A client information system and intelligent meter secure interaction method, medium and terminal

Abstract

The application is suitable for the field of information security technology, and relates to a customer information system and a smart meter security interaction method, medium and terminal. The application has simple process and convenient operation. Through end-to-end technical security measures, encryption and decryption and signature verification are performed on the data transmitted between the customer information system of the source endpoint and the smart meter of the destination endpoint. The intermediate systems cannot decrypt, and do not need to decrypt and verify the signature without the key and the public key certificate. The uppermost layers of the two are application layer end-to-end APDU (application layer protocol data unit). The security of the information is not affected by the number and reliability of the intermediate systems. The application solves the problems that the privacy is easily leaked and the anti-attack strength is insufficient due to multiple encryption and decryption and signature verification in the communication process of the customer information system and the smart meter, and effectively improves the data security and the anti-attack property.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and in particular relates to a secure interaction method, medium and terminal for customer information systems and smart meters. Background Technology

[0002] As society progresses, people are increasingly aware of the importance of protecting their privacy in all aspects of their lives. The General Data Protection Regulation (GDPR), which came into effect in the European Union in 2018, aims to strengthen the protection of personal data. The GDPR applies to all processes involving residents' personal data. As one of the world's strictest data protection regulations, the GDPR has broad binding force on activities involving the processing of personal data, including information closely related to people's daily lives, such as meter readings.

[0003] Smart meter data involves personal data, especially when this data can directly or indirectly identify specific individuals or households. Therefore, the processing of metering data needs to comply with GDPR regulations, particularly in the collection, storage, transmission, and sharing of data. Compliance measures should be implemented to ensure adequate protection of user privacy while meeting business needs. On the other hand, the tampering of metering data or the attack on parameters by hackers is a serious cybersecurity and public safety issue, which can lead to inaccurate electricity, water, and gas billing, data corruption, and even the paralysis of the power grid system. Tampering with electricity consumption data can also lead to incorrect power grid load forecasting, threatening the stability of the power system. Existing technologies have adopted various measures to protect the security of meter data and parameters, such as secure authentication when establishing communication connections, AES encryption and decryption, and ECDSA digital signatures. However, these protective measures are applied between the smart meter and the meter reading system or even the data concentrator, rather than directly between the smart meter and the customer information system ultimately used by the utility company. In practical applications, multiple encryption, decryption, and signature verifications are required, resulting in low data security and attack resistance. The patent with announcement number CN113423100B provides a method, system and device for NB meter verification based on AES encryption. In this patent, the meter parameters and registration information are also encrypted with AES and then sent to the NB platform server after decryption. Multiple encryption and decryption operations are performed between the meter and the server, resulting in low data security and the same drawbacks as existing technologies.

[0004] Therefore, how to provide a secure interaction method for end-to-end customer information systems and smart meters to improve data security and attack resistance is an urgent problem to be solved by those in this technical field. Summary of the Invention

[0005] To address the shortcomings of existing technologies, the present invention aims to provide a secure interaction method between a customer information system and a smart meter, thereby solving the problem that in the actual interaction between a customer information system and a smart meter, each intermediate system needs to perform multiple encryption / decryption and signature verifications, resulting in low data security and attack resistance. In addition, the present invention also provides a secure interaction medium and terminal for a customer information system and a smart meter.

[0006] To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0007] In a first aspect, the present invention provides a secure interaction method between a customer information system and a smart meter, comprising the following steps:

[0008] S10. The customer information system selects parameters from the end-to-end parameter setting list and determines whether the parameter security configuration is AES128 (Advanced Encryption Standard) and elliptic curve P256. If yes, the customer information system generates a key pair of a temporary private key deu1 and a temporary public key Qeu1 based on elliptic curve P256, and selects a P256 certificate and private key. If no, it generates a key pair of a temporary private key deu1 and a temporary public key Qeu1 based on elliptic curve P384, and selects a P384 certificate and private key.

[0009] S20. The customer information system uses the temporary private key deu1 and the static public key Qsv1 of the stored smart meter key negotiation public key certificate to generate a shared secret value Z1. Using the customer information system name and meter number, a temporary encryption key K1 is derived from the shared secret value Z1, and the temporary encryption key K1 is used to encrypt the parameter plaintext to generate parameter ciphertext.

[0010] S30. Arrange the temporary public key Qeu1 and the parameter ciphertext into the application layer APDU (Application Layer Protocol Data Unit). Use the digital signature private key of the customer information system to sign the customer information system name, instrument number, temporary public key Qeu1, parameter length, and parameter ciphertext to form the downlink application layer APDU. Add an upper computer communication support layer to the downlink application layer APDU and transmit it to the smart instrument through various intermediate systems.

[0011] S40. The smart meter processes the DLMS support layer to obtain the downlink application layer APDU. The smart meter queries the end-to-end parameter security configuration options and determines whether the parameter security configuration options are AES128 and elliptic curve P256. If yes, the smart meter selects the P256 certificate and private key; if not, the smart meter selects the P384 certificate and private key.

[0012] S50: The smart meter uses the static public key of the digital signature public key certificate of the customer information system to perform digital signature verification on the received information. If the verification is successful, it uses the smart meter's private key dsv1 for key negotiation and the temporary public key Qeu1 of the received data frame to generate the same shared key value Z1. Using the customer information system name and meter number, it derives the same temporary decryption key K1 from the shared key value Z1. It uses the temporary decryption key K1 to decrypt the parameter plaintext to generate the parameter plaintext and respond with a correct code. If the verification fails, it responds with an error code.

[0013] The S60 and smart meter generate dynamic keys, encrypt them, generate digital signatures, and form an uplink application layer APDU. A DLMS support layer is added outside the uplink application layer APDU, and the data is transmitted to the customer information system through various intermediate systems.

[0014] Furthermore, in S10, the customer information system selects the corresponding parameter type according to the end-to-end parameter setting list, determines its latest specific value, and arranges the hexadecimal plaintext value of the parameter and the length byte of the parameter in the encoding, with the length byte first and the plaintext parameter waiting to be encrypted later; the customer information system arranges its own name and the number of the instrument to be set in sequence before the length byte of the parameter.

[0015] Furthermore, in step S30, the signature value is appended to the parameter ciphertext; finally, the downlink label 0xE1 is appended to the beginning to form the downlink application layer APDU.

[0016] Furthermore, in S50, the information to be verified includes the customer information system name, instrument number, temporary public key Qeu1, parameter length, parameter ciphertext, and the end-to-end uplink tag is 0xE2.

[0017] Furthermore, the elliptic curve used by the customer information system is the same as that used by the smart meter. Therefore, the shared secret value Z1 obtained by the customer information system after calculation is equal to the shared secret value Z1 obtained by the smart meter after calculation. The derived parameters and their order used by the smart meter are the same as those used by the customer information system, and both are derived from the shared secret value Z1. Therefore, the temporary decryption key K1 derived by the smart meter is also equal to the temporary encryption key K1 derived by the customer information system.

[0018] Furthermore, the end-to-end confidentiality management class defined within the customer information system and smart meters includes a class name, a list of end-to-end configured parameters, a security configuration for end-to-end configured parameters, a list of end-to-end read data, and various security credentials. The class name is a string, the parameter list is an array, the security configuration for end-to-end configured parameters uses AES128 and elliptic curve P256, and AES256 and elliptic curve P384 data types, the data list for end-to-end read data is an array, and the security configuration for end-to-end configured parameters uses AES128 and elliptic curve P256, and AES256 and elliptic curve P384 data types. Each security credential is a structure.

[0019] Furthermore, the security credentials of the customer information system include the P256 digital signature public key certificate, the P256 digital signature private key, the P256 key negotiation public key certificate, the P256 key negotiation private key, the P256 digital signature public key certificate, the P256 key negotiation public key certificate, the P256 key negotiation public key certificate, the P384 digital signature public key certificate, the P384 digital signature private key, the P384 key negotiation public key certificate, the P384 key negotiation private key, the P384 key signature public key certificate, and the P384 key negotiation public key certificate for the end-to-end customer information system.

[0020] The security credentials for the smart meter include the P256 digital signature public key certificate, the P256 digital signature private key, the P256 key negotiation public key certificate, the P256 key negotiation private key, the P256 digital signature public key certificate, the P256 key negotiation public key certificate, the P256 key negotiation public key certificate, the P384 digital signature public key certificate, the P384 digital signature private key, the P384 key negotiation public key certificate, the P384 key negotiation private key, the P384 digital signature public key certificate, and the P384 key negotiation public key certificate for the end-to-end customer information system.

[0021] Furthermore, each intermediate system receives a complete communication frame from the customer information system, parses and strips the communication support layer to obtain the application layer APDU. According to the APDU's tag 0xE1, it is an end-to-end application layer APDU, which is directly sent to the smart instrument. Each intermediate system does not process this application layer APDU, but only adds the DLMS support layer of the instrument communication network to the APDU and forwards it to the smart instrument. Each intermediate system does not perform any digital signature verification, calculation, or decryption on the end-to-end application layer APDU.

[0022] In a second aspect, the present invention also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the method described above.

[0023] Thirdly, the present invention also provides an electronic terminal, comprising: a processor and a memory; the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to cause the terminal to perform the method described above.

[0024] Compared with existing technologies, the secure interaction method, medium, and terminal for customer information systems and smart meters provided by this invention have at least the following advantages:

[0025] In existing technologies, customer information systems and smart meters require multiple encryption / decryption and signature verification processes between intermediate systems during actual interaction, resulting in low data security and attack resistance. This invention offers a simple and convenient process. Through end-to-end technical security measures, it encrypts, decrypts, and verifies the transmitted data between the source end (customer information system) and the destination end (smart meter). Since intermediate systems lack keys and public key certificates, they cannot decrypt the data and do not require decryption or signature verification, thus preventing plaintext exposure. This eliminates the need for new algorithms and protections, avoiding unintentional operational errors and malicious attacks in extreme situations. Both systems operate at the application layer end-to-end APDU (Application Layer Protocol Data Unit), ensuring that information security is not affected by the number or reliability of intermediate systems. This invention solves the problem of easy privacy leaks and insufficient attack resistance caused by multiple encryption / decryption and signature verification processes during communication between customer information systems and smart meters, effectively improving data security and attack resistance. Attached Figure Description

[0026] To more clearly illustrate the solution of the present invention, a brief introduction will be given to the drawings used in the description of the embodiments below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0027] Figure 1A flowchart illustrating a secure interaction method between a customer information system and a smart meter, provided as an embodiment of the present invention;

[0028] Figure 2 This invention provides a flowchart of the process for generating temporary private and public keys, as well as encryption and signature procedures, in a secure interaction method between a customer information system and a smart meter, as provided in an embodiment of the invention.

[0029] Figure 3 A schematic diagram illustrating the formation process of the application layer downlink APDU in a secure interaction method between a customer information system and a smart meter, provided in an embodiment of the present invention;

[0030] Figure 4 This is a schematic diagram illustrating the end-to-end communication between the customer information system and the smart meter through various intermediate systems in a secure interaction method between a customer information system and a smart meter, as provided in an embodiment of the present invention.

[0031] Figure 5 This is a flowchart of the end-to-end APDU parsing process of a smart meter in a secure interaction method between a customer information system and a smart meter, provided as an embodiment of the present invention. Detailed Implementation

[0032] To facilitate understanding of the present invention, a more complete description will be given below with reference to the accompanying drawings. Preferred embodiments of the invention are shown in the drawings. However, the invention can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided to provide a thorough and complete understanding of the disclosure of the invention.

[0033] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains. The terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention.

[0034] This invention provides a secure interaction method between a customer information system and a smart meter, applied to the process of uploading legal metering and settlement data from a smart meter to the final customer information system, or the customer information system issuing parameters and control commands to the final smart meter. The secure interaction method between the customer information system and the smart meter includes the following steps:

[0035] S10. The customer information system selects parameters from the end-to-end parameter setting list and determines whether the parameter security configuration is AES128 and elliptic curve P256. If yes, the customer information system generates a key pair of a temporary private key deu1 and a temporary public key Qeu1 based on elliptic curve P256, and selects a P256 certificate and private key; if not, it generates a key pair of a temporary private key deu1 and a temporary public key Qeu1 based on elliptic curve P384, and selects a P384 certificate and private key. S20. The customer information system uses the temporary private key deu1 and the stored smart meter key to negotiate the public key. The static public key Qsv1 of the key certificate is used to generate a shared key value Z1. Using the customer information system name and instrument number, a temporary encryption key K1 is derived from the shared key value Z1, and the plaintext parameter is encrypted using the temporary encryption key K1 to generate the ciphertext parameter. S30: The temporary public key Qeu1 and the ciphertext parameter are arranged into an application layer APDU. The customer information system's digital signature private key is used to sign the customer information system name, instrument number, temporary public key Qeu1, parameter length, and ciphertext parameter, forming a downlink application layer APDU. Upper-level computer communication support is added to the downlink application layer APDU. The data is transmitted to the smart meter through various intermediate systems. S40: The smart meter processes the DLMS support layer to obtain the downlink application layer APDU. The smart meter queries the end-to-end parameter security configuration options and determines whether the parameter security configuration options are AES128 and elliptic curve P256. If yes, the smart meter selects the P256 certificate and private key; if not, the smart meter selects the P384 certificate and private key. S50: The smart meter uses the static public key of the customer information system's digital signature public key certificate to perform digital signature verification on the received information. If the verification passes, the smart meter uses... The private key dsv1 and the temporary public key Qeu1 of the received data frame are negotiated to generate the same shared key value Z1. Using the customer information system name and instrument number, the same temporary decryption key K1 is derived from the shared key value Z1. The parameter plaintext is decrypted using the temporary decryption key K1 to generate the parameter plaintext and respond with a correct code; if the verification fails, an error code is responded with; S60, the smart instrument generates a dynamic key, encrypts it, generates a digital signature, and forms an uplink application layer APDU. A DLMS support layer is added outside the uplink application layer APDU and transmitted to the customer information system through various intermediate systems.

[0036] This invention features a simple process and convenient operation. Through end-to-end technical security measures, it encrypts, decrypts, and verifies the transmitted data between the customer information system at the source endpoint and the smart meter at the destination endpoint. The intermediate systems do not have keys or public key certificates and therefore cannot decrypt the data, nor do they need to perform decryption and signature authentication. The top layer of both systems is an application layer end-to-end APDU (Application Layer Protocol Data Unit). The security of information is not affected by the number or reliability of the intermediate systems. This invention solves the problem of easy privacy leakage and insufficient attack resistance caused by multiple encryption, decryption, and signature verification by intermediate systems during the communication process between the customer information system and the smart meter, effectively improving data security and attack resistance.

[0037] To enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0038] This invention provides a secure interaction method between a customer information system and a smart meter, applied to the process of uploading legal metering and settlement data from the smart meter to the final customer information system, or the customer information system issuing parameters and control commands to the final smart meter, in conjunction with... Figures 1 to 5 In this embodiment, the secure interaction method between the customer information system and the smart meter includes the following steps:

[0039] S10. The customer information system selects parameters from the end-to-end parameter setting list and determines whether the parameter security configuration is AES128 and elliptic curve P256. If yes, the customer information system generates a key pair of a temporary private key deu1 and a temporary public key Qeu1 based on elliptic curve P256, and selects the P256 certificate and private key. If no, it generates a key pair of a temporary private key deu1 and a temporary public key Qeu1 based on elliptic curve P384, and selects the P384 certificate and private key.

[0040] Specifically, in this embodiment, step S10 includes:

[0041] According to the end-to-end parameter setting list, the customer information system selects the corresponding parameter type, determines its latest specific value, and arranges the hexadecimal plaintext value of the parameter and the length byte encoding of the parameter, with the length byte first. The plaintext parameter is to be encrypted later. The customer information system arranges its own name and the number of the instrument to be set in sequence before the length byte of the parameter. Subsequent steps and instruments will need to use the customer information system name and instrument number.

[0042] The customer information system queries the end-to-end settings for parameter security configuration options to determine which encryption algorithm and corresponding elliptic curve to use;

[0043] If the data security configuration options are AES128 and elliptic curve P256, the customer information system generates a key pair of a temporary private key deu1 and a temporary public key Qeu1 based on elliptic curve P256, and selects the P256 certificate and private key; otherwise, it generates a key pair of a temporary private key deu1 and a temporary public key Qeu1 based on elliptic curve P384, and selects the P384 certificate and private key.

[0044] S20. The customer information system uses the temporary private key deu1 and the static public key Qsv1 of the stored smart meter key negotiation public key certificate to generate a shared secret value Z1. The customer information system uses the customer information system name and meter number to derive a temporary encryption key K1 from the shared secret value Z1. The customer information system uses the temporary encryption key K1 to encrypt the parameter plaintext to generate parameter ciphertext, which replaces the parameter plaintext in the original APDU.

[0045] S30. The customer information system arranges the temporary public key Qeu1 and the parameter ciphertext into the application layer APDU for transmission to the smart meter for calculation. The customer information system signs the information using its own digital signature private key. The information to be signed includes the customer information system name, meter number, temporary public key Qeu1, parameter length, and parameter ciphertext. The signature value is appended to the parameter ciphertext. Finally, the downlink tag 0xE1 is appended to the beginning to form the downlink application layer APDU. An upper-level communication support layer is added outside the downlink application layer APDU and transmitted to the smart meter through various intermediate systems.

[0046] Furthermore, in this embodiment, in order to observe the specific information and arrangement order of the application layer APDUs, the formation process of the application layer downlink APDUs is summarized from the above program flowchart, such as... Figure 3 As shown, during transmission, the downlink tag 0xE1 is transmitted first, and the digital signature is transmitted last. It can be seen that the temporary public key Qeu1, the shared secret value Z1, the temporary encryption key K1, and the digital signature private key all use information from both the customer information system and the instrument, without using information from any intermediate systems.

[0047] Furthermore, in this embodiment, the downlink APDU is transmitted from the customer information system to the smart meter through various intermediate systems, achieving end-to-end secure transmission, such as... Figure 4As shown, each intermediate system receives a complete communication frame from the customer information system. After parsing and stripping the communication support layer, it obtains the application layer APDU described earlier. Based on the APDU's tag 0xE1, it can be identified as an end-to-end application layer APDU, which is directly sent to the smart instrument. The intermediate systems do not process this application layer APDU; they simply add the DLMS support layer of the instrument communication network to the APDU and forward it to the smart instrument. It is evident that the intermediate systems do not perform any digital signature verification, computation, or decryption on the end-to-end application layer APDU.

[0048] S40. The smart meter receives the information transmitted from the end-to-end, and then performs digital signature verification, dynamic key calculation, decryption, uplink encryption, signing, and parsing of the end-to-end APDU. Specifically, the smart meter processes the DLMS support layer to obtain the downlink application layer APDU. The smart meter queries the parameter security configuration options set at the end-to-end to determine which encryption algorithm and corresponding elliptic curve are used; it checks whether the parameter security configuration option is AES128 and elliptic curve P256. If so, the smart meter selects the P256 certificate and private key; if not, the smart meter selects the P384 certificate and private key.

[0049] S50. The smart meter uses the static public key of the stored digital signature public key certificate of the customer information system to perform digital signature verification on the received information. The information to be verified includes the customer information system name, meter number, temporary public key Qeu1, parameter length, and parameter ciphertext in the received application layer APDU. The smart meter determines whether the digital signature verification is successful. If the verification is successful, it means that the application layer APDU has not been tampered with or interfered with during transmission, and it can continue to perform calculations and decryption. Then, the smart meter uses its key negotiation private key dsv1 and the temporary public key Qeu1 of the received data frame to generate the same shared secret value Z1. Because the elliptic curve used by the meter is the same as that used by the customer information system, the shared secret value Z1 obtained by the meter after calculation is the same as that of the previous data frame. The shared key Z1 obtained after calculation by the customer information system is equal to the shared key Z1. Using the customer information system name and instrument number, the same temporary decryption key K1 is derived from the shared key Z1. Because the derived parameters and their order used by the instrument are the same as those used by the customer information system, and both are derived from the shared key Z1, the temporary decryption key K1 derived by the instrument is also equal to the temporary encryption key K1 derived by the customer information system, ensuring correct decryption. The temporary decryption key K1 is used to decrypt the parameter plaintext to generate parameter plaintext. The instrument replaces the original parameter with this parameter, which is within a reasonable range, and responds with a correct code. If the verification fails, an error code is responded to, the calculation and decryption are skipped, and the process proceeds directly to the step of composing the response APDU.

[0050] S60 and smart meters generate dynamic keys, encrypt them, generate digital signatures, and form uplink application layer APDUs in the same way. The end-to-end uplink tag is 0xE2. A DLMS support layer is added outside the uplink application layer APDU, and the data is transmitted to the customer information system through various intermediate systems.

[0051] Furthermore, in this embodiment, in order to effectively and centrally manage the data list, security configuration, and various public key certificates, the same end-to-end confidentiality management class is defined in both the customer information system and the smart meter, as shown in Table 1:

[0052] Table 1

[0053] End-to-end confidentiality management class property Data types 1. Class Name String 2. Parameter list for end-to-end settings array 3. End-to-end parameter security configuration Enumerations: AES128 and elliptic curve P256; AES256 and elliptic curve P384. 4. Data list for end-to-end data reading array 5. End-to-end parameter security configuration Enumerations: AES128 and elliptic curve P256; AES256 and elliptic curve P384. 6. Various security credentials Structure

[0054] Furthermore, in this embodiment, the security credentials of the central processing unit of the customer information system include the P256 digital signature public key certificate of the end-to-end customer information system, the P256 digital signature private key of the end-to-end customer information system, the P256 key negotiation public key certificate of the end-to-end customer information system, the P256 key negotiation private key of the end-to-end customer information system, the P256 digital signature public key certificate of the end-to-end smart meter, the P256 key negotiation public key certificate of the end-to-end smart meter, the P384 digital signature public key certificate of the end-to-end customer information system, the P384 digital signature private key of the end-to-end customer information system, the P384 key negotiation public key certificate of the end-to-end customer information system, the P384 key negotiation private key of the end-to-end customer information system, the P384 digital signature public key certificate of the end-to-end smart meter, and the P256 digital signature public key certificate of the end-to-end smart meter. The security credentials for the microcontroller of the smart meter include the P256 digital signature public key certificate, the P256 digital signature private key, the P256 key negotiation public key certificate, the P256 key negotiation private key, the P256 digital signature public key certificate of the end-to-end smart meter, the P256 key negotiation private key of the end-to-end smart meter, the P256 digital signature public key certificate of the end-to-end customer information system, the P256 key negotiation public key certificate of the end-to-end customer information system, the P384 digital signature public key certificate, the P384 digital signature private key, the P384 key negotiation public key certificate, the P384 key negotiation private key, the P384 digital signature public key certificate of the end-to-end customer information system, and the P384 key negotiation public key certificate of the end-to-end customer information system.

[0055] This invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the methods in this embodiment.

[0056] This invention also provides an electronic terminal, including: a processor and a memory; the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory, so that the terminal performs any of the methods in this embodiment.

[0057] As will be understood by those skilled in the art, the computer-readable storage medium described in this embodiment allows for the implementation of all or part of the steps in the above method embodiments by computer program-related hardware. The aforementioned computer program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0058] The electronic terminal provided in this embodiment includes a processor, a memory, a transceiver, and a communication interface. The memory and the communication interface are connected to the processor and the transceiver and complete communication between them. The memory is used to store computer programs, the communication interface is used to perform communication, and the processor and the transceiver are used to run the computer programs, so that the electronic terminal performs the steps of the above method.

[0059] Compared with existing technologies, the secure interaction method, medium, and terminal for customer information systems and smart meters described in the above embodiments have advantages. Existing technologies require multiple encryption / decryption and signature verifications by intermediate systems during actual interaction, resulting in low data security and attack resistance. This invention features a simple process and convenient operation. Through end-to-end technical security measures, it encrypts, decrypts, and verifies the transmitted data between the source endpoint (customer information system) and the destination endpoint (smart meter). Intermediate systems lack keys and public key certificates, thus preventing decryption and signature authentication, and therefore avoiding plaintext, data exposure. It also eliminates the need for new algorithms and protections, preventing unintentional operational errors and malicious attacks in extreme situations. Since both systems operate at the application layer end-to-end APDU (Application Layer Protocol Data Unit), information security is not affected by the number or reliability of intermediate systems. This invention solves the problem of easy privacy leakage and insufficient attack resistance caused by multiple encryption / decryption and signature verifications by intermediate systems during communication between customer information systems and smart meters, effectively improving data security and attack resistance.

[0060] Obviously, the embodiments described above are merely preferred embodiments of the present invention, and not all embodiments. The accompanying drawings illustrate preferred embodiments of the present invention, but do not limit the scope of the patent. The present invention can be implemented in many different forms; rather, these embodiments are provided to provide a more thorough and complete understanding of the disclosure of the present invention. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the scope of patent protection of this invention.

Claims

1. A secure interaction method between a customer information system and a smart meter, characterized in that, Includes the following steps: S10. The customer information system selects parameters from the end-to-end parameter setting list and determines whether the parameter security configuration is AES128 and elliptic curve P256. If yes, the customer information system generates a key pair of temporary private key deu1 and temporary public key Qeu1 based on elliptic curve P256, and selects the P256 certificate and private key. If no, it generates a key pair of temporary private key deu1 and temporary public key Qeu1 based on elliptic curve P384, and selects the P384 certificate and private key. S20. The customer information system uses the temporary private key deu1 and the static public key Qsv1 of the stored smart meter key negotiation public key certificate to generate a shared secret value Z1. Using the customer information system name and meter number, a temporary encryption key K1 is derived from the shared secret value Z1, and the temporary encryption key K1 is used to encrypt the parameter plaintext to generate parameter ciphertext. S30. Arrange the temporary public key Qeu1 and parameter ciphertext into the application layer APDU. Use the digital signature private key of the customer information system to sign the customer information system name, instrument number, temporary public key Qeu1, parameter length, and parameter ciphertext to form the downlink application layer APDU. Add an upper computer communication support layer outside the downlink application layer APDU and transmit it to the smart instrument through each intermediate system. S40. The smart meter processes the DLMS support layer to obtain the downlink application layer APDU. The smart meter queries the end-to-end parameter security configuration options and determines whether the parameter security configuration options are AES128 and elliptic curve P256. If yes, the smart meter selects the P256 certificate and private key; if not, the smart meter selects the P384 certificate and private key. S50: The smart meter uses the static public key of the digital signature public key certificate of the customer information system to perform digital signature verification on the received information. If the verification is successful, it uses the private key dsv1 of the smart meter and the temporary public key Qeu1 of the received data frame to generate the same shared secret value Z1. Using the customer information system name and meter number, it derives the same temporary decryption key K1 from the shared secret value Z1. It uses the temporary decryption key K1 to decrypt the parameter plaintext to generate the parameter plaintext and respond with the correct code. If verification fails, an error code will be displayed. The S60 and smart meter generate dynamic keys, encrypt them, generate digital signatures, and form an uplink application layer APDU. A DLMS support layer is added outside the uplink application layer APDU, and the data is transmitted to the customer information system through various intermediate systems.

2. The secure interaction method between a customer information system and a smart meter according to claim 1, characterized in that, In step S10, the customer information system selects the corresponding parameter type according to the end-to-end parameter setting list, determines its latest specific value, and arranges the hexadecimal plaintext value of the parameter and the length byte of the parameter in the encoding, with the length byte first and the plaintext parameter waiting to be encrypted later; the customer information system arranges its own name and the number of the instrument to be set in sequence before the length byte of the parameter.

3. The secure interaction method between a customer information system and a smart meter according to claim 1, characterized in that, In step S30, the signature value is appended to the parameter ciphertext; finally, the downlink label 0xE1 is appended to the beginning to form the downlink application layer APDU.

4. The secure interaction method between a customer information system and a smart meter according to claim 1, characterized in that, In S50, the information to be verified includes the customer information system name, instrument number, temporary public key Qeu1, parameter length, parameter ciphertext, and the end-to-end uplink tag is 0xE2.

5. The secure interaction method between a customer information system and an intelligent meter according to claim 1, characterized in that, The elliptic curve used by the customer information system is the same as that used by the smart meter. Therefore, the shared secret value Z1 obtained by the customer information system after calculation is equal to the shared secret value Z1 obtained by the smart meter after calculation. The derived parameters and their order used by the smart meter are the same as those used by the customer information system, and both are derived from the shared secret value Z1. Therefore, the temporary decryption key K1 derived by the smart meter is also equal to the temporary encryption key K1 derived by the customer information system.

6. The secure interaction method between a customer information system and a smart meter according to claim 1, characterized in that, The end-to-end confidentiality management class defined within the customer information system and smart meters includes a class name, a list of end-to-end configured parameters, a security configuration for end-to-end configured parameters, a list of end-to-end read data, and various security credentials. The class name is a string, the list of end-to-end configured parameters is an array, the security configuration for end-to-end configured parameters includes AES128 and elliptic curve P256, and AES256 and elliptic curve P384 data types, the data type of the end-to-end read data list is an array, the data type of the end-to-end configured parameter security configuration is AES128 and elliptic curve P256, and AES256 and elliptic curve P384 data types, and the data type of each security credential is a structure.

7. The secure interaction method between a customer information system and a smart meter according to claim 1, characterized in that, The security credentials for the customer information system include: end-to-end customer information system P256 digital signature public key certificate, end-to-end customer information system P256 digital signature private key, end-to-end customer information system P256 key negotiation public key certificate, end-to-end customer information system P256 key negotiation private key, end-to-end smart meter P256 digital signature public key certificate, end-to-end smart meter P256 key negotiation public key certificate, end-to-end customer information system P384 digital signature public key certificate, end-to-end customer information system P384 digital signature private key, end-to-end customer information system P384 key negotiation public key certificate, end-to-end customer information system P384 key negotiation private key, end-to-end smart meter P384 digital signature public key certificate, and end-to-end smart meter P384 key negotiation public key certificate. The security credentials for the smart meter include the P256 digital signature public key certificate, the P256 digital signature private key, the P256 key negotiation public key certificate, the P256 key negotiation private key, the P256 digital signature public key certificate, the P256 key negotiation public key certificate, the P256 key negotiation public key certificate, the P384 digital signature public key certificate, the P384 digital signature private key, the P384 key negotiation public key certificate, the P384 key negotiation private key, the P384 digital signature public key certificate, and the P384 key negotiation public key certificate for the end-to-end customer information system.

8. The secure interaction method between a customer information system and a smart meter according to claim 1, characterized in that, Each intermediate system receives a complete communication frame from the customer information system, parses and strips the communication support layer to obtain the application layer APDU. According to the APDU's tag 0xE1, it is an end-to-end application layer APDU, which is sent directly to the smart instrument. Each intermediate system does not process this application layer APDU, but only adds the DLMS support layer of the instrument communication network to the APDU and forwards it to the smart instrument. Each intermediate system does not perform any digital signature verification, calculation, or decryption on the end-to-end application layer APDU.

9. A computer-readable storage medium, characterized in that, The storage medium stores a computer program that, when executed by a processor, implements the method as described in any one of claims 1 to 8.

10. An electronic terminal, characterized in that, include: Processor and memory; The memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to cause the terminal to perform the method as described in any one of claims 1 to 8.

Images