sub-keys.

[0056] Specifically, in order to improve the encryption strength, a segmented encryption strategy needs to be adopted when the data complexity is high. The system sets a preset threshold (such as 4.5 bits / byte). When the calculated entropy value exceeds the threshold, the key segmentation mechanism is activated. For the first key, the system divides it into multiple sub-key fragments according to the preset segment length (such as 32 bytes); for the second key, it is modularly decomposed according to the structural characteristics of the RSA key. For example, the 256-bit first key is evenly divided into 8 32-bit sub-keys, each of which is responsible for encrypting a specific range of data. This segmented processing mechanism not only improves the utilization efficiency of the key, but also increases the complexity of the encryption process.

[0057] Step 403: construct an encryption chain based on each subkey, and determine different encryption algorithms in the encryption chain according to the size of the data entropy value.

[0058] Specifically, in order to achieve multi-level security protection, it is necessary to build a flexible encryption algorithm chain. The system first assembles the subkeys obtained by segmentation into an encryption chain in a preset order, and then assigns encryption algorithms of different strengths to each encryption link according to the size of the data entropy value. For example, when the entropy value of a certain segment of data is high, the AES-256 algorithm with higher computational intensity is used; when the entropy value is at a medium level, the lightweight ChaCha20 algorithm is selected; when the entropy value is low, a simple XOR encryption algorithm is used. This dynamic algorithm selection mechanism based on entropy value not only ensures encryption strength, but also optimizes the efficiency of computing resources.

[0059] Step 404: Encrypt the charging parameters and the billing parameters based on the corresponding encryption algorithm to obtain first encrypted data and second encrypted data.

[0060] Specifically, in order to complete the secure encryption of data, it is necessary to perform encryption operations in the order of the constructed encryption chain. The system first divides the charging parameters into multiple data blocks according to the data structure, and then uses the corresponding algorithm and subkey in the encryption chain to encrypt them in sequence. The output of each encryption link is used as the input of the next link to finally generate the first encrypted data. The same process is also applied to the encryption of billing parameters, and the second encrypted data is finally generated through multiple rounds of encryption conversion. For example, for the charging voltage data, the first subkey and the AES-256 algorithm are first used for encryption, and then the ciphertext is encrypted with the second subkey and the ChaCha20 algorithm, and so on until the entire encryption process is completed. This chain encryption mechanism not only provides multi-layer security protection, but also achieves a balance between security and efficiency through the reasonable combination of algorithms, effectively ensuring the security of the data transmission process.

[0061] Step 50: Add timing marks to the first encrypted data and the second encrypted data respectively and transmit them to the vehicle terminal of the vehicle.

[0062] Specifically, in order to ensure the orderly transmission and timeliness verification of encrypted data, it is necessary to perform time marking and standardized transmission on the encrypted data. The system first generates a timestamp accurate to the millisecond level and adds it as a time identification to the data header of the first encrypted data and the second encrypted data. For example, the current timestamp is "1676438400000", and the system combines it with the first encrypted data to form a complete data packet, including a data packet header (timestamp), a data payload (encrypted charging parameters) and a checksum; the same processing method is also applied to the second encrypted data to form a complete data packet containing billing parameters. Subsequently, the system transmits these two data packets with time identification to the vehicle terminal through a preset secure communication channel (such as a TLS encrypted channel). After receiving the data packet, the vehicle terminal first verifies the validity of the time identification to ensure the timeliness of the data, for example, setting a time window of 5 seconds. If the time difference between the receiving time and the time identification exceeds the window threshold, the data is determined to be expired and requires retransmission. For the data packets that pass the verification, the vehicle terminal stores them in the control cache and the business cache respectively for subsequent charging control and cost calculation. This transmission mechanism based on timing identification not only ensures the orderliness and real-time nature of data, but also improves the efficiency of data processing through partitioned storage, providing reliable guarantee for the smooth progress of the charging process. At the same time, the complete data packet format and strict timeliness verification mechanism also effectively prevent replay attacks and data tampering, improving the safety of the entire charging system.

[0063] Based on the above embodiment, as another optional embodiment, the step of adding a timing mark to the first encrypted data and the second encrypted data and then transmitting them to the vehicle terminal of the vehicle may further include the following steps: Step 501: Generate incremental timing sequence numbers based on the first encrypted data and the second encrypted data, and combine each timing sequence number with a charging session identifier to generate a timing identifier.

[0064] Specifically, independent serial number counters are set for the first encrypted data and the second encrypted data, respectively, and the timing sequence number is generated incrementally starting from 1. For example, for the control instruction of the first encrypted data, a serial number in the form of "SEQ_001" is generated; for the billing information of the second encrypted data, a serial number in the form of "SEQ_002" is generated. At the same time, the system will generate a unique session identifier, such as "SESSION_20240215_001", when the charging session is established. Subsequently, the timing sequence number and the session identifier are combined in a preset format to generate a complete timing identifier, such as "SESSION_20240215_001_SEQ_001". This combined timing identification mechanism not only ensures the uniqueness and traceability of the data packet, but also provides a reliable basis for breakpoint resumption of data.

[0065] Step 502: Encapsulate the corresponding timing identifiers into the data headers of the first encrypted data and the second encrypted data respectively, and transmit the encapsulated data packets to the vehicle terminal of the vehicle in a hierarchical manner according to a preset transmission priority, wherein the transmission priority of the first encrypted data is higher than that of the second encrypted data.

[0066] Specifically, the generated timing identifier is added to the data packet header of the corresponding encrypted data to form a standard data transmission format. In addition to the timing identifier, the data packet header also contains information such as the data type mark and data length. Subsequently, the system sets the transmission priority according to the importance of the data, sets the first encrypted data involving charging control to the highest priority (such as Priority-1), and sets the second encrypted data involving billing to the secondary priority (such as Priority-2). During the actual transmission process, the system prioritizes the processing and sending of Priority-1 level data packets to ensure the timely delivery of charging control instructions; after the control data transmission is completed, the Priority-2 level billing data packet is transmitted. This hierarchical transmission mechanism effectively guarantees the real-time control requirements of the charging process, while also taking into account the reliable transmission of business data.

[0067] Step 503: Monitor the data receiving status of the vehicle terminal. When data transmission interruption is detected, determine the interruption position based on the timing identifier, and retransmit data from the interruption position until the vehicle terminal returns a reception confirmation message.

[0068] Specifically, the system monitors the communication status with the vehicle terminal in real time through the heartbeat packet. When it detects three consecutive heartbeat packet timeouts or receives an abnormal response from the terminal, it determines that the transmission is interrupted. At this time, the system accurately locates the location of the transmission interruption based on the timing identifier of the last successfully received data packet. For example, if the timing identifier of the last successfully received data packet is "SESSION_20240215_001_SEQ_010", the system will prepare to retransmit the data starting from sequence number 11. During the retransmission process, the system still follows the priority transmission strategy, retransmits the first encrypted data first, and continues to retransmit the second encrypted data after the vehicle terminal returns confirmation information (such as ACK message). This breakpoint-resume transmission mechanism based on timing identifiers not only improves the reliability of data transmission, but also avoids unnecessary data retransmission and improves transmission efficiency by accurately locating the interruption location. At the same time, the strict confirmation mechanism also ensures the integrity and accuracy of data transmission.

[0069] Based on the above embodiment, as another optional embodiment, a charging facility data security protection method may also include the following process: Specifically, in order to detect potential security threats in a timely manner, the system needs to monitor the data decryption process in real time. The system sets a decryption failure counter to record the number of consecutive decryption failures. When the number of failures reaches a preset value (such as 3 times), the security warning mechanism is activated. The system calculates the current communication delay by measuring the round-trip time from the sending of the data packet to the receiving confirmation. For example, the normal delay range is within 50ms. When a decryption anomaly is detected, the system generates a first-level security warning data packet containing information such as the number of decryption failures, communication delay, and timestamp. This timely anomaly monitoring mechanism provides early warning support for system security protection.

[0070] When it is detected that the communication delay exceeds the preset safety threshold (such as 200ms) and an abnormal decryption request occurs at the same time (such as the use of an invalid key or an illegal format of decryption instructions), the system determines that there are major safety hazards in the current charging process. At this time, the system immediately switches the target charging pile to the restricted charging mode, limits the charging power to no more than 30% of the rated power, and sets a maximum charging time limit. At the same time, the system generates a second-level safety warning, recording the characteristic information of the abnormal decryption request, the delay data, and the charging status after the switch. This hierarchical response mechanism not only ensures system security, but also avoids the complete interruption of charging services.

[0071] In addition, in order to accurately assess the level of security threats, the system needs to establish a comprehensive risk assessment mechanism. The system first sets weight coefficients for different types of warning information, such as a first-level warning weight of 0.3 and a second-level warning weight of 0.5. At the same time, the credibility of the vehicle identity verification results is scored, including factors such as the verification pass rate and historical charging records, with a weight of 0.2. Based on these factors, the system uses a weighted calculation method to generate a security risk score of 0-100. For example, when there are multiple first-level warnings, at least one second-level warning, and there are abnormalities in vehicle identity verification, the system may generate a high-risk score of more than 85 points.

[0072] When the security risk score exceeds the preset emergency threshold (such as 90 points), the system immediately triggers the highest level of security warning. First, the system cuts off all data communication links with the suspicious vehicle terminal through the communication management module and stops data exchange. Subsequently, the system integrates all relevant abnormal information, including warning records, risk score change trends, abnormal behavior characteristics (such as the time distribution and characteristic patterns of illegal decryption attempts), and generates a security event report in a standard format. The system uploads the report to the charging station management system in real time through a secure channel for subsequent security analysis and disposal. This multi-level security protection mechanism can not only effectively prevent potential security threats, but also provide an important basis for the optimization of security strategies through detailed event records and analysis.

[0073] See also Figure 2 , is a module schematic diagram of a charging facility data security protection system provided in an embodiment of the present application, wherein the system includes: An identity verification module is used to verify the identity of the vehicle based on the charging request when receiving a charging request from the vehicle to the target charging pile in the charging station, and obtain a verification result; A data acquisition module, used to acquire charging parameters of the target charging pile control layer and billing parameters of the business layer based on the charging request when the verification result is successful; A key generation module, used to generate a first key of a control layer and a second key of a business layer based on vehicle information and a charging request of the vehicle; An encryption processing module, configured to perform a first encryption processing on the charging parameter based on the first key to obtain first encrypted data, and perform a second encryption processing on the charging parameter based on the second key to obtain second encrypted data; The data transmission module is used to add timing marks to the first encrypted data and the second encrypted data respectively and then transmit them to the vehicle terminal of the vehicle.

[0074] Optionally, the identity authentication module is further used to obtain the vehicle identification code and charging port type of the vehicle from the charging request; Verifying the vehicle identification code with a preset vehicle identity database to obtain a first verification result; Verify the charging port type and the charging port type supported by the target charging pile to obtain a second verification result; When both the first verification result and the second verification result are verified to be passed, the verification result is determined to be verified to be passed.

[0075] Optionally, the data acquisition module is further used to obtain a charging mode and a target charging amount from a charging request, and determine a charging index based on historical charging information of a target charging pile; Determine charging parameters of the target charging pile after charging according to the charging mode based on the charging index; Determine the charging time required to reach the target charging amount based on the charging mode, and calculate the charging parameters based on the charging time and the unit price corresponding to the charging mode; The charging parameters are stored in the control layer, and the billing parameters are stored in the business layer.

[0076] Optionally, the key generation module is further used to extract the vehicle identification code from the vehicle information of the vehicle and obtain the timestamp of the charging request; The vehicle identification code and the timestamp are concatenated to obtain a first original key, and the first original key is hashed to obtain a first key; Extract the user ID from the charging request and obtain the device serial number of the target charging pile; Performing an XOR operation on the user identification and the device serial number to obtain a second original key, and asymmetrically encrypting the second original key to obtain a second key; The first key and the second key are stored in the key table of the control layer and the key table of the business layer respectively.

[0077] Optionally, the encryption processing module is also used to calculate the data entropy value of the charging parameters and the billing parameters; When the data entropy value is greater than a preset threshold, the first key and the second key are processed in segments to obtain multiple subkeys; Construct an encryption chain based on each subkey, and determine different encryption algorithms in the encryption chain according to the size of the data entropy value; The charging parameters and the charging parameters are encrypted based on the corresponding encryption algorithms to obtain first encrypted data and second encrypted data.

[0078] Optionally, the data transmission module is further used to generate an incremental timing sequence number based on the first encrypted data and the second encrypted data, and combine each timing sequence number with the charging session identifier to generate a timing identifier; Encapsulating the corresponding timing identifiers into the data headers of the first encrypted data and the second encrypted data, respectively, and transmitting the encapsulated data packets to the vehicle terminal of the vehicle in a hierarchical manner according to a preset transmission priority, wherein the transmission priority of the first encrypted data is higher than that of the second encrypted data; Monitor the data reception status of the vehicle terminal. When a data transmission interruption is detected, determine the interruption position based on the timing identifier, and retransmit the data from the interruption position until the vehicle terminal returns a reception confirmation message.

[0079] Optionally, the data transmission module is further used to monitor the decryption process of the first encrypted data and the second encrypted data in real time, and when a preset number of decryption failures occur, calculate the current communication delay and generate a first-level security warning; When the communication delay exceeds the preset safety threshold and an abnormal decryption request is detected, the target charging pile is switched to the restricted charging mode and a second-level safety warning is generated; Based on the first-level security warning and the second-level security warning, combined with the vehicle's identity verification results, a security risk score is constructed; When the safety risk score reaches the emergency threshold, the third-level safety warning is triggered, the data communication link with the vehicle terminal is cut off, and the corresponding warning information, safety risk score and abnormal behavior characteristics are reported to the charging station management system.

[0080] It should be noted that: when the system provided in the above embodiment realizes its functions, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device is divided into different functional modules to complete all or part of the functions described above. In addition, the system and method embodiments provided in the above embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

[0081] An embodiment of the present application also provides a computer storage medium, which can store multiple instructions. The instructions are suitable for being loaded by a processor and executing a charging facility data security protection method of the above embodiment. The specific execution process can be found in the specific description of the above embodiment, which will not be repeated here.

[0082] Please refer to Figure 3 The application also discloses an electronic device. Figure 3 The electronic device 300 may include: at least one processor 301 , at least one network interface 304 , a user interface 303 , a memory 305 , and at least one communication bus 302 .

[0083] The communication bus 302 is used to realize the connection and communication between these components.

[0084] The user interface 303 may include a display screen (Display) and a camera (Camera). Optionally, the user interface 303 may also include a standard wired interface and a wireless interface.

[0085] The network interface 304 may optionally include a standard wired interface or a wireless interface (such as a WI-FI interface).

[0086] Among them, the processor 301 may include one or more processing cores. The processor 301 uses various interfaces and lines to connect various parts in the entire server, and executes various functions of the server and processes data by running or executing instructions, programs, code sets or instruction sets stored in the memory 305, and calling data stored in the memory 305. Optionally, the processor 301 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 301 can integrate one or a combination of a central processing unit (Central Processing Unit, CPU), a graphics processing unit (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 301, and it can be implemented separately through a chip.

[0087] Among them, the memory 305 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory). Optionally, the memory 305 includes a non-transitory computer-readable storage medium. The memory 305 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 305 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as a touch function, a sound playback function, an image playback function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 305 may optionally also be at least one storage device located away from the aforementioned processor 301. Refer to Figure 3 , the memory 305 as a computer storage medium may include an operating system, a network communication module, a user interface module and an application program of a charging facility data security protection method.

[0088] exist Figure 3 In the electronic device 300 shown, the user interface 303 is mainly used to provide an input interface for the user and obtain the data input by the user; and the processor 301 can be used to call an application program storing a charging facility data security protection method in the memory 305. When executed by one or more processors 301, the electronic device 300 executes one or more methods in the above-mentioned embodiments. It should be noted that for the aforementioned method embodiments, for the sake of simple description, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited to the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required for the present application.

[0089] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0090] In the several embodiments provided in this application, it should be understood that the disclosed devices can be implemented in other ways. For example, the device embodiments described above are only schematic, such as the division of units, which is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some service interfaces, and the indirect coupling or communication connection of devices or units can be electrical or other forms.

[0091] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0092] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0093] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable memory. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a memory and includes several instructions for a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the various embodiments of the present application. The aforementioned memory includes: various media that can store program codes, such as USB flash drives, mobile hard drives, magnetic disks or optical disks.

[0094] The above are only exemplary embodiments of the present disclosure and cannot be used to limit the scope of the present disclosure. That is, any equivalent changes and modifications made according to the teachings of the present disclosure are still within the scope of the present disclosure. After considering the disclosure of the specification and the truth of practice, those skilled in the art will easily think of other embodiments of the present disclosure.

[0095] This application is intended to cover any variation, use or adaptation of the present disclosure, which follows the general principles of the present disclosure and includes common knowledge or customary technical means in the art not described in the present disclosure. The description and examples are to be regarded as exemplary only, and the scope and spirit of the present disclosure are defined by the claims.

Claims

1. A charging facility data security protection method, characterized in that: Methods include: When receiving a charging request from a vehicle to a target charging pile in a charging station, verifying the identity of the vehicle based on the charging request and obtaining a verification result; When the verification result is successful, the charging parameters of the target charging pile control layer and the billing parameters of the business layer are obtained based on the charging request; Generate a first key of the control layer and a second key of the business layer based on vehicle information and a charging request of the vehicle; Performing a first encryption process on the charging parameter based on the first key to obtain first encrypted data, and performing a second encryption process on the charging parameter based on the second key to obtain second encrypted data; The first encrypted data and the second encrypted data are respectively added with timing identifiers and then transmitted to a vehicle terminal of the vehicle.

2. The charging facility data security protection method according to claim 1, characterized in that: The identity of the vehicle is verified based on the charging request, and a verification result is obtained, including: Get the vehicle identification number and charging port type of the vehicle from the charging request; Verifying the vehicle identification code with a preset vehicle identity database to obtain a first verification result; Verify the charging port type and the charging port type supported by the target charging pile to obtain a second verification result; When both the first verification result and the second verification result are verified to be passed, the verification result is determined to be verified to be passed.

3. The charging facility data security protection method according to claim 1, characterized in that: Based on the charging request, the charging parameters of the target charging pile control layer and the billing parameters of the business layer are obtained, including: Obtaining a charging mode and a target charging amount from a charging request, and determining a charging index based on historical charging information of a target charging pile; Determine charging parameters of the target charging pile after charging according to the charging mode based on the charging index; Determine the charging time required to reach the target charging amount based on the charging mode, and calculate the charging parameters based on the charging time and the unit price corresponding to the charging mode; The charging parameters are stored in the control layer, and the billing parameters are stored in the business layer.

4. The charging facility data security protection method according to claim 1, characterized in that: Generate a first key of the control layer and a second key of the business layer based on vehicle information and a charging request of the vehicle, including: Extract the vehicle identification code from the vehicle's vehicle information and obtain the timestamp of the charging request; The vehicle identification code and the timestamp are concatenated to obtain a first original key, and the first original key is hashed to obtain a first key; Extract the user ID from the charging request and obtain the device serial number of the target charging pile; Performing an XOR operation on the user identification and the device serial number to obtain a second original key, and asymmetrically encrypting the second original key to obtain a second key; The first key and the second key are stored in the key table of the control layer and the key table of the business layer respectively.

5. The charging facility data security protection method according to claim 1, characterized in that: Performing a first encryption process on the charging parameter based on the first key to obtain first encrypted data, and performing a second encryption process on the charging parameter based on the second key to obtain second encrypted data, including: Calculate the data entropy value of charging parameters and billing parameters; When the data entropy value is greater than a preset threshold, the first key and the second key are processed in segments to obtain multiple subkeys; Construct an encryption chain based on each subkey, and determine different encryption algorithms in the encryption chain according to the size of the data entropy value; The charging parameters and the charging parameters are encrypted based on the corresponding encryption algorithms to obtain first encrypted data and second encrypted data.

6. The charging facility data security protection method according to claim 1, characterized in that: The method of adding a timing mark to the first encrypted data and the second encrypted data respectively and transmitting the data to a vehicle terminal of the vehicle comprises: Generate an incremental timing sequence number based on the first encrypted data and the second encrypted data, respectively, and combine each timing sequence number with the charging session identifier to generate a timing identifier; Encapsulating the corresponding timing identifiers into the data headers of the first encrypted data and the second encrypted data, respectively, and transmitting the encapsulated data packets to the vehicle terminal of the vehicle in a hierarchical manner according to a preset transmission priority, wherein the transmission priority of the first encrypted data is higher than that of the second encrypted data; Monitor the data reception status of the vehicle terminal. When a data transmission interruption is detected, determine the interruption position based on the timing identifier, and retransmit the data from the interruption position until the vehicle terminal returns a reception confirmation message.

7. The charging facility data security protection method according to claim 1, characterized in that: The method further comprises: Monitor the decryption process of the first encrypted data and the second encrypted data in real time, and when a preset number of decryption failures occur, calculate the current communication delay and generate a first-level security warning; When the communication delay exceeds the preset safety threshold and an abnormal decryption request is detected, the target charging pile is switched to the restricted charging mode and a second-level safety warning is generated; Based on the first-level security warning and the second-level security warning, combined with the vehicle's identity verification results, a security risk score is constructed; When the safety risk score reaches the emergency threshold, the third-level safety warning is triggered, the data communication link with the vehicle terminal is cut off, and the corresponding warning information, safety risk score and abnormal behavior characteristics are reported to the charging station management system.

8. A charging facility data security protection system, characterized in that: The system includes: An identity verification module is used to verify the identity of the vehicle based on the charging request when receiving a charging request from the vehicle to the target charging pile in the charging station, and obtain a verification result; A data acquisition module, used to acquire charging parameters of the target charging pile control layer and billing parameters of the business layer based on the charging request when the verification result is successful; A key generation module, used to generate a first key of a control layer and a second key of a business layer based on vehicle information and a charging request of the vehicle; An encryption processing module, configured to perform a first encryption processing on the charging parameter based on the first key to obtain first encrypted data, and perform a second encryption processing on the charging parameter based on the second key to obtain second encrypted data; The data transmission module is used to add timing marks to the first encrypted data and the second encrypted data respectively and then transmit them to the vehicle terminal of the vehicle.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a plurality of instructions, and the instructions are suitable for being loaded by a processor and executing the method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: It includes a processor, a memory, a user interface and a network interface, the memory is used to store instructions, the user interface and the network interface are used to communicate with other devices, and the processor is used to execute the instructions stored in the memory so that the electronic device executes the method as claimed in any one of claims 1 to 7.

Images