Safe communication authentication method for electric energy meter

Abstract

The invention discloses a secure communication authentication method for an electric energy meter, and aims to solve the problems that only link encryption is carried out in a multi-level network from an electric meter to a collector to a master station, the collector is visible and changeable, and packets are easy to lose in small-frame fragmentation. According to the method, the entity proof token and the mixed public key are packaged and bound in a hard manner, the key tree is constructed from the object level to the fragment level, the Merkel fragment commitment is used for generating the fragment level initialization parameter and the authentication related data, and the authentication encryption algorithm with the synthesis initialization vector characteristic is used for encryption and integrity protection. And meanwhile, a trusted execution environment monotonic counter is used for preventing rollback, and a system type forward error correction enhancement recovery capability is introduced, so that the technical effects of real end-to-end authentication and encryption, fragment-level insertion modification prevention, rearrangement prevention, truncation prevention, whole message consistency verification and adaptation to out-of-order and packet loss scenes are realized.

Description

Technical Field

[0001] This invention relates to the field of power metering and power information collection, and in particular to a secure communication authentication method for electricity meters. Background Technology

[0002] With the large-scale deployment of smart meters and electricity consumption information collection systems, a layered communication architecture from the meter to the collector to the master station has become mainstream. Existing technologies generally use symmetric keys or public key infrastructure for session protection. Common solutions include DLMS COSEM security suite, ANSI C12.22, and IEC 62351. Encryption and authentication are typically implemented on the link side from the meter to the collector or from the collector to the master station, with the collector handling proxy forwarding and key management. Due to bandwidth limitations and terminal resource constraints, small frame transmission is widespread, and messages often need to be fragmented. While the link layer and application layer have retransmission and verification capabilities, they lack a cryptographically-bound overall message consistency design.

[0003] The main shortcomings of existing technologies are:

[0004] 1. Lack of true end-to-end identity authentication and confidentiality protection; the data collector can see and modify business data, making it difficult to effectively resist man-in-the-middle and tampering attacks; session keys are usually not bound to device platform status or firmware metrics.

[0005] 2. In fragmented scenarios, encryption is mainly done frame by frame, without binding each fragment to the overall message structure information, making it difficult to detect fragment rearrangement, truncation, and insertion; improper initialization vector and freshness management can easily lead to replay and security degradation.

[0006] 3. In high packet loss channels such as power line carrier, the lack of a forward error correction mechanism coordinated with cryptographic commitment results in insufficient recovery capability of the entire message after small frame loss, affecting the reliability and real-time performance of data acquisition.

[0007] Therefore, a secure communication authentication method for electricity meters that can overcome the shortcomings of the existing technology is a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0008] One objective of this invention is to propose a method for secure communication authentication of electricity meters. Addressing the problems of existing technologies in multi-level networks from the meter to the collector to the master station, such as only link encryption, collector visibility and modifiability, easy packet loss in fragmented transmission, and lack of overall message consistency binding, this invention proposes a technical solution that includes: hard binding of entity proof tokens with hybrid public key keys; deriving object-level keys based on session exporters and object contexts, and deriving fragment-level keys based on fragment sequence numbers and the total number of fragments; generating fragment-level initialization parameters and authentication-related data using Merkle fragment commitments; employing an authentication encryption algorithm with synthetic initialization vector characteristics for fragment-level encryption and integrity protection; embedding root values ​​and the total number of fragments in the first and last fragments to form a double seal; and utilizing a trusted execution environment monotonic counter to prevent rollback and supplementing it with forward error correction. This invention achieves true end-to-end authentication and encryption, fragment-level anti-insertion, anti-reordering, and anti-truncation, verifiable overall message consistency, and recovery even in out-of-order and packet-loss scenarios.

[0009] This invention provides a secure communication authentication method for electricity meters, comprising:

[0010] S1. The master station generates a session identifier and a challenge random number and sends them to the electricity meter. The electricity meter generates encapsulation parameters for a hybrid public key encapsulation in a trusted execution environment. It writes the encapsulation parameters, session identifier, and challenge random number into the protected statement of the entity proof token. The master station verifies the token and calculates the proof hash value.

[0011] S2. Perform hybrid public key encapsulation using the proof hash value, session identifier, and encapsulation parameters as information parameters, derive the session master key and obtain the session export interface, determine the object context identifier based on the session export interface and the session identifier, and generate an object-level key through the key derivation function to determine the communication direction.

[0012] S3. Collect and form object data according to the fragmentation parameters of the object context identifier, divide the object data into multiple fragments, determine the total number of fragments and fragment number, calculate the Merkle root value, calculate the proof path for each fragment, and form fragment plaintext.

[0013] S4. Based on the object-level key, session identifier, and communication direction, combined with the Merkle root value, total number of fragments, fragment sequence number, and proof path, generate a fragment-level key for each fragment according to the key derivation rules from the object level to the fragment level. Hash and truncate the Merkle root value, proof path, fragment sequence number, and session identifier to obtain a fragment-level random number. Combine the Merkle root value, fragment sequence number, total number of fragments, and session identifier to form authentication-related data.

[0014] S5. Using the fragment-level key, fragment-level random number, and authentication-related data as parameters, and with the authentication-related data as associated authentication data, the Advanced Encryption Standard Authentication Encryption Algorithm with Galois Counter mode featuring a synthetic initialization vector configuration is used to complete end-to-end encryption and integrity protection for each fragment, generating fragment-level ciphertext. The authentication-related data of the first and last fragments both contain the Merkle root value and the total number of fragments and participate in encryption authentication to form a double seal for overall message consistency.

[0015] S6. Based on the object-level key and communication direction, the master station, combined with the Merkle root value, total number of fragments, fragment sequence number and proof path, reproduces the fragment-level key and fragment-level random number, and performs fragment-level verification and decryption with authentication-related data to recover the fragment plaintext. When the last fragment is received, the Merkle root value and total number of fragments obtained by the authentication-related data verification are compared with the corresponding values ​​of the first fragment to obtain the consistency verification result of the whole message. After all fragments are verified, they are reassembled into a whole message according to the fragment sequence number.

[0016] Optionally, S1 includes:

[0017] The main station generates a session identifier and a challenge random number and sends them to the electricity meter to mark the current session and provide freshness verification.

[0018] The energy meter generates encapsulation parameters of a hybrid public key encapsulation within a trusted execution environment, and writes the encapsulation parameters, session identifier, and challenge random number as a protected claim into an entity proof token. The entity proof token simultaneously contains a device identifier, firmware metric, and trusted execution environment security status, which is used to simultaneously characterize the device identity and platform status in end-to-end authentication.

[0019] The main station verifies the entity proof token, including verifying the validity of the digital signature, checking the consistency and freshness of the protected statement, session identifier and challenge random number, and determining whether the firmware metric and trusted execution environment security status meet the preset policy. After the verification is passed, the proof hash value is calculated based on the content of the entity proof token.

[0020] Outputs the proof hash value, session identifier, and encapsulation parameters.

[0021] Terminology definition:

[0022] The trusted execution environment is a secure domain that provides isolated execution and key protection capabilities within the energy meter. It can generate secure randomness, protect key materials, and participate in token generation and signature calculation.

[0023] The hybrid public key encapsulation is a key negotiation / encapsulation mechanism that uses the receiver's public key and the sender's one-time secret material to collaboratively derive a shared session master key and supports subsequent key deriving.

[0024] The encapsulation parameters are a set of public information required to perform hybrid public key encapsulation, including at least a one-time public key or its encoding, an algorithm suite identifier, and session-related tag information.

[0025] The protected statement is a set of fields written into the entity proof token and protected by digital signature or message authentication, including at least encapsulation parameters, session identifier and challenge random number;

[0026] The proof hash value is a digest obtained by encoding the content of the entity proof token verified by the main station according to the agreed normalization and calculating it using a hash function. It is used to bind the device status and session in the subsequent key encapsulation.

[0027] The device identifier is identification information used to uniquely identify the electricity meter entity, including but not limited to serial number, certificate subject, or key identifier;

[0028] The firmware metric is the integrity measurement result of the electricity meter firmware / software, including but not limited to version information, component hash, configuration hash, or a summary set of metric evidence;

[0029] The Trusted Execution Environment security status refers to status information reflecting the current trustworthiness of the Trusted Execution Environment, including but not limited to security configuration, patch level, counter value, and runtime policy flags;

[0030] The digital signature is a signature calculated by the token issuer for the content of the entity's proof token, and is used by the main site to verify the authenticity and integrity of the token;

[0031] The preset strategy is a set of acceptance rules and thresholds used by the master station to determine whether the device identifier, firmware metric, and trusted execution environment security status meet the security requirements.

[0032] Optionally, S2 includes:

[0033] The information parameters for the hybrid public key encapsulation are constructed based on the proof hash value, session identifier, and encapsulation parameters, and the hybrid public key encapsulation is performed to derive the session master key and generate the session export interface. The proof hash value is included in the information parameters to bind the derived session master key and the session export interface to the device state reflected by the entity proof token.

[0034] Based on the session export interface and session identifier, the object context identifier is determined according to preset rules to uniquely identify the security context of the object data in this instance.

[0035] Based on the session export interface and the object context identifier, an object-level key is generated through a key derivation function, which is used for subsequent key tree derivation from the object level to the fragment level.

[0036] The communication direction is determined according to the current uplink or downlink path, which is used to distinguish key materials from different directions during the derivation and verification process;

[0037] Outputs the object-level key, object context identifier, and communication direction.

[0038] Terminology definition:

[0039] The information parameters are a key encapsulation input set formed by combining the proof hash value, session identifier, and encapsulation parameters according to a pre-defined encoding and fixed order, which is used to bind the device state and session context when performing hybrid public key encapsulation;

[0040] The session master key is a shared root key obtained by encapsulating a hybrid public key based on the information parameters. It is used for key export and encryption authentication during this session and is uniquely bound to the information parameters.

[0041] The session export interface is a key export function handle or algorithm context established based on the session master key, which supports deriving session subkeys for different purposes from context information and using them for subsequent generation of object-level keys;

[0042] The object context identifier is a unique identifier generated according to preset rules based on the session export interface and the session identifier. It is used to mark the security context of the object data and as context information derived from the key.

[0043] The key derivation function is a key derivation algorithm that meets cryptographic security requirements, used to derive object-level keys from the session export interface and object context identifier as input;

[0044] The object-level key is the root key for this object data output by the key derivation function, which serves as the root node of the object-level to fragment-level key tree for subsequent fragment-level key derivation and verification.

[0045] The communication direction is a direction marker that distinguishes between uplink and downlink paths, used to achieve direction isolation during key derivation and verification and to prevent the mixing of key materials from different directions;

[0046] The uplink path is the communication path through which the electricity meter sends data to the master station;

[0047] The downlink path is the communication path through which the main station sends data to the electricity meter;

[0048] The key tree is a hierarchical key structure that is derived step by step from the object-level key as the root and according to the preset derivation rules, combined with context such as the fragment number, the total number of fragments and the communication direction. It is used to standardize the key relationship from the object level to the fragment level.

[0049] The preset rules are a set of rules used to generate object context identifiers, which at least specify the fields used, encoding methods and combination order, and domain separation strategies to ensure the uniqueness and unambiguity of the identifiers.

[0050] Optionally, S3 includes:

[0051] The electricity meter collects and forms object data based on the preset segmentation parameters in the object context identifier, which is used to determine the segmentation length and segmentation order;

[0052] The object data is divided into multiple fragments according to a fixed fragment length. If the last fragment is less than the fixed length, it is filled according to a preset filling rule and the filling content participates in subsequent hash operations.

[0053] Determine the total number of fragments and assign fragment numbers to each fragment according to the fragment generation order, so that the fragment numbers monotonically increase and correspond one-to-one with the fragmentation order;

[0054] Merkle tree is constructed by using the slice number as the leaf node order in ascending order. The hash value of the leaf node is obtained by hashing the concatenation result of each slice plaintext and the corresponding slice number. Then, the hash values ​​of the left and right child nodes of adjacent leaf nodes or intermediate nodes are connected in a fixed order and hashed. The calculation is carried out from bottom to top until the Merkle tree root value is obtained. When the number of leaf nodes is not a power of two, the last leaf node is expanded according to the preset expansion method to meet the tree construction requirements to ensure the uniqueness of the Merkle tree root value.

[0055] A proof path is generated for each piece. The proof path consists of the hash values ​​of the sibling nodes at each level on the path from the leaf node corresponding to the piece to the Merkle root value, and their left and right position marks at that level, in a bottom-up order. This path is used to uniquely recover the Merkle root value in subsequent verification.

[0056] Output the Merkle root value, the total number of fragments, the fragment number of each fragment, the proof path of each fragment, and the plaintext of each fragment.

[0057] Terminology definition:

[0058] The fragmentation parameters are a set of parameters in the object context identifier used to specify the fragmentation length, fragmentation order, and maximum number of fragments;

[0059] The object data is a data sequence of the original data collected by the electricity meter and to be transmitted under the current object security context, after being normalized and encoded.

[0060] The fragmentation refers to the continuous data blocks obtained by dividing the object data according to a fixed fragment length, which serve as the basic unit for independent encryption and verification.

[0061] The fixed fragment length is the standard byte length of each fragment as specified in the fragmentation parameters, used to ensure the consistency of fragment size;

[0062] The preset padding rule is a deterministic padding algorithm used when the last fragment is less than a fixed length, and the padding bytes participate in subsequent hashing and verification.

[0063] The total number of fragments is a count value of the number of fragments obtained after the object data is fragmented and filled;

[0064] The fragment number is a monotonically increasing integer identifier assigned to each fragment according to the fragment generation order, and corresponds one-to-one with the fragment order;

[0065] The Merkle tree is a binary hash tree constructed by using fragmented related data as leaf nodes and connecting the hash values ​​of adjacent nodes in a fixed order with hashes. It is used to make cryptographic commitments to the entire message content and structure.

[0066] The leaf node is the bottom-level node of the Merkle tree, and its hash input is the concatenation result of the fragment plaintext and the corresponding fragment number;

[0067] The leaf node hash value is a digest obtained by hashing the leaf node hash input, and is used to participate in the calculation of the upper-level nodes;

[0068] The intermediate node is a non-leaf internal node in the Merkle tree, and its hash input is the result of concatenating the hash values ​​of the left and right child nodes in a fixed order.

[0069] The hash operation is the process of calculating a digest after encoding the input according to a predefined cryptographic hash function;

[0070] The fixed order is a deterministic order constraint when concatenating the hash values ​​of the left and right child nodes to ensure the consistency and uniqueness of the root value calculation.

[0071] The Merkel root value is a hash value of the root node obtained by bottom-up calculation, which is used as a global commitment to the consistency of the entire message;

[0072] The expansion method is a leaf node expansion strategy adopted when the number of leaf nodes is not a power of two, which is to fill the number of leaf nodes to a power of two that is not less than the original number by copying the last leaf node or by equivalent means.

[0073] The proof path is a sequence of hash values ​​and position markers of sibling nodes at each level along the path from a leaf node to the root node of the Merkle tree, used to uniquely recover and verify the root value corresponding to that leaf.

[0074] The left and right position markers are identifiers in the proof path that indicate the relative position (left or right) of sibling nodes in this layer, and are used to determine the hash connection order;

[0075] The fragmented plaintext is the unencrypted data content of each fragment after being segmented according to the fragmentation rules and padded when necessary;

[0076] The sibling node is one of the two child nodes of the same parent node, and it participates in the upper-level hash calculation together with the current node.

[0077] The leaf node order follows a rule of arranging leaf nodes in ascending order of their slice number, which is used to construct the bottom-level sequence of the Merkle tree.

[0078] Optionally, S4 includes:

[0079] Based on the object-level key, session identifier, and communication direction, combined with the Merkle root value, total number of fragments, fragment number of each fragment, and proof path of each fragment, a fragment-level key is generated for each fragment according to the key derivation rules from object level to fragment level. The fragment-level key for that fragment is obtained by combining the object-level key with the corresponding fragment number, total number of fragments, and communication direction through the key derivation function.

[0080] The Merkle root value, the proof path of the fragment, the fragment number and the session identifier are concatenated in a fixed order, hashed and truncated to obtain the fragment-level random number of the fragment.

[0081] The Merkle root value, the fragment number, the total number of fragments, and the session identifier are combined in a fixed order to form the authentication-related data of the fragment. The authentication-related data is used to bind the session and the whole message for consistency during subsequent fragment-level encryption and verification.

[0082] Output the shard-level key, the shard-level random number, and the authentication-related data for each shard.

[0083] Terminology definition:

[0084] The key derivation rules are a set of rules agreed upon for key derivation from the object level to the fragment level. They specify the input fields, encoding and combination order, and domain separation and direction isolation strategies of the key derivation function to ensure that the key of each fragment is unique and cannot be used interchangeably.

[0085] The fragment-level key is a session subkey derived from the object-level key and the context of the fragment, such as the fragment number, the total number of fragments, and the communication direction, according to the key derivation rules. It is used for the encryption and integrity protection of the fragment.

[0086] The slice-level random number is an initialization parameter obtained by concatenating the Merkle root value, the proof path of the slice, the slice number and the session identifier according to the agreed encoding and fixed order, hashing and truncating according to a predetermined length, and is used as the random number / nonce input for subsequent authentication encryption algorithms;

[0087] The authentication-related data is associated authentication data formed by combining the Merkle root value, the fragment number, the total number of fragments, and the session identifier according to the agreed encoding and fixed order. It is used to bind the session context and the consistency of the whole message during fragment-level encryption and verification.

[0088] The hashing and truncation process is a deterministic process that encodes the input according to a convention, calculates a digest using a predetermined hash function, and truncates the first fixed-length bits to generate slice-level random numbers.

[0089] Optionally, S5 includes:

[0090] For each shard, encryption and integrity protection are performed using the Advanced Encryption Standard Authentication Encryption Algorithm with a Galois Counter mode featuring a synthetic initialization vector configuration. The encryption and integrity protection uses the corresponding shard-level key as the key material, the corresponding shard-level random number as the initialization parameter, and the corresponding authentication-related data as the associated authentication data. The authentication-related data is a combination of Merkle root value, shard number, total number of shards, and session identifier in a fixed order.

[0091] The authentication data for the first fragment includes the Merkle root value and the total number of fragments, and participates in the encryption authentication. Similarly, the authentication data for the last fragment includes the Merkle root value and the total number of fragments, and participates in the encryption authentication, so as to form a double seal at the beginning and end of the message to ensure consistency of the entire message.

[0092] After completing the encryption and integrity protection of each fragment, the corresponding fragment-level ciphertext is generated;

[0093] Output the fragment-level ciphertext for each fragment.

[0094] Terminology definition:

[0095] The Advanced Encryption Standard Authentication Encryption Algorithm with the Galois Counter mode featuring a synthetic initialization vector configuration is an authentication encryption algorithm based on the Galois / Counter structure of AES that uses a synthetic initialization vector. It can simultaneously provide confidentiality and integrity protection and improve security in scenarios where random numbers / nonces are misused.

[0096] The synthesized initialization vector configuration is a mechanism that generates an initialization vector / nonce from inputs such as the key, associated authentication data, and fragmented plaintext through internal algorithm calculation. This is used to avoid the application layer's strong constraint on the uniqueness of random numbers.

[0097] The Galois counter mode is a block cipher working mode that uses a counter sequence for encryption and calculates the authentication value using Galois field multiplication.

[0098] The Advanced Encryption Standard (AES) is a general term for the AES block cipher algorithm, which is used as the core operator for encryption and authentication.

[0099] The authentication encryption algorithm is a cryptographic algorithm that simultaneously performs encryption and authentication, and outputs authentication results that can be used to detect tampering and forgery while ensuring data confidentiality.

[0100] The initialization parameters are the random number / nonce input of the authentication encryption algorithm, which is provided by chip-level random numbers in this invention;

[0101] The associated authentication data is the unencrypted but integrity-verified additional data (AAD) in the authentication encryption algorithm, which corresponds to the aforementioned authentication-related data in this invention.

[0102] The end-to-end encryption and integrity protection is an encryption and authentication process implemented directly between the electricity meter and the master station, and the intermediate collector does not participate in key derivation or plaintext processing.

[0103] The fragment-level ciphertext is the output obtained after processing a single fragment with an authentication encryption algorithm, and includes at least the encrypted data and authentication information used for integrity verification.

[0104] The first fragment is the fragment with the smallest fragment number, and its associated authentication data includes and authenticates the Merkle root value and the total number of fragments.

[0105] The tail slice is the slice with the largest slice number, and its associated authentication data includes and authenticates the Merkle root value and the total number of slices.

[0106] The double sealing is a design that simultaneously includes and authenticates the Merkle root value and the total number of fragments in the associated authentication data of the first and last fragments, which is used to bind the consistency of the entire message at both ends.

[0107] The overall message consistency refers to the verifiability of all fragments after reassembly to maintain consistency with the Merkle root value and the total number of fragments, and is used to detect truncation, insertion, and rearrangement.

[0108] Optionally, S6 includes:

[0109] For each fragment's ciphertext, the master station reconstructs the fragment-level key based on the object-level key, communication direction, fragment sequence number, and total number of fragments. It then hashes and truncates the concatenated Merkle root value, the proof path of the fragment, the fragment sequence number, and the session identifier in a fixed order to reconstruct the fragment-level random number. Finally, it performs fragment-level verification and decryption using authentication-related data formed by combining the Merkle root value, the fragment sequence number, the total number of fragments, and the session identifier. After successful verification, the fragment plaintext of the fragment is restored.

[0110] When the last packet is received, the Merkel root value and the total number of fragments obtained by the authentication-related data verification of the last packet are compared with the Merkel root value and the total number of fragments obtained by the authentication-related data verification of the first packet. If they match, it is confirmed that the entire message has not been truncated or altered; if they do not match, the entire message is rejected.

[0111] After all fragments have passed verification, the recovered plaintext fragments are reassembled according to their fragment numbers to form a complete message.

[0112] Output the recovered fragmented plaintext, the reassembled whole message, and the consistency verification results.

[0113] Terminology definition:

[0114] The fragment-level verification process involves verifying the integrity and authenticity of the fragment-level ciphertext using the corresponding fragment-level key and fragment-level random number, combined with authentication-related data, to determine whether the fragment has been tampered with or forged.

[0115] The fragment-level decryption process involves using the corresponding fragment-level key and fragment-level random number to decrypt the fragment-level ciphertext after the fragment-level verification is passed, in order to recover the fragment plaintext.

[0116] The consistency verification result is a result identifier formed by comparing the Merkle root value obtained from the verification of the first and last fragments through the relevant authentication data with the total number of fragments. It is used to determine whether the entire message has been truncated or altered.

[0117] The reassembly is a process of sequentially connecting the recovered plaintext fragments according to their sequence numbers to form a complete message after all fragments have passed verification.

[0118] The complete message is a data representation obtained by concatenating all plaintext fragments of the object data according to their fragment numbers, and is used to submit it to the upper-layer application for processing.

[0119] Optionally, the security status of the trusted execution environment includes a monotonic counter value for rollback prevention. When verifying the entity proof token, the master station performs a non-decreasing check on the monotonic counter to reject devices in a rollback state.

[0120] Optionally, when the number of leaf nodes is not a power of two, the last leaf node is copied and extended to a least power of two that is not less than that number. A domain separation label is introduced in the hash calculation of the copied leaf nodes to ensure the uniqueness of the Merkle root value.

[0121] Optionally, after collecting and forming object data, systematic forward error correction coding is performed to generate several verification fragments. These verification fragments participate as ordinary fragments in subsequent Merkle tree calculations, encryption, and verification to improve the whole message recovery capability in scenarios where small frames are prone to packet loss.

[0122] The beneficial effects of this invention are:

[0123] 1. Achieve true end-to-end authentication and encryption: By hard binding entity proof tokens with hybrid public key keys and verifying the freshness of protected claims and the monotonic counter of trusted execution environment, the session master key is bound to the device identity and platform state. The collector does not participate in key derivation, effectively resisting man-in-the-middle tampering and rollback attacks.

[0124] 2. Simultaneous protection of fragment-level security and overall message consistency: A key tree from the object level to the fragment level is adopted. The fragment-level key contains the fragment sequence number, the total number of fragments, and the communication direction. The fragment-level initialization parameters are generated by the Merkle tree root value, the proof path, and the session identifier. The root value and the total number of fragments are included in the authentication-related data of the first and last fragments to form a double seal, which can detect and reject truncation, insertion, rearrangement, and duplicate injection.

[0125] 3. Improved robustness in scenarios with small frames and high packet loss: After collecting and forming object data, a systematic forward error correction is introduced to generate verification fragments, which participate in Merkel commitment, encryption and verification. The main station can independently verify and reassemble fragments that arrive out of order, significantly improving the recovery capability and collection reliability of the entire message. Attached Figure Description

[0126] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0127] Figure 1 This is a flowchart of a secure communication authentication method for electricity meters proposed in this invention;

[0128] Figure 2 This is a flowchart of step S4 of the present invention, which generates the fragment-level key and fragment-level parameters. Detailed Implementation

[0129] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0130] refer to Figure 1 A secure communication authentication method for electricity meters, comprising:

[0131] S1. The master station generates a session identifier and a challenge random number and sends them to the electricity meter. The electricity meter generates encapsulation parameters for a hybrid public key encapsulation in a trusted execution environment. It writes the encapsulation parameters, session identifier, and challenge random number into the protected statement of the entity proof token. The master station verifies the token and calculates the proof hash value.

[0132] S2. Perform hybrid public key encapsulation using the proof hash value, session identifier, and encapsulation parameters as information parameters, derive the session master key and obtain the session export interface, determine the object context identifier based on the session export interface and the session identifier, and generate an object-level key through the key derivation function to determine the communication direction.

[0133] S3. Collect and form object data according to the fragmentation parameters of the object context identifier, divide the object data into multiple fragments, determine the total number of fragments and fragment number, calculate the Merkle root value, calculate the proof path for each fragment, and form fragment plaintext.

[0134] S4. Based on the object-level key, session identifier, and communication direction, combined with the Merkle root value, total number of fragments, fragment sequence number, and proof path, generate a fragment-level key for each fragment according to the key derivation rules from the object level to the fragment level. Hash and truncate the Merkle root value, proof path, fragment sequence number, and session identifier to obtain a fragment-level random number. Combine the Merkle root value, fragment sequence number, total number of fragments, and session identifier to form authentication-related data.

[0135] S5. Using the fragment-level key, fragment-level random number, and authentication-related data as parameters, and with the authentication-related data as associated authentication data, the Advanced Encryption Standard Authentication Encryption Algorithm with Galois Counter mode featuring a synthetic initialization vector configuration is used to complete end-to-end encryption and integrity protection for each fragment, generating fragment-level ciphertext. The authentication-related data of the first and last fragments both contain the Merkle root value and the total number of fragments and participate in encryption authentication to form a double seal for overall message consistency.

[0136] S6. Based on the object-level key and communication direction, the master station, combined with the Merkle root value, total number of fragments, fragment sequence number and proof path, reproduces the fragment-level key and fragment-level random number, and performs fragment-level verification and decryption with authentication-related data to recover the fragment plaintext. When the last fragment is received, the Merkle root value and total number of fragments obtained by the authentication-related data verification are compared with the corresponding values ​​of the first fragment to obtain the consistency verification result of the whole message. After all fragments are verified, they are reassembled into a whole message according to the fragment sequence number.

[0137] In this specific embodiment, S1 includes:

[0138] Main site generates session identifier With challenge random numbers ,in Used to uniquely identify the context of this session. Generated from a high-quality random source on the main site for freshness verification and replay protection;

[0139] The main site will and The message is sent to the electricity meter, which, within a trusted execution environment, invokes a secure randomization and key management service to generate encapsulation parameters for hybrid public key encapsulation. ,in It must contain at least a one-time public key or its encoding, an algorithm suite identifier, and session-related tag information;

[0140] The electricity meter constructs an entity proof token (EAT) within a trusted execution environment, encapsulating parameters. Session identifier With challenge random numbers Write a protected statement The token also includes the device identifier. Firmware metrics Trusted Execution Environment Security Status and monotonic counter value The device then uses the key verification method to calculate the digital signature. ;

[0141] After receiving EAT, the main station first verifies the digital signature based on the root of trust. The validity of the test, and then the verification. In and Consistency with previously sent values ​​and freshness determination, while also... Perform non-decreasing checks to reject devices in a rollback state, and follow the preset strategy. determination and Meets safety requirements;

[0142] After the above verification is passed, the main site calculates the proof hash value based on the normalized encoding of the token content. Its deterministic calculation can be expressed as:

[0143] ;

[0144] in To prove that the hash value is used to bind the session master key with the device identity and platform state in subsequent key encapsulation, To predetermine the cryptographic hash function, A normalized encoding function for token content. This indicates a binary concatenation operation performed in a fixed order. For a set of protected statements, For inclusion and The set of fields in the token used to represent device identity and platform status;

[0145] Main station output and .

[0146] In this specific embodiment, S2 includes:

[0147] To prove the hash value Session identifier With package parameters The information parameters, encoded according to the agreement, are encapsulated in a hybrid public key. The energy meter and the master station collaboratively execute the encapsulation and decapsulation process to derive the session master key. And establish a session export interface Exp ,in Used for key export and cryptographic authentication during this session and and and Unique binding, For based on The exported function handle is used to derive session subkeys for different purposes;

[0148] Subsequently based on and Determine the object context identifier according to preset rules. This is used to uniquely identify the security context of the object data and serves as context information derived from the key;

[0149] Then determine the communication direction marker according to the current communication path. ,in The value can be selected between uplink and downlink to achieve directional isolation and prevent the mixing of key materials from different directions;

[0150] Then, based on the key derivation function KDF(), the session master key is used. With object context identifier and communication direction markers For input derived object-level key To highlight the separation of binding relationships from domains, the deterministic derivation process of object-level keys can be concisely expressed as follows:

[0151] ;

[0152] in The object-level key is used for subsequent key tree derivation from the object level to the fragment level. Key derivation functions that meet cryptographic security requirements, The hybrid public-key encapsulation mechanism outputs the same information as the session master. Generated according to preset rules Communication direction markers are used to distinguish uplink and downlink key materials;

[0153] Output object-level key Object context identifier With communication direction marker .

[0154] In this specific embodiment, S3 includes:

[0155] Electricity meter based on object context identifier Preset fragmentation parameters Collect and form object data sequences ,in At least a fixed slice length must be specified. And the maximum number of shards;

[0156] Will Based on fixed segment length Divide into multiple partitions and obtain the first partition. The plaintext of each fragment The last segment is insufficient The situation is filled according to the preset rules. Deterministic padding is performed, and the padding bytes participate in subsequent hash operations;

[0157] Determine the total number of fragments Each fragment is assigned a fragment number according to the fragment generation order. make exist The order of the segments is monotonically increasing and corresponds one-to-one with the segmentation order.

[0158] Construct a Merkle tree using the slice number as the leaf node in ascending order. First, for each slice... Corresponding The algorithm concatenates the input to calculate the hash of the leaf nodes, then concatenates the hash values ​​of the left and right child nodes of adjacent leaf nodes or intermediate nodes in a fixed order and hashes them again. This process is repeated from bottom to top until the Merkle root value is obtained. Its deterministic calculation can be expressed as:

[0159] ;

[0160] in The Merkle root value is used as a global commitment for overall message consistency. This is a deterministic function that aggregates the hashes of leaf nodes from bottom to top according to the rules of a binary hash tree, and concatenates the hash values ​​of the left and right child nodes in a fixed order at each level to obtain the root value. Indicates the sequence number from 0 to an ordered set To predetermine the cryptographic hash function, Enc For the normalized coding function, This indicates a binary concatenation operation performed in a fixed order. For the first Each fragment of plaintext, For the film sequence number, This represents the total number of fragments.

[0161] When the number of leaf nodes is not a power of two, the last leaf node is copied and expanded to the least power of two that is not less than that number to meet the tree construction requirements and maintain the uniqueness of the root value calculation.

[0162] Generate proof path for each shard The The hash values ​​of the sibling nodes at each level along the path from the leaf node to the root node of the partition, along with their left and right position markers at that level, are arranged in top-down order. This hash value is used to uniquely recover and verify the partition in subsequent verification. ;

[0163] Output Merkle root value Total number of fragments The fragment number of each fragment Path for each slice With each fragment plaintext .

[0164] In this specific embodiment, S4 includes:

[0165] Electricity meters based on object-level keys With session identifier and communication direction markers Combined with Merkel root value Total number of fragments The fragment number of this fragment. Proof path of this fragment The key derivation rules from object level to fragment level are as follows: Each fragment generates a fragment-level key. The object-level key is combined with the slice number, the total number of slices and the communication direction through a key derivation function to achieve directional isolation and inter-slice incompatibility.

[0166] Simultaneously, the root value, proof path, fragment number, and session identifier are concatenated in a fixed order, hashed, and truncated according to a predetermined length to generate a fragment-level random number for that fragment. The root value, fragment number, total number of fragments, and session identifier are then standardized and encoded in a fixed order to form authentication-related data. Used to bind session and overall message consistency during subsequent chip-level encryption and verification;

[0167] To highlight deterministic generation and context binding, the above process can be compressed into the following representation:

[0168] ,

[0169] ,

[0170] ;

[0171] in For the first The fragment-level key for each fragment is used for subsequent fragment-level encryption and integrity protection. The fragment-level random number is used as the initialization parameter for subsequent authentication encryption algorithms. The authentication-related data for this fragment is used to bind the session context and ensure consistency with the entire message during fragment-level encryption and verification. Key derivation functions to meet cryptographic security requirements and To implement key tree derivation and direction isolation from the object level to the fragment level, The object-level key originates from the session export and context binding result of step S2 and inherits from the key. The binding, For the film sequence number in the range The internal order is monotonically increasing and corresponds one-to-one with the partitioning order. The total number of fragments, The communication direction marker is limited to either uplink or downlink to prevent the mixing of key materials from different directions. The function is used to truncate numbers to a predetermined length to generate deterministic-length slice-level random numbers from the hash output. To predetermine the cryptographic hash function, The normalized encoding function is used to unambiguously encode input fields into binary sequences according to a predefined format. This indicates a binary concatenation operation performed in a fixed order. For Merkel root values, The proof path for this partition consists of a sequence of hash values ​​of each sibling node along the path from the leaf node to the root node of the partition, along with their left and right position markers. Session identifiers are used to provide freshness and context binding;

[0172] Output .

[0173] In this specific embodiment, S5 includes:

[0174] The electricity meter is for each segment number (Its value range is) The fragments are each executed using the Advanced Encryption Standard Authentication (AES) encryption algorithm with a Galois counter mode featuring a synthesized initialization vector configuration, with a fragment-level key. As key material, using slice-level random numbers As an initialization parameter (i.e., a random number / nonce), and with authentication-related data As associated authentication data (AAD), the first The plaintext of each fragment As input, end-to-end encryption and integrity protection are performed; the output is fragment-level ciphertext. ,in By Merkel root value Film serial number Total number of fragments With session identifier It is constructed using standardized encoding in a fixed order and is used to bind the session context and ensure consistency with the entire message. In particular, it is used in the first and last segments (i.e., and During the processing of ), Included and involved in certification and This creates a "double seal" at the beginning and end of the entire message, ensuring consistency across the entire message.

[0175] To highlight the determinism and context binding of the algorithm's call interface, the following compact representation can be used to describe the chip-level encryption and integrity protection process:

[0176] ;

[0177] Among them, AES-GCM-SIV For the calling function of the Advanced Encryption Standard Authentication Encryption Algorithm with a Galois Counter mode possessing a synthetic initialization vector configuration, outputs fragment-level ciphertext. (Includes at least encrypted data and authentication labels for subsequent integrity verification) For the first The fragment-level key for each fragment is derived from the key tree derivation result in step S4 and bound to the session context. The slice-level random numbers for this slice are used as initialization parameters in the generation of the synthetic initialization vector to enhance security in scenarios where random numbers are misused. The authentication-related data for this fragment is used as associated authentication data in encryption and authentication, binding the session and the entire message structure information. For the first Each plaintext fragment is encrypted end-to-end to form a fragment-level ciphertext. After completing the encryption and integrity protection of each fragment, output all .

[0178] In this specific embodiment, S6 includes:

[0179] The main station processes each received fragment-level encrypted message. (of which the film number) For the total number of fragments, fragment-level verification and decryption are performed, first based on the object-level key. With communication direction marker Combined with the film sequence number Total number of fragments Derivation function KDF by key ( Reproduce the fragment-level key of this fragment. Then, based on Merkel root values The proof path for this fragment. Film serial number With session identifier According to the normalized coding function The fixed order of concatenation and the hash function Calculated and then truncated by the function Pre-defined length truncated reproducible random number At the same time, Merkel root value Film serial number Total number of fragments With session identifier Reproduce authentication-related data using standardized encoding in a fixed order. Subsequently, the verification and decryption interface of the Advanced Encryption Standard Authentication Encryption Algorithm with a Galois counter mode possessing a synthetic initialization vector configuration is invoked to verify the first... Each fragment undergoes end-to-end verification and decryption, which can be compactly represented as follows:

[0180] ;

[0181] in For the first The plaintext fragments of each fragment (output upon successful verification), AES-GCM-SIV_Open ( This is a verification and decryption function for the Advanced Encryption Standard (AES) authentication encryption algorithm with a Galois counter mode featuring a synthetic initialization vector configuration. It performs integrity checks on the associated authentication data and decrypts it to obtain the plaintext after successful authentication. For the first The fragment-level key for each fragment is provided by KDF. by and To reproduce the input and bind it to the session context, The fragment-level random number for this fragment is determined by... right The deterministic processing results are reproduced and used as algorithm initialization parameters. The authentication-related data for this fragment is provided by The data is reproduced and used as associated authentication data in the verification process to bind the session and ensure consistency with the entire message. For the first Each fragment's slice-level ciphertext is used as input to the function;

[0182] Upon receiving the end copy (i.e.) After verification, the main site will compare the Merkle root value and the total number of fragments obtained from the authentication-related data verification and normalized decoding of the last fragment with the previous first fragment (i.e., The Merkle root value, obtained through verification of relevant data and normalized decoding, is compared with the total number of fragments. If they match, the consistency verification result is recorded. True, and confirm that the entire message has not been truncated or altered; if inconsistent, record it. false and reject the entire message;

[0183] After all fragments have passed verification, the main site will process them according to their serial numbers. For the recovered fragmented plaintext To reorganize in an orderly manner to form a complete message The final output is the recovered set of fragmented plaintext. Reorganized complete message Consistency verification results .

[0184] In this specific embodiment, it includes:

[0185] Trusted Execution Environment maintains monotonic counter values ​​on the device side and regard it as the security state of the trusted execution environment. The constituent fields are included in the protected statement of the entity proof token EAT. Generate and sign together;

[0186] During the token verification process in step S1, the master station extracts the device identifier from the token. With monotonic counter value And query the device's last counter record from the persistent storage on the main station side. The counter is validated using non-decreasing rules, and a rollback decision is generated. Compact representation is:

[0187] ;

[0188] in The non-decreasing verification result is used in the token verification process to determine whether to accept the device's current platform state and proceed to the subsequent proof hash value. Calculation of session master key Derivatives of The monotonic counter value provided for the trusted execution environment is used to prevent platform state rollback. This is a function on the main station side that queries the historical counter records of a specified device identifier, and the records are saved persistently. The device identifier is used to uniquely index device records;

[0189] when When the main station rejects the token for this session and marks the device as being in a rollback state, At that time, the main station accepts the token and uses it to... The principle is to update the main site's historical records to maintain non-decreasing constraints, thereby continuously suppressing rollbacks and aligning with the policy set across sessions and restarts. Other security checks work together to ensure the platform's freshness and credibility.

[0190] In this specific embodiment, it includes:

[0191] When the number of leaf nodes is not a power of two, the energy meter expands the Merkle tree in step S3 by copying the last leaf node to a least power of two that is not less than that number. A domain separation label is introduced in the hash calculation of the copied leaf nodes to ensure the uniqueness of the Merkle tree root value. Specifically, the total number of expanded leaf nodes is first determined. (It is defined as not less than the total number of fragments) (The least power of two), and then construct an extended leaf hash sequence according to the slice number in ascending order. And calculate the root value, where the deterministic calculation of the root value can be compactly expressed as:

[0192] ;

[0193] ;

[0194] in The Merkle root value is used as a global commitment for overall message consistency. This is a deterministic function that aggregates the hashes of leaf nodes from bottom to top according to the rules of a binary hash tree, and concatenates the hash values ​​of the left and right child nodes in a fixed order at each level to obtain the root value. For the expanded ordered set of leaf node hashes, For the first The hash value of each leaf node. For the first Each fragment of plaintext, For the film sequence number in the range Monotonically increasing, This represents the original total number of fragments. To expand the total number of leaf nodes, its value is not less than The least power of two, To predetermine the cryptographic hash function, Enc The normalized encoding function is used to unambiguously encode input fields into binary sequences according to a predefined format. This indicates a binary concatenation operation performed in a fixed order. A function to generate field-separated labels that uses a copied index. The deterministic label, used as input and output only for copying the leaf node hash calculation, achieves domain separation from the original leaf node input. This ensures the uniqueness and reproducibility of the root value even with the copying and expansion of the final leaf node, and maintains the consistency constraints of the generation of slice-level key derivation and authentication-related data centered on the root value in subsequent steps.

[0195] In this specific embodiment, it includes:

[0196] The electricity meter collects and forms a sequence of object data. And based on the object context identifier After normalizing and padding the data according to the partitioning parameters to obtain a set of data partitions, first determine the number of data partitions. (Represents the original number of fragments without error correction) and the planned number of verification fragments. (This represents the number of check fragments required for systematic forward error correction), and the total number of fragments after expansion is determined accordingly:

[0197] ;

[0198] Among them, the first The plaintext of each fragment is denoted as: And the film sequence number Monotonically increasing and corresponding one-to-one with the segmentation order, when completing the systematic forward error correction coding, the original data segments remain unchanged, and only a check segment is appended to the end of the sequence and used as a normal segment in subsequent processing;

[0199] To highlight the determinism of the systematic coding and the ordered nature of the appended check fragments, the process of generating check fragments is expressed as follows:

[0200] ;

[0201] in Indicates the sequence number from arrive An ordered set of fragmented plaintext. This is a systematic forward error correction coding function. Its inputs are the original set of data fragments and the desired number of check fragments, and its output is a set of check fragments generated in a fixed order. The number of original data fragments. To verify the number of fragments, This represents the total number of expanded fragments;

[0202] After the above generation is completed, the electricity meter will divide all the segments (i.e., segment numbers) From 0 to of ,in Data sharding and (For verification, the partition is used as a regular partition in the Merkle tree calculation in step S3 to obtain the Merkle tree root value.) Path of proof for each piece In step S4, a fragment-level key is generated for each fragment according to the predetermined derivation rules. Slice-level random numbers Data related to certification Then, in step S5, the Advanced Encryption Standard Authentication (AES) encryption algorithm with a Galois counter mode having a synthetic initialization vector configuration is applied to each fragment to generate fragment-level ciphertext. In step S6 on the main station side, even if some data fragments are lost, fragment-level verification and decryption can be completed and the entire message can be reassembled based on the verification of fragments and the arrived fragments. This significantly improves the recovery capability and acquisition reliability of the entire message in scenarios where small frames are prone to packet loss and out-of-order arrival.

[0203] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

[0204] This invention addresses the end-to-end authentication and fragmentation security issues in a multi-level network from the meter to the data collector to the master station. By hard-binding the entity proof token with a hybrid public key, the master station incorporates the proof hash value into the encapsulated information parameters after token verification, thus integrating the session master key with device identity and platform state. Subsequently, a session exporter generates an object context identifier and derives an object-level key, then derives fragment-level keys based on fragment number, total fragment count, and communication direction. Fragment-level initialization parameters are generated using the Merkle tree root value, proof path, and session identifier. The root value, fragment number, and total fragment count are combined to form authentication-related data. This data, combined with an authentication encryption algorithm possessing synthetic initialization vector characteristics, completes fragment-level encryption and integrity protection. Furthermore, double sealing using the root value and total fragment count is introduced at the first and last fragments. This achieves true end-to-end authentication and encryption, effectively resisting fragment insertion, rearrangement, truncation, and duplicate injection, while maintaining verifiability and reconfigurability even under out-of-order and packet loss conditions.

[0205] The improvements in the algorithm structure of this invention are reflected in several targeted designs. First, the hard binding of the entity proof token and the hybrid public key encapsulation, along with the monotonic counter of the trusted execution environment, strongly correlates the session key with the platform state and freshness, suppressing rollback and man-in-the-middle attacks. Second, a two-level key tree introduces isolation in the total number and direction of fragments, and uses Merkel-driven initialization parameters and authentication-related data design to tightly bind each fragment to the overall message structure information, using double sealing at the beginning and end to achieve overall message consistency verification. Third, addressing the reality of small frames being prone to packet loss, a systematic forward error correction is adopted to generate verification fragments and incorporate Merkel commitments and encryption processes, enabling the master station to independently verify and recover even when some fragments are lost or arrive out of order. The synergistic effect of these improvements significantly enhances security and robustness, reducing the negative impact of the collector on communication security.

Claims

1. A secure communication authentication method for electricity meters, characterized in that, include: S1. The master station generates a session identifier and a challenge random number and sends them to the electricity meter. The electricity meter generates encapsulation parameters for a hybrid public key encapsulation in a trusted execution environment. It writes the encapsulation parameters, session identifier, and challenge random number into the protected statement of the entity proof token. The master station verifies the token and calculates the proof hash value. S2. Perform hybrid public key encapsulation using the proof hash value, session identifier, and encapsulation parameters as information parameters, derive the session master key and obtain the session export interface, determine the object context identifier based on the session export interface and the session identifier, and generate an object-level key through the key derivation function to determine the communication direction. S3. Collect and form object data according to the fragmentation parameters of the object context identifier, divide the object data into multiple fragments, determine the total number of fragments and fragment number, calculate the Merkle root value, calculate the proof path for each fragment, and form fragment plaintext. S4. Based on the object-level key, session identifier, and communication direction, combined with the Merkle root value, total number of fragments, fragment sequence number, and proof path, generate a fragment-level key for each fragment according to the key derivation rules from the object level to the fragment level. Hash and truncate the Merkle root value, proof path, fragment sequence number, and session identifier to obtain a fragment-level random number. Combine the Merkle root value, fragment sequence number, total number of fragments, and session identifier to form authentication-related data. S5. Using the fragment-level key, fragment-level random number, and authentication-related data as parameters, and with the authentication-related data as associated authentication data, the Advanced Encryption Standard Authentication Encryption Algorithm with Galois Counter mode featuring a synthetic initialization vector configuration is used to complete end-to-end encryption and integrity protection for each fragment, generating fragment-level ciphertext. The authentication-related data of the first and last fragments both contain the Merkle root value and the total number of fragments and participate in encryption authentication to form a double seal for overall message consistency. S6. Based on the object-level key and communication direction, the master station, combined with the Merkle root value, total number of fragments, fragment sequence number and proof path, reproduces the fragment-level key and fragment-level random number, and performs fragment-level verification and decryption with authentication-related data to recover the fragment plaintext. When the last fragment is received, the Merkle root value and total number of fragments obtained by the authentication-related data verification are compared with the corresponding values ​​of the first fragment to obtain the consistency verification result of the whole message. After all fragments are verified, they are reassembled into a whole message according to the fragment sequence number.

2. The method for secure communication authentication of an electricity meter according to claim 1, characterized in that, S1 includes: The main station generates a session identifier and a challenge random number and sends them to the electricity meter to mark the current session and provide freshness verification. The energy meter generates encapsulation parameters of a hybrid public key encapsulation within a trusted execution environment, and writes the encapsulation parameters, session identifier, and challenge random number as a protected claim into an entity proof token. The entity proof token simultaneously contains a device identifier, firmware metric, and trusted execution environment security status, which is used to simultaneously characterize the device identity and platform status in end-to-end authentication. The main station verifies the entity proof token, including verifying the validity of the digital signature, checking the consistency and freshness of the protected statement, session identifier and challenge random number, and determining whether the firmware metric and trusted execution environment security status meet the preset policy. After the verification is passed, the proof hash value is calculated based on the content of the entity proof token. Outputs the proof hash value, session identifier, and encapsulation parameters.

3. The method for secure communication authentication of an electricity meter according to claim 1, characterized in that, S2 include: The information parameters for the hybrid public key encapsulation are constructed based on the proof hash value, session identifier, and encapsulation parameters, and the hybrid public key encapsulation is performed to derive the session master key and generate the session export interface. The proof hash value is included in the information parameters to bind the derived session master key and the session export interface to the device state reflected by the entity proof token. Based on the session export interface and session identifier, the object context identifier is determined according to preset rules to uniquely identify the security context of the object data in this instance. Based on the session export interface and the object context identifier, an object-level key is generated through a key derivation function, which is used for subsequent key tree derivation from the object level to the fragment level. The communication direction is determined according to the current uplink or downlink path, which is used to distinguish key materials from different directions during the derivation and verification process; Outputs the object-level key, object context identifier, and communication direction.

4. The method for secure communication authentication of an electricity meter according to claim 1, characterized in that, S3 includes: The electricity meter collects and forms object data based on the preset segmentation parameters in the object context identifier, which is used to determine the segmentation length and segmentation order; The object data is divided into multiple fragments according to a fixed fragment length. If the last fragment is less than the fixed length, it is filled according to a preset filling rule and the filling content participates in subsequent hash operations. Determine the total number of fragments and assign fragment numbers to each fragment according to the fragment generation order, so that the fragment numbers monotonically increase and correspond one-to-one with the fragmentation order; Merkle tree is constructed by using the slice number as the leaf node order in ascending order. The hash value of the leaf node is obtained by hashing the concatenation result of each slice plaintext and the corresponding slice number. Then, the hash values ​​of the left and right child nodes of adjacent leaf nodes or intermediate nodes are connected in a fixed order and hashed. The calculation is carried out from bottom to top until the Merkle tree root value is obtained. When the number of leaf nodes is not a power of two, the last leaf node is expanded according to the preset expansion method to meet the tree construction requirements to ensure the uniqueness of the Merkle tree root value. A proof path is generated for each piece. The proof path consists of the hash values ​​of the sibling nodes at each level on the path from the leaf node corresponding to the piece to the Merkle root value, and their left and right position marks at that level, in a bottom-up order. This path is used to uniquely recover the Merkle root value in subsequent verification. Output the Merkle root value, the total number of fragments, the fragment number of each fragment, the proof path of each fragment, and the plaintext of each fragment.

5. The method for secure communication authentication of an electricity meter according to claim 1, characterized in that, S4 includes: Based on the object-level key, session identifier, and communication direction, combined with the Merkle root value, total number of fragments, fragment number of each fragment, and proof path of each fragment, a fragment-level key is generated for each fragment according to the key derivation rules from object level to fragment level. The fragment-level key for that fragment is obtained by combining the object-level key with the corresponding fragment number, total number of fragments, and communication direction through the key derivation function. The Merkle root value, the proof path of the fragment, the fragment number and the session identifier are concatenated in a fixed order, hashed and truncated to obtain the fragment-level random number of the fragment. The Merkle root value, the fragment number, the total number of fragments, and the session identifier are combined in a fixed order to form the authentication-related data of the fragment. The authentication-related data is used to bind the session and the whole message for consistency during subsequent fragment-level encryption and verification. Output the shard-level key, the shard-level random number, and the authentication-related data for each shard.

6. The method for secure communication authentication of an electricity meter according to claim 1, characterized in that, S5 include: For each shard, encryption and integrity protection are performed using the Advanced Encryption Standard Authentication Encryption Algorithm with a Galois Counter mode featuring a synthetic initialization vector configuration. The encryption and integrity protection uses the corresponding shard-level key as the key material, the corresponding shard-level random number as the initialization parameter, and the corresponding authentication-related data as the associated authentication data. The authentication-related data is a combination of Merkle root value, shard number, total number of shards, and session identifier in a fixed order. The authentication data for the first fragment includes the Merkle root value and the total number of fragments, and participates in the encryption authentication. Similarly, the authentication data for the last fragment includes the Merkle root value and the total number of fragments, and participates in the encryption authentication, so as to form a double seal at the beginning and end of the message to ensure consistency of the entire message. After completing the encryption and integrity protection of each fragment, the corresponding fragment-level ciphertext is generated; Output the fragment-level ciphertext for each fragment.

7. The method for secure communication authentication of an electricity meter according to claim 1, characterized in that, S6 include: For each fragment's ciphertext, the master station reconstructs the fragment-level key based on the object-level key, communication direction, fragment sequence number, and total number of fragments. It then hashes and truncates the concatenated Merkle root value, the proof path of the fragment, the fragment sequence number, and the session identifier in a fixed order to reconstruct the fragment-level random number. Finally, it performs fragment-level verification and decryption using authentication-related data formed by combining the Merkle root value, the fragment sequence number, the total number of fragments, and the session identifier. After successful verification, the fragment plaintext of the fragment is restored. When the last packet is received, the Merkel root value and the total number of fragments obtained by the authentication-related data verification of the last packet are compared with the Merkel root value and the total number of fragments obtained by the authentication-related data verification of the first packet. If they match, it is confirmed that the entire message has not been truncated or altered; if they do not match, the entire message is rejected. After all fragments have passed verification, the recovered plaintext fragments are reassembled according to their fragment numbers to form a complete message. Output the recovered fragmented plaintext, the reassembled whole message, and the consistency verification results.

8. The method for secure communication authentication of an electricity meter according to claim 2, characterized in that, The security status of the trusted execution environment includes a monotonic counter value for preventing rollback. When verifying the entity proof token, the master station performs a non-decreasing check on the monotonic counter to reject devices in a rollback state.

9. The method for secure communication authentication of an electricity meter according to claim 4, characterized in that, When the number of leaf nodes is not a power of two, the last leaf node is copied and extended to a power of two that is not less than that number. A domain separation label is introduced in the hash calculation of the copied leaf nodes to ensure the uniqueness of the Merkle root value.

10. A method for secure communication authentication of an electricity meter according to claim 4, characterized in that, After collecting and forming object data, systematic forward error correction coding is performed to generate several verification fragments. These verification fragments, as ordinary fragments, participate in subsequent Merkle tree calculations, encryption, and verification to improve the whole message recovery capability in scenarios where small frames are prone to packet loss.

Images