A blockchain-based method and system for secure authentication of charging pile payment transactions

Abstract

This application provides a blockchain-based method and system for secure authentication of charging pile payment transactions, belonging to the field of blockchain application technology. This application extracts sequence data of data packet arrival time intervals and changes in the sliding window of the transport layer, obtains entropy and frequency information through statistical analysis, and fuses them to generate a traffic feature vector. If this vector satisfies the human-computer interaction conditions, a set is constructed using historical public keys from the blockchain, and the traffic features are mapped to constraint parameters to generate a ring signature credential. Finally, the request is broadcast to the blockchain, and a smart contract verifies the integrity of the credential and parses the traffic features. Fund settlement is completed when verification is successful and the features meet the human-computer interaction conditions. By embedding network traffic features reflecting the authenticity of human-computer interaction into the blockchain ring signature algorithm, this method effectively resists automated script attacks while protecting transaction privacy, ensuring the authenticity and security of payment transactions.

Description

Technical Field

[0001] This application belongs to the field of blockchain application technology, and in particular relates to a blockchain-based method and system for secure authentication of charging pile payment transactions. Background Technology

[0002] With the rapid development of the new energy vehicle industry, the charging pile payment authentication method based on blockchain technology, leveraging its decentralized and immutable characteristics, offers broad application prospects for building a trustworthy and transparent distributed energy trading system. This technology not only reduces the trust costs of multi-party collaboration but also effectively ensures data integrity and traceability during the charging pile payment settlement process.

[0003] Existing blockchain-based charging station payment transaction solutions typically employ traditional public key infrastructure or standard digital signature technology to verify the identity and legitimacy of mobile terminals. These methods primarily focus on logically verifying the validity of the transaction public key and the account balance at the smart contract level to ensure the compliance of fund transfers.

[0004] However, this method, which relies solely on cryptographic key verification, neglects to consider the physical or network layer behavioral characteristics during communication sessions, making it difficult to distinguish between legitimate user manual operations and malicious automated scripts. Because the transaction signing process is separated from actual communication traffic, attackers can simulate communication behavior to launch fake transactions or replay attacks, making it impossible to identify the differences between machines and humans. Therefore, existing technologies suffer from insufficient security authentication of payment transactions due to a lack of effective verification of the authenticity of human-computer interaction. Summary of the Invention

[0005] The purpose of this application is to provide a blockchain-based method and system for secure authentication of payment transactions for charging piles, in order to solve the problem of insufficient security authentication of payment transactions in existing technologies.

[0006] To address the aforementioned technical problems, firstly, this application provides a blockchain-based method for secure authentication of charging pile payment transactions, comprising:

[0007] During the encrypted communication session between the charging pile and the mobile terminal in a public network environment, the arrival time interval sequence of the encrypted data packets sent by the mobile terminal and the size change sequence of the sliding window of the transport layer protocol are obtained.

[0008] The arrival time interval sequence is discretized and its probability distribution is statistically analyzed to obtain the statistical entropy value. The size change sequence is statistically analyzed to obtain the frequency information of the window adjustment amplitude. The statistical entropy value and the frequency information are weighted and fused to generate a flow feature vector.

[0009] Randomly select multiple legitimate transaction public keys from the preset blockchain historical ledger, and construct a public key set based on the legitimate transaction public keys and the current transaction public key;

[0010] When the traffic feature vector meets the preset human-computer interaction conditions, the traffic feature vector is mapped to the constraint parameters of the ring signature algorithm. Based on the private key, public key set and constraint parameters corresponding to the current transaction public key, a mixed operation is performed to generate a ring signature certificate.

[0011] The payment transaction request, which includes a ring signature credential, is broadcast to the blockchain network nodes. The smart contracts deployed on the blockchain network nodes perform integrity verification on the ring signature credential and parse the traffic feature vector from the ring signature credential. When the ring signature credential verification passes and the traffic feature vector meets the human-computer interaction conditions, the funds are settled.

[0012] Optionally, the method further includes:

[0013] Obtain the first list of wireless network addresses accessed by the charging pile and the second list of wireless network addresses accessed by the mobile terminal;

[0014] The network environment similarity is obtained by calculating the ratio of the intersection to the union of the first address list and the second address list.

[0015] When the traffic feature vector meets the preset human-computer interaction conditions, the traffic feature vector is mapped to the constraint parameters of the ring signature algorithm. Based on the private key corresponding to the current transaction public key, the public key set, and the constraint parameters, a hybrid operation is performed to generate a ring signature certificate, including:

[0016] When the network environment similarity is greater than a preset spatial threshold, and when the traffic feature vector meets the preset human-computer interaction conditions, the traffic feature vector is mapped to the constraint parameters of the ring signature algorithm. Based on the private key, public key set and constraint parameters corresponding to the current transaction public key, a mixed operation is performed to generate a ring signature certificate.

[0017] Optionally, the method further includes:

[0018] The message length sequence is constructed by extracting the payload byte length of the encrypted data packet;

[0019] Calculate the transition probability between messages of different lengths in a message length sequence using n-gram syntax, and generate a transition probability matrix.

[0020] The statistical entropy value and frequency information are weighted and fused to generate a traffic feature vector, including:

[0021] The statistical entropy value, frequency information, and transition probability matrix are weighted and fused to generate a traffic feature vector.

[0022] Optionally, the arrival time interval sequence is discretized and its probability distribution is statistically analyzed to obtain a statistical entropy value. The size change sequence is then statistically analyzed to obtain frequency information about the window adjustment amplitude. The statistical entropy value and the frequency information are then weighted and fused to generate a flow characteristic vector, including:

[0023] The values ​​in the arrival time interval sequence are mapped to multiple preset continuous time intervals. The number of values ​​in each time interval is counted. The probability distribution value is obtained by calculating the ratio of the number of values ​​in each time interval to the total number of values. The statistical entropy value is obtained by performing logarithmic operation and accumulation on the probability distribution value.

[0024] Calculate the absolute difference between two adjacent window size values ​​in the size change sequence, and obtain frequency information by calculating the number of times all absolute differences are greater than a preset adjustment threshold;

[0025] After weighting the statistical entropy value and frequency information using preset weighting coefficients, the weighted statistical entropy value and frequency information are combined according to preset vector arrangement rules to obtain the traffic feature vector.

[0026] Optionally, the traffic feature vector is mapped to constraint parameters of the ring signature algorithm, and a hybrid operation is performed based on the private key corresponding to the current transaction public key, the public key set, and the constraint parameters to generate a ring signature credential, including:

[0027] The flow feature vector is compressed and mapped using a preset numerical conversion rule to obtain a constraint digest value of fixed length, and the constraint digest value is used as a constraint parameter in the ring signature algorithm to lock the transaction content.

[0028] Using the private key corresponding to the current transaction public key, a scalar multiplication operation is performed on the preset elliptic curve base point to generate key mirror data used to identify the uniqueness of the transaction;

[0029] For each legitimate transaction public key in the public key set, a corresponding random interference value is generated. The public key set, key mirror data, and constraint digest value are concatenated and processed to obtain the initial challenge value.

[0030] Based on the initial challenge value, random interference value, and private key, the final response value corresponding to the current transaction public key is obtained by closed-loop recursive calculation, and the key mirror data, initial challenge value, and final response value are combined to form a ring signature certificate.

[0031] Optionally, the preset human-computer interaction conditions include a statistical entropy value greater than a preset entropy threshold and frequency information within a preset frequency range.

[0032] Optionally, a smart contract deployed on a blockchain network node is used to perform integrity verification on the ring signature certificate and parse the flow feature vector from the ring signature certificate, including:

[0033] Key mirror data, initial challenge value, final response value, and traffic feature vector are extracted from the ring signature credential. The extracted traffic feature vector is then compressed and mapped using a preset numerical conversion rule to obtain the digest value to be verified.

[0034] The verification challenge value is obtained by performing an elliptic curve-based reverse recursive operation using the public key set, key mirror data, final response value, and digest value to be verified.

[0035] When the challenge value matches the initial challenge value, the integrity verification of the ring signature credential is confirmed to have passed.

[0036] Secondly, this application provides a blockchain-based charging pile payment transaction security authentication system, including:

[0037] The acquisition module is used to acquire the arrival time interval sequence of encrypted data packets sent by the mobile terminal and the size change sequence of the transport layer protocol sliding window during an encrypted communication session between the charging pile and the mobile terminal in a public network environment.

[0038] The generation module is used to discretize the arrival time interval sequence and perform probability distribution statistics to obtain the statistical entropy value. It also performs statistical analysis on the size change sequence to obtain the frequency information of the window adjustment amplitude. Finally, it weights and fuses the statistical entropy value and the frequency information to generate a flow feature vector.

[0039] The construction module is used to randomly select multiple legitimate transaction public keys from a preset blockchain historical ledger, and construct a public key set based on the legitimate transaction public keys and the current transaction public key;

[0040] The generation module is also used to map the traffic feature vector to the constraint parameters of the ring signature algorithm when the traffic feature vector meets the preset human-computer interaction conditions, and to perform mixed operations based on the private key, public key set and constraint parameters corresponding to the current transaction public key to generate a ring signature certificate.

[0041] The settlement module is used to broadcast payment transaction requests, including ring signature credentials, to blockchain network nodes, perform integrity verification on the ring signature credentials using smart contracts deployed on the blockchain network nodes, and parse the flow feature vector from the ring signature credentials. When the ring signature credentials are verified and the flow feature vector meets the human-computer interaction conditions, the funds are settled.

[0042] Thirdly, this application provides an electronic device, comprising:

[0043] Memory, used to store computer programs;

[0044] A processor is configured to execute the computer program to implement the steps of the blockchain-based charging pile payment transaction security authentication method as described in the first aspect above.

[0045] Fourthly, this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, can implement the steps of the blockchain-based charging pile payment transaction security authentication method described in the first aspect above.

[0046] The blockchain-based charging pile payment transaction security authentication method provided in this application firstly acquires the arrival time interval sequence of encrypted data packets and the size change sequence of the sliding window of the transport layer protocol in real time during the encrypted communication session between the charging pile and the mobile terminal. It then constructs a traffic feature vector using statistical entropy value and frequency information, thereby accurately capturing the randomness and non-deterministic characteristics unique to human manual operation at the network layer, and effectively identifying and eliminating the simulated behavior of automated script programs.

[0047] Secondly, the traffic feature vectors that meet the human-computer interaction conditions are mapped to the constraint parameters of the ring signature algorithm. A ring signature credential is generated based on the public key set, establishing a strong binding relationship between the identity authentication of the payment transaction and the current physical communication behavior characteristics. This prevents attackers from using traffic feature stripping to conduct fraudulent transactions or replay attacks. Subsequently, by utilizing smart contracts deployed on nodes to perform integrity verification of the ring signature credential and parse the traffic feature vectors, it is ensured that fund settlement is only executed when cryptographic verification passes and the communication behavior genuinely meets the human-computer interaction conditions.

[0048] Therefore, this application can effectively solve the technical problem of insufficient security authentication of payment transactions caused by the lack of effective verification of the authenticity of human-computer interaction in existing technologies, while protecting transaction privacy.

[0049] Furthermore, this application first obtains the wireless network address lists perceived by the charging pile and the mobile terminal respectively, and calculates the network environment similarity between the two, thereby using the spatial fingerprint characteristics of wireless signals to verify the consistency of the physical locations of the two parties in the transaction. This mechanism can accurately determine whether the mobile terminal is truly within the near-field service range of the charging pile, effectively identifying and blocking cross-regional fraudulent transactions initiated by attackers through remote proxies or signal relays.

[0050] Secondly, by adding constraints on network environment similarity during the generation of ring signature credentials, payment requests are only allowed when the physical space is close and the network environment is consistent, further increasing the cost and difficulty of forging transaction credentials. Therefore, this application effectively solves the technical problem of existing technologies' inability to defend against remote relay attacks and location fraud by introducing spatial consistency verification based on the network environment, ensuring the authenticity of the physical presence of the transaction subjects. Attached Figure Description

[0051] To more clearly illustrate the technical solutions of the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0052] Figure 1 A flowchart illustrating a blockchain-based security authentication method for charging pile payment transactions, provided as an embodiment of this application;

[0053] Figure 2 A flowchart illustrating a method for generating traffic feature vectors provided in an embodiment of this application;

[0054] Figure 3 A flowchart illustrating a method for generating a ring signature credential provided in an embodiment of this application;

[0055] Figure 4 A schematic diagram of the structure of a blockchain-based charging pile payment transaction security authentication system provided in this application embodiment;

[0056] Figure 5 This is a schematic diagram of the hardware structure of an electronic device provided in one embodiment of this application. Detailed Implementation

[0057] Existing blockchain-based charging station payment transaction solutions are mostly limited to cryptographic-level identity verification, only checking the legitimacy of the transaction public key and the account's fund status, while neglecting the dynamic behavioral characteristics of the physical and transport layers during the communication session. This static authentication mechanism is unable to effectively distinguish between genuine user interactions and automated instructions from malicious scripts, allowing attackers to use legitimate keys to simulate normal communication behavior to launch fraudulent transactions or replay attacks. Due to the lack of underlying verification of the authenticity of "human-computer interaction," existing technologies have significant security blind spots when facing automated script attacks, making it difficult to guarantee the authenticity and non-repudiation of payment transactions.

[0058] To address the aforementioned issues, this application proposes a blockchain-based security authentication method for charging pile payment transactions. The core of this method lies in establishing a deep correlation between physical network behavior and digital asset transactions. During encrypted communication, the entropy characteristics of data packet arrival time intervals and the frequency information of transport layer window changes are extracted in real time and fused to generate a traffic feature vector reflecting the authenticity of human-computer interaction. Furthermore, this vector is embedded as a constraint parameter in a ring signature algorithm to generate credentials, and integrity verification and feature parsing are performed using smart contracts deployed on blockchain nodes.

[0059] This application extends payment authorization verification to the underlying behavioral analysis of network traffic, ensuring that fund settlement is only executed when cryptographic verification is passed and the traffic characteristics conform to human-computer interaction patterns. This effectively identifies and defends against automated script attacks while protecting user privacy, filling the gap in existing technologies for verifying the authenticity of transactions.

[0060] To enable those skilled in the art to better understand the present application, the present application will be further described in detail below with reference to the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of the present application, and not all embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0061] To address the problems of existing technologies, this application provides a blockchain-based method, apparatus, device, computer storage medium, and computer program product for secure authentication of charging pile payment transactions. The blockchain-based method for secure authentication of charging pile payment transactions provided in this application is described below.

[0062] Figure 1 This illustration shows a flowchart of a blockchain-based security authentication method for charging pile payment transactions according to an embodiment of this application. Figure 1 As shown, the method includes:

[0063] S101. During the encrypted communication session between the charging pile and the mobile terminal in a public network environment, obtain the arrival time interval sequence of the encrypted data packets sent by the mobile terminal and the size change sequence of the sliding window of the transport layer protocol.

[0064] An arrival time interval sequence refers to the set of timestamp differences between the arrival times of two adjacent encrypted data packets from the same source, captured consecutively by the receiving network interface card during a continuous encrypted communication session, at the physical or link layer. A transport layer protocol sliding window size change sequence refers to an ordered set of window size values ​​extracted from the transport layer header fields of the captured data packets, arranged in the chronological order of message reception, and used for flow control.

[0065] First, the secure transmission channel established between the charging station and the mobile terminal is monitored. Deep packet inspection components deployed at the driver layer or gateway intercept the encrypted data stream in real time. For each captured data packet, the payload is not decrypted; instead, the unencrypted IP and TCP headers are directly parsed. Second, the kernel timestamp of each data packet's arrival is recorded with nanosecond precision. By calculating the difference between the current data packet's timestamp and the previous data packet's timestamp, this difference data is continuously acquired to construct an arrival time interval sequence.

[0066] For example, when mobile terminal A connects to charging station B and initiates payment, the traffic analysis module assumes that the arrival times of the first three data packets P1, P2, and P3 are recorded as T1, T2, and T3, respectively. By calculating T2 minus T1 and T3 minus T2, two time interval values ​​are obtained, such as 20 milliseconds and 45 milliseconds, thus forming a list of values ​​containing 20 and 45 as the arrival time interval sequence. At the same time, the Window Size field in the TCP header is read, and these values ​​are stored in a buffer in sequence to construct a size change sequence. For example, the window values ​​65535, 64240, and 64240 corresponding to the above data packets are extracted to form a list containing these three values.

[0067] S102. Discretize the arrival time interval sequence and perform probability distribution statistics to obtain the statistical entropy value. Perform statistical analysis on the size change sequence to obtain the frequency information of the window adjustment amplitude. Then, weight and fuse the statistical entropy value and the frequency information to generate the flow feature vector.

[0068] Optionally, step S102 involves discretizing the arrival time interval sequence and performing probability distribution statistics to obtain a statistical entropy value, performing statistical analysis on the size change sequence to obtain frequency information of the window adjustment amplitude, and weightedly fusing the statistical entropy value and the frequency information to generate a flow feature vector. This process may specifically include:

[0069] Figure 2 A flowchart illustrating a method for generating traffic feature vectors according to an embodiment of this application is shown. Figure 2 As shown, the method includes:

[0070] S1021. Map the values ​​in the arrival time interval sequence to multiple preset continuous time intervals, count the number of values ​​in each time interval, and obtain the probability distribution value by calculating the ratio of the number of values ​​in each time interval to the total number of values. Obtain the statistical entropy value by performing logarithmic operation and accumulation on the probability distribution value.

[0071] The probability distribution value refers to the frequency of the proportion of samples falling within a specific time window interval in an arrival time interval sequence relative to the total number of samples in the sequence. Statistical entropy values ​​can include the discrete information entropy index based on Shannon's information theory. As a quantitative value that measures the uncertainty and randomness of a time interval sequence, a larger value indicates a weaker regularity in the arrival of data packets and a more significant human manipulation characteristic.

[0072] First, obtain the maximum and minimum values ​​of the arrival time interval sequence, and then divide the interval into... The sequence data is then iterated through, counting the intervals that fall within the first consecutive time interval. Number of values ​​in each time interval And calculate the probability distribution value for each interval. ,in The total number of sequences is given. Finally, the statistical entropy value is calculated using the information entropy formula. The specific calculation formula is as follows: .

[0073] For example, suppose a simplified sequence of arrival time intervals is captured as 10 milliseconds, 10 milliseconds, 80 milliseconds, and 20 milliseconds, and the set time intervals include interval 1 (0 to 30 milliseconds) and interval 2 (30 to 100 milliseconds). Then, there are 3 values ​​falling into interval 1 and 1 value falling into interval 2. Calculate the probability of finding the value in interval 1. The probability of interval 2 is 0.75. The value is 0.25, and then the statistical entropy value is calculated. It is approximately 0.81.

[0074] S1022. Calculate the absolute difference between two adjacent window size values ​​in the size change sequence, and obtain frequency information by calculating the number of times all absolute differences are greater than the preset adjustment threshold.

[0075] Frequency information refers to the cumulative number of significant adjustment behaviors that occur in the entire sequence of size changes of the sliding window of the transport layer protocol. This indicator reflects the severity of flow control during data transmission.

[0076] First, read the sequence of size changes of the transport layer sliding window in chronological order. Starting from the second element of the sequence, calculate the current window value one by one. Window value at the previous time step The absolute value of the difference is calculated. Next, each calculated absolute difference is compared to a preset adjustment threshold. The counter is initialized to 0, and incremented by 1 whenever an absolute difference greater than the adjustment threshold is detected. Finally, after traversing the entire sequence, the final value of the counter is the frequency information.

[0077] For example, suppose the obtained window size change sequence is 60000, 60000, 30000, and 30500, and the adjustment threshold is set to 2000. The absolute values ​​of the adjacent differences are calculated to be 0, 30000, and 500, respectively. Only 30000 is greater than the threshold of 2000, so the frequency information is determined. The value is 1.

[0078] S1023. After weighting the statistical entropy value and frequency information using preset weighting coefficients, the weighted statistical entropy value and frequency information are combined according to preset vector arrangement rules to obtain the traffic feature vector.

[0079] The flow feature vector can be a one-dimensional array or tensor data containing weighted entropy features and frequency features. It serves as a digital fingerprint of physical layer behavior and is used to constrain encrypted transactions in subsequent steps.

[0080] First, read the calculated statistical entropy values ​​respectively. and frequency information Call the preset first weight coefficient. Second weighting coefficient The weighted eigenvalues ​​are obtained by performing multiplication operations on each eigenvalue. and Secondly, according to preset vector arrangement rules, such as using an arrangement where entropy comes first and frequency comes last, the vectors are arranged... and The data is then sequentially filled into the vector structure to construct the traffic feature vector. For example, based on the previously calculated statistical entropy value of 0.81 and frequency information of 1, assuming a weighting coefficient is set... =1, A value of 0.5 will generate the final traffic feature vector. The vector consists of 0.81 and 0.5.

[0081] This embodiment extracts the randomness and dynamic control characteristics of communication behavior at the micro level by statistically analyzing the entropy values ​​of arrival time intervals and the frequency of changes in the transport layer window, and then weights and fuses these two characteristics into a traffic feature vector. This multi-dimensional feature extraction method can effectively distinguish between real human operation and mechanical automated scripts.

[0082] Optionally, the method further includes:

[0083] The message length sequence is constructed by extracting the payload byte length of the encrypted data packet.

[0084] Payload byte length refers to the size of the remaining application layer encrypted data portion after stripping the network and transport layer headers from a captured encrypted data packet. Message length sequence refers to an ordered set of consecutively extracted payload byte length values ​​arranged chronologically according to the time of packet capture.

[0085] First, while monitoring encrypted communication sessions in real time, the traffic capture component parses each passing TCP / IP packet, locates the start of the transport layer payload, and reads the number of bytes up to the end of the packet as its payload length. Second, it ignores pure acknowledgment packets with zero payload length and only records the length of messages carrying actual data. Finally, these length values ​​are stored in a list in chronological order, thus constructing the message length sequence.

[0086] For example, suppose mobile terminal A sends three encrypted messages carrying data in sequence. The first message is a short handshake message with a payload length of 128 bytes; the second is a long message including payment authorization information with a payload length of 1024 bytes; and the third is a short message ending the session with a payload length of 64 bytes. Thus, the constructed message length sequence is [128, 1024, 64].

[0087] The transition probability matrix is ​​generated by calculating the transition probability between messages of different lengths in a message length sequence using n-gram syntax.

[0088] The transition probability matrix is ​​a two-dimensional or multi-dimensional numerical matrix in which rows and columns represent different message length states. Each element value in the matrix represents the statistical probability of transitioning from a row state to a column state. This matrix can characterize the traffic interaction state machine features unique to the application.

[0089] First, determine the discretized state space of the message length, assuming all possible length values ​​are mapped to short, medium, and long states, or directly use typical length clusters obtained by clustering algorithms. Next, select a value for n, typically n=2, to analyze the transition relationship between adjacent message lengths. Traverse the obtained message length sequence and count the frequency of co-occurrence for each pair of adjacent length states. Then, calculate the total number of occurrences for each initial state. Finally, divide the co-occurrence frequency of each pair by the total number of occurrences of the initial state to obtain the conditional probability of state transition, and fill these probability values ​​into the corresponding positions in the matrix to generate the transition probability matrix.

[0090] For example, first, assume a message length sequence [128, 1024, 64]. Define 128 as a short packet, 1024 as a long packet, and 64 as a short packet. Second, statistics show that a short packet is immediately followed by a long packet 80 times, while a long packet is immediately followed by a short packet 20 times. Therefore, the probability of transitioning from a short packet to a long packet is 0.8. Finally, the generated matrix is ​​a 3x3 matrix, where the value at position (1,2) is 0.8.

[0091] In step S102, the statistical entropy value and frequency information are weighted and fused to generate a traffic feature vector, including:

[0092] The statistical entropy value, frequency information, and transition probability matrix are weighted and fused to generate a traffic feature vector.

[0093] First, the obtained transition probability matrix is ​​flattened, converting it into a one-dimensional vector. Next, the statistical entropy value and frequency information are obtained separately, and each element in the entropy value, frequency information, and transition probability vector is weighted using its corresponding preset weight coefficients. Finally, all the processed values ​​are concatenated in a predetermined order to form the final traffic feature vector.

[0094] For example, suppose the original traffic feature vector is [weighted entropy value, weighted frequency], and now the flattened transition probability vector [p1, p2, ..., p9] is added, then the new traffic feature vector becomes [weighted entropy value, weighted frequency, wp1, wp2, ..., wp9].

[0095] This embodiment further extracts application-layer interaction logic features from encrypted traffic, building upon time and transmission control characteristics. This traffic feature vector, which incorporates message state transition probabilities, can deeply characterize the inherent behavioral patterns of payment applications and effectively defend against advanced automated attacks that can mimic simple time statistical features.

[0096] S103. Randomly select multiple legitimate transaction public keys from the preset blockchain historical ledger, and construct a public key set based on the legitimate transaction public keys and the current transaction public key.

[0097] The pre-defined blockchain historical ledger refers to a distributed database stored in the full nodes of the blockchain network. It contains all past block data and transaction records confirmed by the consensus mechanism, with each transaction record linked to a legitimate public key identity via a digital signature. The public key set refers to a list of public keys used in the ring signature algorithm, including a legitimate signer's public key and several decoy public keys used as obfuscation. From the perspective of the verifier, the user corresponding to each of these public keys could potentially be the initiator of the transaction.

[0098] First, the blockchain node is accessed via an RPC interface to retrieve the latest block height and historical transaction index. Based on a pre-defined sampling strategy, valid past transaction records are selected from the historical ledger, and a predetermined number of public keys are extracted using a true random number generation algorithm as legitimate transaction public keys. Next, the public key of the mobile terminal initiating the payment request (i.e., the current transaction public key) is obtained, merged with the randomly selected multiple legitimate transaction public keys, and the list order is randomly shuffled to construct the final public key set. .

[0099] For example, assuming the current mobile terminal's public key is PubK_T, two public keys PubK_A and PubK_B that have participated in transactions are randomly selected from the historical ledger as obfuscation items. After merging and scrambling, the output public key set is... It may present as a sequence structure of PubK_A, PubK_T, and PubK_B.

[0100] This embodiment constructs an obfuscation set by randomly selecting legitimate public keys from the blockchain's historical ledger. Using the real historical identity as a cover, the current transaction's public key is hidden within this obfuscation set. This mechanism effectively severs the explicit association between the transaction and a specific user, achieving strong anonymity in the payment process and preventing malicious nodes from tracking and analyzing user identities and transaction habits.

[0101] S104. When the traffic feature vector meets the preset human-computer interaction conditions, the traffic feature vector is mapped to the constraint parameters of the ring signature algorithm. Based on the private key, public key set and constraint parameters corresponding to the current transaction public key, a mixed operation is performed to generate a ring signature certificate.

[0102] Preset human-computer interaction conditions refer to logical criteria set based on the statistical patterns of human manual operations in terms of time and frequency. Constraint parameters refer to fixed-length digest values ​​converted from multi-dimensional traffic feature vectors through numerical mapping or compression algorithms. Ring signature credentials refer to the final generated encrypted combination of key mirror data, initial challenge values, and response value sequences.

[0103] Optionally, the method further includes:

[0104] Obtain the first list of wireless network addresses accessed by the charging pile and the second list of wireless network addresses accessed by the mobile terminal.

[0105] The first address list refers to the set of MAC addresses or BSSIDs of all detectable Wi-Fi hotspots in the charging pile's vicinity at the current moment, as sensed by the wireless network scanning module built into the charging pile. The second address list refers to the set of Wi-Fi hotspot identifiers in the surrounding environment scanned by the mobile terminal initiating the payment request using its own network interface.

[0106] First, after the mobile terminal establishes a communication connection with the charging station, the charging station immediately triggers its own wireless network card to perform passive scanning or active detection, collecting the BSSIDs of all WiFi access points within a certain signal strength range and storing these unique identifiers in a first address list. Simultaneously, the charging station sends an environment verification request to the mobile terminal. The mobile terminal responds to this request, calling the underlying API to scan for nearby Wi-Fi hotspots, extracting the BSSIDs of each hotspot and storing them in a second address list. The mobile terminal then securely sends this list to the charging station or authentication module through an established encrypted channel.

[0107] For example, assuming the charging station scans hotspots A, B, C, and D, the first address list is {A, B, C, D}; if the mobile terminal scans hotspots A, B, C, and E, the second address list is {A, B, C, E}.

[0108] The network environment similarity is obtained by calculating the ratio of the intersection to the union of the first address list and the second address list.

[0109] Network environment similarity is a numerical metric between 0 and 1, used to quantify the degree of overlap in content between the first address list and the second address list.

[0110] First, read the first address list and the second address list respectively. Second, use set operations to find the common BSSIDs in both lists, and count the number of these common BSSIDs as the size of the intersection. Next, merge all BSSIDs from both lists, remove duplicates, and count the total number of the remaining BSSIDs as the size of the union. Finally, divide the size of the intersection by the size of the union; the quotient is the network environment similarity.

[0111] For example, suppose the first address list is {A,B,C,D} and the second address list is {A,B,C,E}. The intersection of the two is {A,B,C}, with a count of 3; the union is {A,B,C,D,E}, with a count of 5. Then the network environment similarity is 0.6.

[0112] In step S104, when the traffic feature vector meets the preset human-computer interaction conditions, the traffic feature vector is mapped to the constraint parameters of the ring signature algorithm. Before generating the ring signature credential, a hybrid operation is performed based on the private key, public key set, and constraint parameters corresponding to the current transaction public key. This includes:

[0113] When the network environment similarity is greater than a preset spatial threshold, and when the traffic feature vector meets the preset human-computer interaction conditions, the traffic feature vector is mapped to the constraint parameters of the ring signature algorithm. Based on the private key, public key set and constraint parameters corresponding to the current transaction public key, a mixed operation is performed to generate a ring signature certificate.

[0114] The preset spatial threshold refers to the benchmark value for judging the similarity of the network environment based on actual physical environment test data and security tolerance.

[0115] Optionally, the preset human-computer interaction conditions in step S104 specifically include a statistical entropy value greater than a preset entropy threshold and frequency information within a preset frequency range.

[0116] The preset entropy threshold is the minimum information entropy standard determined through extensive experimental analysis of the random distribution of traffic generated by normal human operations. The preset frequency range refers to the numerical range defined by adjusting the frequency of congestion control based on human operations in a real network environment. The preset entropy thresholds are set according to different network environments, as shown in Table 1 below:

[0117] Table 1: Preset Entropy Threshold Reference Table

[0118]

[0119] Table 1 shows examples of preset entropy threshold settings for different network environments. The table specifies the corresponding minimum entropy requirements based on network type. For example, in unstable WiFi environments, due to greater network jitter, the entropy value of normal traffic is usually higher, so the threshold setting is relatively lenient; while in stable leased line environments, the threshold is adjusted accordingly.

[0120] The preset frequency ranges are set according to different network environments, as shown in Table 2 below:

[0121] Table 2: Preset Frequency Interval Reference Table

[0122]

[0123] Table 2 shows an example of preset frequency range determination criteria. This table defines the permissible window adjustment frequency range for different session durations or packet sizes. This range is defined by a lower limit and an upper limit. For example, for short-duration interactive sessions, the normal number of window adjustments should be kept within a certain range; exceeding the upper limit may indicate the presence of high-frequency automated probing or attack behavior.

[0124] Optionally, the process of mapping the traffic feature vector to the constraint parameters of the ring signature algorithm in step S104, and performing a hybrid operation based on the private key, public key set, and constraint parameters corresponding to the current transaction public key to generate the ring signature certificate, may specifically include:

[0125] Figure 3 A flowchart illustrating a method for generating ring signature credentials according to an embodiment of this application is shown. Figure 3 As shown, the method includes:

[0126] S1041. The flow feature vector is compressed and mapped using a preset numerical conversion rule to obtain a constraint digest value of fixed length, and the constraint digest value is used as a constraint parameter in the ring signature algorithm to lock the transaction content.

[0127] The preset numerical conversion rules refer to the standardized processing logic for converting multidimensional vector data into a byte stream format suitable for cryptographic hash operations, including data type conversion, delimiter insertion, and serialization encoding. A table of preset numerical conversion rules is shown in Table 3 below:

[0128] Table 3: Preset Numerical Conversion Rules Comparison Table

[0129]

[0130] Table 3 shows specific configuration examples of the preset numerical conversion rules. This table defines the processing methods and final output formats for different input data types. For example, for floating-point statistical entropy values, it is specified that 6 decimal places are retained; for vector data, it is specified that a vertical bar "|" is used for delimiting and concatenating.

[0131] First, obtain the traffic feature vector generated in step S102. Following the rules shown in Table 3, convert the floating-point and integer elements in the vector into string format and concatenate them into a long string using a specific delimiter. Then, input this string into a preset hash function for digest calculation. Finally, the output hash value is the constraint digest value. This value will be used as a parameter input into the subsequent ring signature generation function, making the final generated signature strongly bound to the current traffic behavior. For example, terminal A concatenates the previously generated traffic feature vectors 0.81 and 0.5 using the # symbol, then inputs them into the SHA-256 algorithm. The resulting hexadecimal hash value is the constraint digest value. .

[0132] S1042. Using the private key corresponding to the current transaction public key, perform scalar multiplication on the preset elliptic curve base point to generate key mirror data used to identify the uniqueness of the transaction.

[0133] Key mirror data refers to a unique feature point derived from the actual signer's private key on an elliptic curve group in a ring signature scheme, used to prevent double-spending. First, let's assume the private key used in the current transaction is... Use a hash function to store the public key Mapped to a point on an elliptic curve Next, perform elliptic curve scalar multiplication to calculate... The obtained result points This is the key mirror data. For example, terminal A uses the private key it holds... Perform a dot product on the mapped public key points to generate The value will be embedded in the certificate as a unique identifier for this transaction.

[0134] S1043. Generate a corresponding random interference value for each legitimate transaction public key in the public key set. Concatenate and process the public key set, key mirror data, and constraint digest value to obtain the initial challenge value.

[0135] First, let the public key set be... The public key index of the real signer is For all indices in the set Not equal to Members use a random number generator to generate random values. and Next, the public key set... Key mirror data generated in step S1042 and the constraint summary value generated in step S1041 Perform byte-level concatenation and input the concatenation result into a hash function. The initial seed hash is calculated. Based on this, a circular recursive calculation is initiated.

[0136] For example, for indexes Not equal to Based on the location, use the formula to calculate the challenge value of the next node. ,in This represents a predefined base point in an elliptic curve cryptography system. For example, suppose the public key set contains... Terminal A as The holder will first... and Generate random parameters and calculate the challenge value starting from index 1 until the actual signer is reached. The location.

[0137] S1044. Based on the initial challenge value, random interference value, and private key, the final response value corresponding to the current transaction public key is obtained by closed-loop recursive calculation, and the key mirror data, initial challenge value, and final response value are combined to form a ring signature certificate.

[0138] First, continue the recursive calculation until the index of the real signer is calculated. Corresponding challenge value To close the loop, a response value must be constructed. According to Calculated This allows subsequent calculations in the loop to eventually return to the initial state. Secondly, it utilizes the private key. calculate ,in It is the order of the elliptic curve. Finally, mirror the key. The first challenge value And including all The list is combined and packaged to generate the final ring signature credential. For example, terminal A uses the private key... Calculate the response value This closes the loop, and the final generated credentials contain a key mirror image. Initial challenge value and three response values This credential conceals the specific identity but is linked to traffic characteristics.

[0139] S105. Broadcast the payment transaction request, which includes the ring signature certificate, to the blockchain network node. Use the smart contract deployed on the blockchain network node to perform integrity verification on the ring signature certificate and parse the traffic feature vector from the ring signature certificate. When the ring signature certificate verification is successful and the traffic feature vector meets the human-computer interaction conditions, perform fund settlement.

[0140] Smart contracts are automated scripts running on a blockchain virtual machine, integrating verification logic functions that work with ring signature algorithms. Integrity verification uses a public key set and data from the signature credential to mathematically verify whether the signature satisfies the closure property of the ring equation.

[0141] First, the mobile terminal packages the ring signature credential, target receiving address, transaction amount, and optional additional information into a standard payment transaction request data packet. Second, using the underlying blockchain client interface, it broadcasts this request to nearby blockchain network nodes. Next, upon receiving the request, the network nodes place it in a pending transaction pool, and miner nodes or validator nodes package it into a new block.

[0142] Subsequently, the smart contract deployed on the blockchain is triggered for execution. The smart contract first calls the built-in signature verification function to read the public key set, key image, initial challenge value, and response value from the credential, and performs elliptic curve inverse operation to verify the mathematical validity of the signature. If the mathematical verification passes, the contract further parses the flow characteristic constraint parameters carried in the credential to determine whether they meet the preset human-computer interaction conditions. Finally, only when both the signature verification and the flow characteristics meet the requirements are satisfied simultaneously will the smart contract execute the transfer operation, update the balance status of the on-chain ledger, and complete the fund settlement; otherwise, the transaction will be deemed invalid and discarded.

[0143] Optionally, step S105, which involves using a smart contract deployed on a blockchain network node to perform integrity verification on the ring signature certificate and parse the flow feature vector from the ring signature certificate, may specifically include:

[0144] S1051. Extract key mirror data, initial challenge value, final response value and traffic feature vector from the ring signature certificate. Perform compression mapping processing on the extracted traffic feature vector using preset numerical conversion rules to obtain the digest value to be verified.

[0145] First, the smart contract parses the input transaction data packet and extracts the ring signature credential. and plaintext flow feature vectors Secondly, the contract calls the built-in hash function library and, according to the rules defined in Table 3 above, performs the hashing. Convert to a string and calculate the hash to obtain the digest value to be verified. For example, suppose a smart contract converts the received traffic feature vectors 0.81 and 0.5 into strings according to rules and calculates their hashes. If the features have not been tampered with, the hash value will be... Should be used when generating the signature Consistent.

[0146] S1052. Using the public key set, key mirror data, final response value, and digest value to be verified, perform an elliptic curve-based reverse recursive operation to obtain the verification challenge value.

[0147] Elliptic curve-based reverse recursive computation refers to the process by which a smart contract uses public parameters to re-derive the mathematical process of the challenge value of each node along the loop formed by the public key set.

[0148] First, the smart contract obtains the set of public keys from the transaction request. and the extracted key image Initial challenge value And a list of response values. Next, the contract initializes a loop, starting from the index... Begin by using the formula When calculating the challenge value of subsequent nodes in sequence, where This represents a preset base point in an elliptic curve cryptography system. Finally, when the last node is computed, its output challenge value is used as the final verification challenge value. For example, the contract sequentially utilizes... and response value The calculations should eventually lead to a hash value that returns to the beginning of the ring.

[0149] S1053. When the verification challenge value is consistent with the initial challenge value, confirm that the integrity verification of the ring signature certificate has passed.

[0150] First, the smart contract compares the calculated verification challenge value with the initial challenge value in the credential. A numerical comparison is performed. If the two are equal, it indicates that the ring equation is closed, proving that the signer possesses a legitimate private key and that the flow characteristics have not been tampered with. Next, the contract further checks whether the statistical entropy value in the flow feature vector is greater than the threshold in Table 1, and whether the frequency information falls within the range in Table 2. Only when both the cryptographic verification and the feature threshold judgment are true will the contract trigger a transfer instruction, update the on-chain state database, and complete the fund settlement. For example, the smart contract assumes that the calculated... With the voucher If the results are completely consistent and the parsed entropy value of 0.81 is greater than the minimum requirement of 0.65, then the fund transfer operation will be executed automatically.

[0151] This embodiment ensures that only transactions with mathematical integrity and in accordance with human-computer interaction principles can trigger settlement. While protecting privacy, it effectively blocks fraudulent payment requests that lack genuine communication support, thus safeguarding funds.

[0152] Figure 4 This is a schematic diagram illustrating a specific implementation of a blockchain-based charging pile payment transaction security authentication system provided in this application. (Refer to...) Figure 4 The system may include:

[0153] 410 Acquisition Module is used to acquire the arrival time interval sequence of encrypted data packets sent by the mobile terminal and the size change sequence of the transport layer protocol sliding window during an encrypted communication session between the charging pile and the mobile terminal in a public network environment.

[0154] The 420 generation module is used to discretize and statistically analyze the arrival time interval sequence to obtain the statistical entropy value, perform statistical analysis on the size change sequence to obtain the frequency information of the window adjustment amplitude, and weight and fuse the statistical entropy value and the frequency information to generate the flow feature vector.

[0155] The 430 building module is used to randomly select multiple legitimate transaction public keys from a preset blockchain historical ledger and construct a public key set based on the legitimate transaction public keys and the current transaction public key;

[0156] The 420 generation module is also used to map the traffic feature vector to the constraint parameters of the ring signature algorithm when the traffic feature vector meets the preset human-computer interaction conditions, and to perform mixed operations based on the private key, public key set and constraint parameters corresponding to the current transaction public key to generate a ring signature certificate.

[0157] The 440 settlement module is used to broadcast payment transaction requests, including ring signature credentials, to blockchain network nodes. It uses smart contracts deployed on blockchain network nodes to perform integrity verification on the ring signature credentials and parses the flow feature vector from the ring signature credentials. When the ring signature credentials are verified and the flow feature vector meets the human-computer interaction conditions, the funds are settled.

[0158] The blockchain-based charging pile payment transaction security authentication system of this application embodiment is used to implement the aforementioned blockchain-based charging pile payment transaction security authentication method. Therefore, the specific implementation of the blockchain-based charging pile payment transaction security authentication system can be found in the embodiment section of the blockchain-based charging pile payment transaction security authentication method above. The specific implementation can be referred to the description of the corresponding embodiment, and will not be repeated here.

[0159] Figure 5 A schematic diagram of the hardware structure of an electronic device provided in one embodiment of this application is shown.

[0160] The electronic device may include a processor 510 and a memory 520 storing computer program instructions.

[0161] Specifically, the processor 510 may include a central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits that can be configured to implement the embodiments of this application.

[0162] Memory 520 may include mass storage for data or instructions. For example, and not limitingly, memory 520 may include a hard disk drive (HDD), floppy disk drive, flash memory, optical disk, magneto-optical disk, magnetic tape, or Universal Serial Bus (USB) drive, or a combination of two or more of these. Where appropriate, memory 520 may include removable or non-removable (or fixed) media. Where appropriate, memory 520 may be internal or external to the integrated gateway disaster recovery device. In a particular embodiment, memory 520 is non-volatile solid-state memory.

[0163] Memory may include read-only memory (ROM), random access memory (RAM), disk storage media devices, optical storage media devices, flash memory devices, and electrical, optical, or other physical / tangible memory storage devices. Therefore, typically, memory includes one or more tangible (non-transitory) computer-readable storage media (e.g., memory devices) encoded with software including computer-executable instructions, and when the software is executed (e.g., by one or more processors), it is operable to perform the operations described with reference to the method according to the first aspect of this disclosure.

[0164] The processor 510 reads and executes computer program instructions stored in the memory 520 to implement any of the blockchain-based charging pile payment transaction security authentication methods in the above embodiments.

[0165] In one example, the electronic device may also include a communication interface 530 and a bus 540. Wherein, such as Figure 5 As shown, the processor 510, memory 520, and communication interface 530 are connected through bus 540 and complete communication with each other.

[0166] The communication interface 530 is mainly used to realize communication between various modules, devices, units and / or equipment in the embodiments of this application.

[0167] Bus 540 includes hardware, software, or both, that couples components of an online data traffic metering device together. For example, and not limitingly, the bus may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a Front Side Bus (FSB), HyperTransport (HT) interconnect, an Industry Standard Architecture (ISA) bus, an Infinite Bandwidth Interconnect, a Low Pin Count (LPC) bus, a memory bus, a Microchannel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCI-X) bus, a Serial Advanced Technology Attachment (SATA) bus, a Video Electronics Standards Association Local (VLB) bus, or other suitable buses, or combinations of two or more of these. Where appropriate, bus 540 may include one or more buses. Although specific buses are described and illustrated in embodiments of this application, any suitable bus or interconnect is contemplated herein.

[0168] The electronic device can execute the blockchain-based charging pile payment transaction security authentication method in the embodiments of this application, thereby realizing the blockchain-based charging pile payment transaction security authentication method described in conjunction with the accompanying drawings.

[0169] Furthermore, in conjunction with the blockchain-based charging pile payment transaction security authentication method in the above embodiments, this application embodiment can provide a computer-readable storage medium for implementation. This computer-readable storage medium stores computer program instructions; when these computer program instructions are executed by a processor, they implement any of the blockchain-based charging pile payment transaction security authentication methods in the above embodiments.

[0170] It should be clarified that this application is not limited to the specific configurations and processes described above and shown in the figures. For the sake of brevity, detailed descriptions of known methods are omitted here. In the above embodiments, several specific steps are described and shown as examples. However, the method process of this application is not limited to the specific steps described and shown. Those skilled in the art can make various changes, modifications, and additions, or change the order of steps, after understanding the spirit of this application.

[0171] The functional blocks shown in the above-described structural diagram can be implemented as hardware, software, firmware, or a combination thereof. When implemented in hardware, they can be, for example, electronic circuits, application-specific integrated circuits (ASICs), appropriate firmware, plug-ins, function cards, etc. When implemented in software, the elements of this application are programs or code segments used to perform the required tasks. Programs or code segments can be stored on a machine-readable medium or transmitted over a transmission medium or communication link via data signals carried on a carrier wave. "Machine-readable medium" can include any medium capable of storing or transmitting information. Examples of machine-readable media include electronic circuits, semiconductor memory devices, ROM, flash memory, erasable ROM (EROM), floppy disks, CD-ROMs, optical disks, hard disks, fiber optic media, radio frequency (RF) links, etc. Code segments can be downloaded via computer networks such as the Internet, intranets, etc.

[0172] It should also be noted that the exemplary embodiments mentioned in this application describe methods or systems based on a series of steps or apparatus. However, this application is not limited to the order of the above steps; that is, the steps can be performed in the order mentioned in the embodiments, or in a different order, or several steps can be performed simultaneously.

[0173] The aspects of this application have been described above with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It should be understood that each block in the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine such that these instructions, executable via the processor of the computer or other programmable data processing apparatus, enable the implementation of the functions / actions specified in one or more blocks of the flowchart illustrations and / or block diagrams. Such a processor can be, but is not limited to, a general-purpose processor, a special-purpose processor, a special application processor, or a field-programmable logic circuit. It is also understood that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can also be implemented by dedicated hardware performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0174] The foregoing has provided a detailed description of a blockchain-based security authentication method and system for charging pile payment transactions. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the embodiments above are merely for the purpose of helping to understand the method and its core ideas. It should be noted that those skilled in the art can make various improvements and modifications to this application without departing from its principles, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A blockchain-based security authentication method for charging pile payment transactions, characterized in that, The method includes: During an encrypted communication session between a charging pile and a mobile terminal in a public network environment, the arrival time interval sequence of encrypted data packets sent by the mobile terminal and the size change sequence of the transport layer protocol sliding window are obtained. The arrival time interval sequence is discretized and its probability distribution is statistically analyzed to obtain a statistical entropy value. The size change sequence is statistically analyzed to obtain the frequency information of the window adjustment amplitude. The statistical entropy value and the frequency information are then weighted and fused to generate a traffic feature vector. Randomly select multiple legitimate transaction public keys from a preset blockchain historical ledger, and construct a public key set based on the legitimate transaction public keys and the current transaction public key; When the traffic feature vector meets the preset human-computer interaction conditions, the traffic feature vector is mapped to the constraint parameters of the ring signature algorithm. Based on the private key corresponding to the current transaction public key, the public key set, and the constraint parameters, a mixed operation is performed to generate a ring signature certificate. The payment transaction request, including the ring signature credential, is broadcast to the blockchain network node. The smart contract deployed on the blockchain network node performs an integrity verification on the ring signature credential and parses the traffic feature vector from the ring signature credential. When the ring signature credential verification passes and the traffic feature vector meets the human-computer interaction conditions, the funds are settled.

2. The method according to claim 1, characterized in that, The method further includes: Obtain a first address list of the wireless networks accessed by the charging pile and a second address list of the wireless networks accessed by the mobile terminal; The network environment similarity is obtained by calculating the ratio of the intersection to the union of the first address list and the second address list; When the traffic feature vector satisfies preset human-computer interaction conditions, the traffic feature vector is mapped to constraint parameters of a ring signature algorithm. A ring signature credential is generated by performing a hybrid operation based on the private key corresponding to the current transaction public key, the public key set, and the constraint parameters. This includes: When the network environment similarity is greater than a preset spatial threshold, and when the traffic feature vector meets the preset human-computer interaction conditions, the traffic feature vector is mapped to the constraint parameters of the ring signature algorithm. Based on the private key corresponding to the current transaction public key, the public key set, and the constraint parameters, a mixed operation is performed to generate a ring signature credential.

3. The method according to claim 1, characterized in that, The method further includes: By extracting the payload byte length of the encrypted data packet, a message length sequence is constructed; The transition probabilities between messages of different lengths in the message length sequence are calculated using n-gram syntax, and a transition probability matrix is ​​generated. The step of weightedly fusing the statistical entropy value and the frequency information to generate a traffic feature vector includes: The statistical entropy value, the frequency information, and the transition probability matrix are weighted and fused to generate the traffic feature vector.

4. The method according to claim 1, characterized in that, The arrival time interval sequence is discretized and its probability distribution is statistically analyzed to obtain a statistical entropy value. The size change sequence is then statistically analyzed to obtain frequency information about the window adjustment amplitude. Finally, the statistical entropy value and the frequency information are weighted and fused to generate a traffic feature vector, including: The values ​​in the arrival time interval sequence are mapped to multiple preset consecutive time intervals. The number of values ​​in each time interval is counted. The probability distribution value is obtained by calculating the ratio of the number of values ​​in each time interval to the total number of values. The statistical entropy value is obtained by performing logarithmic operation and accumulation on the probability distribution value. Calculate the absolute difference between two adjacent window size values ​​in the size change sequence, and obtain the frequency information by calculating the number of times that all the absolute differences are greater than a preset adjustment threshold; After weighting the statistical entropy value and the frequency information using preset weighting coefficients, the weighted statistical entropy value and the frequency information are combined according to preset vector arrangement rules to obtain the traffic feature vector.

5. The method according to claim 2, characterized in that, The step of mapping the traffic feature vector to constraint parameters of the ring signature algorithm, and generating a ring signature credential based on the private key corresponding to the current transaction public key, the public key set, and the constraint parameters through a hybrid operation, includes: The traffic feature vector is compressed and mapped using a preset numerical conversion rule to obtain a constraint digest value of fixed length, and the constraint digest value is used as a constraint parameter in the ring signature algorithm to lock the transaction content. Using the private key corresponding to the current transaction public key, a scalar multiplication operation is performed on the preset elliptic curve base point to generate key mirror data used to identify the uniqueness of the transaction; For each legitimate transaction public key in the public key set, a corresponding random interference value is generated. The public key set, the key mirror data, and the constraint digest value are concatenated and processed to obtain the initial challenge value. Based on the initial challenge value, the random interference value, and the private key, a final response value corresponding to the current transaction public key is obtained by closed-loop recursive calculation, and the key mirror data, the initial challenge value, and the final response value are combined to form the ring signature certificate.

6. The method according to claim 1, characterized in that, The preset human-computer interaction conditions include that the statistical entropy value is greater than a preset entropy threshold and that the frequency information is within a preset frequency range.

7. The method according to claim 5, characterized in that, The step of performing integrity verification on the ring signature certificate using a smart contract deployed on the blockchain network node and parsing the traffic feature vector from the ring signature certificate includes: The key mirror data, the initial challenge value, the final response value, and the traffic feature vector are extracted from the ring signature credential. The extracted traffic feature vector is then compressed and mapped using the preset numerical conversion rules to obtain the digest value to be verified. The verification challenge value is obtained by performing an elliptic curve-based reverse recursive operation using the public key set, the key mirror data, the final response value, and the digest value to be verified. When the verification challenge value matches the initial challenge value, the integrity verification of the ring signature credential is confirmed to have passed.

8. A blockchain-based security authentication system for charging pile payment transactions, characterized in that, include: The acquisition module is used to acquire the arrival time interval sequence of encrypted data packets sent by the mobile terminal and the size change sequence of the transport layer protocol sliding window during an encrypted communication session between the charging pile and the mobile terminal in a public network environment. The generation module is used to discretize and statistically analyze the arrival time interval sequence to obtain a statistical entropy value, perform statistical analysis on the size change sequence to obtain frequency information of window adjustment amplitude, and weight and fuse the statistical entropy value and the frequency information to generate a traffic feature vector. The construction module is used to randomly select multiple legitimate transaction public keys from a preset blockchain historical ledger, and construct a public key set based on the legitimate transaction public keys and the current transaction public key; The generation module is also used to map the traffic feature vector to constraint parameters of the ring signature algorithm when the traffic feature vector meets the preset human-computer interaction conditions, and to perform a mixed operation based on the private key corresponding to the current transaction public key, the public key set and the constraint parameters to generate a ring signature certificate; The settlement module is used to broadcast a payment transaction request including the ring signature certificate to a blockchain network node, perform an integrity check on the ring signature certificate using a smart contract deployed on the blockchain network node, and parse the traffic feature vector from the ring signature certificate. When the ring signature certificate passes the verification and the traffic feature vector meets the human-computer interaction conditions, the funds are settled.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor, configured to implement the steps of the blockchain-based charging pile payment transaction security authentication method as described in any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, enables the implementation of the blockchain-based charging pile payment transaction security authentication method as described in any one of claims 1 to 7.

Images