Electric energy meter security firmware upgrading method

Abstract

The invention discloses a secure firmware upgrading method for an electric energy meter, and aims to solve the problems that in a weak network environment, a link loses packets and is out of order, the bandwidth is small, the internal memory of a meter end is limited, and traditional differential and general compression is easy to fail and easy to be decompressed and bomb. According to the method, a Merkel directed acyclic graph resource list is constructed through a limited differential script only containing a copy instruction and an insertion instruction, a double-anchor address and page certificate verification, fountain code redundancy is only carried out on an insertion piece in a window, piece-level hash and node affiliation verification, guard quota control and leading edge pointer monotonically advancing are implemented at a meter end, and the method is simple and convenient to implement. According to the method, the technical effects of stable transmission and high-success-rate upgrading under the weak network, memory depletion and forged chip attack suppression, verifiability and restorability improvement and the like are achieved by using the weak network, writing intention persistence and page sealing witness and not executing general decompression.

Description

Technical Field

[0001] This invention relates to the field of power metering terminals, and more particularly to a method for upgrading the security firmware of an electricity meter. Background Technology

[0002] With the widespread application of smart meters on the distribution side, remote firmware upgrades have become a routine means to ensure functional safety and rapid iteration. Existing technologies mainly include two paths: one is full packet download and replacement, usually combined with general compression and signature verification; the other is differential upgrade, which uses a general differential algorithm to generate patches, and then restores the new image at the meter through decompression and merging. To improve transmission reliability under weak network conditions, some systems employ retransmission control or apply erasure coding or fountain code redundancy across the entire image range. Power line carrier communication (PLC) and narrowband IoT (NB-IoT) links have limited bandwidth, high latency, and are prone to packet loss and out-of-order delivery. The memory and storage space at the meter end are limited, and there is a risk of power outages.

[0003] The existing technology still has the following shortcomings:

[0004] 1. In weak network and out-of-order scenarios, general differential and whole packet redundancy often rely on global context consistency and large continuous buffers. Cross-range encoding and random writing make transmission and reconstruction unstable. After packet loss, patch application may fail or whole packet rollback may be required.

[0005] 2. Insufficient protection of table-end resources. General decompression and general differential recovery consume a lot of memory and processing steps. They are easily constructed into decompression bombs or oversized patches that trigger memory exhaustion and processing blockage. There is a lack of partition quota and dynamic quota control.

[0006] 3. The consistency and verification granularity is too coarse, relying heavily on image-level signatures or overall hashes, lacking fine-grained page-level certificates, execution dependencies, and incremental witnesses. It is difficult to recover as intended after power failure or abnormal interruption, resulting in a difficult-to-repair semi-upgrade state and a high failure rate.

[0007] Therefore, a method for upgrading the security firmware of electricity meters that can overcome the shortcomings of the existing technology is a problem that needs to be solved by those skilled in the art. Summary of the Invention

[0008] One objective of this invention is to propose a method for secure firmware upgrades of electricity meters. Addressing the problems of existing technologies such as packet loss and out-of-order delivery under weak network conditions, limited bandwidth and meter-end memory constraints, and the risk of decompression bombs due to frequent differential or compression failures, this invention proposes a restricted differential script containing only copy and insert instructions, dual-anchor addresses and page certificate verification, a Merkle directed acyclic graph resource list, fountain code redundancy only for inserted fragments by window, and implementation of fragment-level hashing and node ownership verification, guardian node quota control, monotonically advancing leading-edge pointers, persistent write intent, and page sealing witnessing at the meter end. Combined with root hash verification and without performing general decompression, this invention achieves stable transmission and high success rate upgrades in weak network environments, resistance to memory exhaustion and forged fragment attacks, and support for recovery and end-to-end verifiability after abnormal power outages.

[0009] This invention provides a method for upgrading the security firmware of an electricity meter, comprising:

[0010] S1. Divide and compare the old firmware image and the new firmware image according to the preset page size, generate a restricted differential script containing only copy and insert instructions, encode the target address of each instruction into a dual anchor address, calculate the certificate data of each page of the old firmware, and extract the page-aligned insert slice data from the new firmware image according to the restricted differential script.

[0011] S2. Based on the restricted differential script, page certificate data, and inserted fragment data, construct a Merkle tree directed acyclic graph resource graph in the resource list, map copy, insert, and page seal instructions to nodes, determine window identifier data and page identifier data, establish dependencies based on page offset monotonically without decreasing and prohibiting cross-window references, form micro-instruction dependency relationship data, set guardian node quota data at the window layer and page layer, associate page certificate data with page layer quota, calculate root hash data and inserted fragment fragment-level hash data, and determine fountain code parameter data for each window;

[0012] S3. Based on the window identifier data and fountain code parameter data, perform fountain code redundancy encoding only on the inserted slice data in each window to generate fountain code redundant slice data, and generate encoding seed data according to the encoding seed derivation rule and window identifier data.

[0013] S4. At the electricity meter, decode and recover the inserted chip data based on the fountain code redundant chip data and the encoding seed data, perform chip-level verification based on the inserted chip chip-level hash data, perform node ownership verification based on the micro-instruction dependency data, and perform resource verification based on the guardian node quota data to form executable micro-instruction data. The electricity meter does not execute the general decompression algorithm.

[0014] S5. Based on the executable micro-instruction data, combined with the daemon node quota data and page certificate data, set the leading pointer and execute it in its monotonically advancing order. Before copying, verify the old firmware target page based on the page certificate data. If there is a mismatch, roll back to the corresponding insert instruction. Before inserting, generate and persist the write intent record data based on the target page index, page offset, write length and slice-level hash. When the insert instruction and copy instruction of a certain page are completed and the quota requirements are met, execute the page sealing instruction, generate page completion witness data and determine the sealed page identification data.

[0015] S6. Based on the page completion witness data and the sealed page identifier data, the resource list is verified in conjunction with the root hash data. The corresponding page fountain code redundancy is stopped based on the page completion witness data, forming a new firmware image data that can be started and firmware switching confirmation data. When all pages have generated page completion witness data and the root hash data verification is passed, the energy meter completes the firmware switch.

[0016] Optionally, S1 includes:

[0017] For old firmware images and new firmware images, page division and comparison are performed according to preset page size. Based on the comparison results, a limited differential script containing only copy and insert instructions is generated.

[0018] The target address of each copy instruction and insert instruction is encoded with a double anchor address, which consists of a page index and an offset within the page, with the offset unit being bytes.

[0019] Calculate the hash digest of each page of the old firmware image as page certificate data, which is used for page content verification before the copy instruction is executed;

[0020] Based on the restricted differential script, page-aligned insert slice data is extracted from the new firmware image. The insert slice data records the corresponding page index, page offset, write length and slice content, and the insert slice size does not exceed the preset page size.

[0021] In the process of generating restricted differential scripts, copy instructions that overlap between source and destination addresses are prohibited. If a region that may overlap is encountered, the region is converted into an insert instruction.

[0022] Outputs restricted differential script, page certificate data, and insert slice data.

[0023] Terminology definition:

[0024] The old firmware image is the binary image data of the currently running or stored firmware of the electricity meter in the storage medium.

[0025] The new firmware image is binary image data generated at the sending end for distribution of the target version firmware to be upgraded and deployed;

[0026] The preset page size is a page granularity parameter used to perform equal-length splitting of the firmware image, a positive integer value in bytes, and it remains consistent between the old firmware image and the new firmware image.

[0027] The page is a fixed-length data block obtained by sequentially dividing the firmware image from the first byte according to a preset page size;

[0028] The page index is an unsigned integer identifier that sequentially numbers pages starting from zero, used to uniquely locate pages;

[0029] The page offset is the offset relative to the starting byte of the page, in bytes;

[0030] The page division involves sequentially splitting the firmware image according to a preset page size and generating pages and their indexes.

[0031] The comparison is performed between the old firmware image and the new firmware image, identifying consistent and different regions at the page granularity and necessary byte granularity for the generation of differential information.

[0032] The restricted differential script is an ordered set of instructions consisting only of copy and insert instructions, used to guide the reconstruction of a new firmware image based on the old firmware image and the inserted chip data.

[0033] The copy instruction is a microinstruction that instructs the reading of a specified length of data from the source address of the old firmware image and writing it to the target address;

[0034] The source address is the data location in the old firmware image determined by the page index and the offset within the page;

[0035] The insertion instruction is a microinstruction that instructs the insertion chip data to be written to the target address to generate the corresponding content of the new firmware image;

[0036] The target address is the write location identifier of the instruction, which is determined by the target page index and the offset within the page.

[0037] The page alignment means that the writing range of the inserted slice data does not cross the page boundary and is completely within the same page.

[0038] Optionally, S2 includes:

[0039] Based on the restricted differential script, page certificate data, and inserted slice data, a Merkle tree directed acyclic graph resource graph is constructed in the resource list;

[0040] Map the copy, insert, and page seal commands in the restricted differential script to nodes, and determine the window identifier data and page identifier data corresponding to each node.

[0041] Based on the monotonically non-decreasing order of page offsets and the constraint of prohibiting cross-window references, the dependencies between nodes are established to form microinstruction dependency data, where the node corresponding to the page sealing instruction depends on all copy and insert instructions on the same page to complete.

[0042] Set guardian node quota data at the window layer and page layer. The guardian node quota data shall include at least the write byte quota, memory quota and processing step quota. Associate the page certificate data with the guardian node quota data of the page layer for page content verification of subsequent copy instructions.

[0043] Calculate a hash digest for each inserted slice data to generate slice-level hash data for the inserted slice and record it to the corresponding insertion instruction node;

[0044] The root hash data of the Merkle tree directed acyclic graph resource graph is calculated for overall verification;

[0045] Determine the fountain code parameter data for each window, including redundancy ratio, coding degree distribution and coding seed derivation rules, for subsequent redundancy coding of the inserted slice;

[0046] Output window identifier data, page identifier data, microinstruction dependency data, daemon node quota data, root hash data, inserted fragment-level hash data, and fountain code parameter data.

[0047] Terminology definition:

[0048] The resource list is a structured data set that records the instruction nodes, inserted chips, dependencies, quotas and verification data required for the upgrade, and serves as the basis for consistency between the sending end and the electricity meter end;

[0049] The Merkle tree directed acyclic graph resource graph is a directed acyclic graph structure that uses node content hashes as identifiers and aggregates parent and child hashes to form a root hash, used for overall integrity verification and anti-tampering.

[0050] The node is the smallest execution unit in the resource graph that represents a copy instruction, insert instruction, or page seal instruction;

[0051] The page sealing command is a control command that seals the content of a page and generates a completion witness after all copying and insertion of the same page is completed.

[0052] The window identification data is an identification value used to uniquely identify a window in the resource graph. A window is a unit that logically groups inserted pieces and related nodes to support fountain code encoding and dependency constraints.

[0053] The page identification data is an identification value used to uniquely identify a page in the resource graph, and at least includes the page index or its verification evidence;

[0054] The cross-window reference refers to a node's dependency, read, or write reference to data or nodes within different windows;

[0055] The microinstruction dependency data describes the relationship between nodes in terms of sequential execution constraints and home page constraints, and includes at least the dependent source node, the dependent target node, and the constraint type.

[0056] The window layer is a hierarchical structure in the resource graph that organizes nodes and inserted pieces by window, and is used to set and verify quota and fountain parameters within the window range;

[0057] The page layer is a hierarchical organization of nodes in the resource graph by page, used to bind page certificates and page-level quotas and implement intra-page offset order constraints.

[0058] The guardian node quota data is a set of allowed resource consumption limits for nodes within the window layer or page layer, used to prevent resource exhaustion and denial of service.

[0059] The write byte quota is the maximum number of write bytes allowed within a quota period or window / page range;

[0060] The memory quota is the maximum memory capacity limit allowed to be used during node execution;

[0061] The processing step quota is the maximum number of processing steps or instruction count limit allowed for a node;

[0062] The page certificate data is a page content hash digest calculated for each page of the old firmware image, which is used to verify the page content before the copy instruction is executed and to bind it to the page layer quota.

[0063] The inserted slice-level hash data is a hash digest calculated on the content of a single inserted slice, used for slice-level integrity verification and rapid location of window range;

[0064] The root hash data is the root node hash of the Merkle tree directed acyclic graph resource graph, which is used to perform overall consistency verification on the resource list;

[0065] The fountain code parameter data is a set of parameters used to perform fountain code redundancy coding on the inserted piece within the window, including at least the redundancy ratio, coding degree distribution, and coding seed derivation rules.

[0066] The redundancy ratio is a parameter that represents the ratio of the number of redundant fountain code pieces to the number of original inserted pieces.

[0067] The coding degree distribution is the probability distribution parameter for selecting the number of original fragments to participate in when generating redundant fragments using fountain codes;

[0068] The encoding seed derivation rule is a rule for deterministically generating a random source of encoding based on window identifier data, etc., and is used to consistently reproduce the redundant chip combination at the transmitting end and the electricity meter end.

[0069] Optionally, S3 includes:

[0070] The inserted slice data is organized within a window based on the window identifier data, and fountain code redundancy encoding is performed only on the inserted slice data within each window.

[0071] Based on the fountain code parameter data, the redundancy ratio and coding degree distribution are determined, and the combination relationship is selected from the inserted slice data in the same window according to the coding degree distribution to generate redundant fountain code slice data that can fill in the missing fountain code in a weak network environment, and redundant slice data is not generated for the data corresponding to the copy instruction.

[0072] Based on the coding seed derivation rules and combined with the window identifier data, coding seed data is generated so that the fountain code redundant chip data can be deterministically regenerated between the transmitting end and the energy meter.

[0073] Output fountain code redundant chip data and encoding seed data.

[0074] Terminology definition:

[0075] The fountain code redundancy coding is a data processing procedure that selects several inserted pieces according to the coding degree based on the fountain code parameter data within the same window range and generates redundant pieces for recovery.

[0076] The fountain code redundant chip data is an independent data unit generated by fountain code redundancy encoding. It is used to participate in decoding recovery when the inserted chip is missing, and carries the necessary metadata related to window and combination selection.

[0077] The combination relationship is the original insert piece selection set and its index relationship corresponding to a certain fountain code redundant piece, which is used to characterize the original insert piece set that participated in the generation of the redundant piece.

[0078] The encoded seed data is a deterministic random source generated based on the encoded seed derivation rule and combined with the window identifier data, which is used to drive the selection of insert chips and the generation of redundant chips in a consistent manner at the transmitting end and the electricity meter end.

[0079] The deterministic regeneration refers to the ability of the transmitting end and the energy meter end to independently generate consistent redundant chips and their combination relationships using the same derivation rules under the same window identifier and encoded seed data conditions.

[0080] The sending end is a firmware distribution-side device or system responsible for generating and sending resource lists, inserted chip and fountain code redundant chip data;

[0081] The organization within the window involves grouping and arranging the inserted pieces based on the window identifier data, ensuring that encoding and decoding are performed only within the scope of this window.

[0082] Optionally, S4 includes:

[0083] At the electricity meter end, the redundant chip data of the fountain code and the encoding seed data are decoded, and the inserted chip data is restored according to the window identifier data;

[0084] The recovered insert fragment data is subjected to fragment-level integrity verification based on the fragment-level hash data of the insert fragment. Insert fragment data that fails the verification is rejected and recorded as waiting for redundancy completion.

[0085] By combining restricted differential scripts and microinstruction dependency data, and performing node attribution verification based on window identifier data and page identifier data, the page to which each insert and copy instruction belongs and its execution order are determined.

[0086] Based on the daemon node quota data, the microinstructions to be executed are checked for resources. The resource check includes at least the write byte quota, memory quota, and processing step quota. Microinstructions that do not meet the quota are postponed.

[0087] In this method, the electricity meter does not execute the general decompression algorithm;

[0088] Insert and copy instructions that pass chip-level integrity verification, node ownership verification, and resource verification are aggregated into executable micro-instruction data. The executable micro-instruction data records execution parameters such as micro-instruction type, target page index, page offset, and write length.

[0089] Outputs executable microinstruction data.

[0090] Terminology definition:

[0091] The energy meter terminal is the smart energy meter device-side operating environment that performs decoding, verification, resource checking and writing operations in this method;

[0092] The chip-level integrity verification is a process that uses a single inserted chip as the verification granularity and performs a hash comparison on the received or recovered inserted chip content based on the chip-level hash data of the inserted chip to determine its integrity.

[0093] The node attribution verification is a process based on restricted differential script and microinstruction dependency data, combined with window identifier data and page identifier data, to confirm the window, page, and legal execution order within the same page of each insert or copy instruction.

[0094] The resource verification is a control process that checks resource consumption such as written bytes, memory usage, and processing steps based on the daemon node quota data before microinstruction is executed, and decides whether to allow execution or postpone it accordingly.

[0095] The executable microinstruction data is a set of executable microinstructions formed after slice-level integrity verification, node ownership verification, and resource verification, and includes at least execution parameters such as microinstruction type, target page index, page offset, and write length;

[0096] The general decompression algorithm is a decompression and restoration process for general data compression formats, and is not a decoding algorithm specific to the encoding or verification of this method. It includes, but is not limited to, decompression based on general compression formats such as LZ series, DEFLATE, LZMA, and ZIP.

[0097] The "Waiting for Redundancy Completion" is a processing state set for inserted chips that fail the chip-level integrity verification or are missing, indicating that it is necessary to continue receiving fountain code redundant chips in the same window to complete the recovery of the inserted chip.

[0098] Optionally, S5 includes:

[0099] The leading edge pointer is set based on the executable microinstruction data, and insert and copy instructions are executed in a monotonically advancing order of the leading edge pointer. Write operations across the leading edge pointer are prohibited.

[0100] Before executing the copy command, the dual anchor address is read and the certificate of the target page of the old firmware is verified according to the page certificate data. If the certificate does not match, the copy command is rolled back to the corresponding insert command to maintain the correctness of execution.

[0101] Before executing the insert instruction, write intent record data is generated based on the target page index, page offset, write length and slice hash, and the write intent record data is persisted for recovery after power failure. After persistence, the insert slice data is written to the target page and the leading edge pointer is updated.

[0102] During execution, the resource quota of the micro-instructions to be executed is checked based on the quota data of the guardian node. Micro-instructions that do not meet the quota data of the guardian node are postponed.

[0103] When all insert and copy commands for a page are executed and the daemon node quota data requirements are met, the page sealing command is executed to generate page completion witness data, and the sealed page identifier data for that page is determined based on the page completion witness data.

[0104] The output page contains witness data, sealed page identification data, and write intent record data.

[0105] Terminology definition:

[0106] The leading edge pointer is an indicator value used to define the write progress boundary within a page and constrain the execution order. It indicates the boundary position of the corresponding page that has been confirmed for writing and only advances to a higher offset as a valid write proceeds.

[0107] The monotonic advance sequence is an irreversible execution sequence based on the leading edge pointer from low offset to high offset;

[0108] The cross-leading pointer write is a write operation in which the data range to be written exceeds or crosses the writable boundary defined by the current leading pointer.

[0109] The old firmware target page is the page in the old firmware image that corresponds to the target address of a certain copy instruction, and is used to perform page certificate verification before copying;

[0110] The slice-level hash is a hash digest calculated from the content of the inserted slice, which is equivalent to the slice-level hash data of the inserted slice;

[0111] The write intent record data is record data generated and persisted before the execution of the insert instruction, used for replay and consistency recovery after power failure, and includes at least the target page index, page offset, write length and slice hash;

[0112] The persistence is a storage operation that writes data to a non-volatile storage medium to ensure that it can still be read and recovered after power failure;

[0113] The resource quota check is a process of checking the resource consumption of the micro-instruction to be executed based on the quota data of the guardian node.

[0114] The page completion witness data is evidentiary data generated when the page sealing instruction is executed and bound to the page content. It is used to indicate that the insertion and copying of the page has been completed according to the quota and sealed, and includes summary information for verification.

[0115] The sealed page identification data is a set of identifiers that identify pages that have been sealed, including at least the corresponding page index.

[0116] Optionally, S6 includes:

[0117] Update the resource status of each page based on the page completion witness data, and accordingly stop the fountain code redundancy of the corresponding page from the sending end;

[0118] Based on the sealed page identifier data, the contents of the sealed pages are combined into new firmware image data according to the page index order;

[0119] The resource list is verified as a whole by combining the root hash data. If the verification passes, the bootability of the new firmware image data is confirmed.

[0120] When all pages have generated page completion witness data and the overall verification passes, firmware switch confirmation data is generated and firmware switch is executed.

[0121] Outputs new firmware image data and firmware switch confirmation data.

[0122] Terminology definition:

[0123] The resource status is a set of statuses for the execution and verification progress of each page at the energy meter end, including at least the insertion / copy completion status, sealing status, and quota consumption records, which are used to determine whether to stop the fountain code redundancy of the corresponding page.

[0124] The stop corresponding page fountain code redundancy is a control action based on the page completion witness data to stop the generation, sending or receiving of fountain code redundancy fragment data of the window where the sealed page is located.

[0125] The overall verification is a verification process that verifies the integrity and consistency of the resource list based on the root hash data;

[0126] The new firmware image data is a new firmware binary image data obtained by combining the contents of sealed pages in page index order at the power meter end, and serves as the target image for startup and switching.

[0127] The bootability refers to the attribute of the new firmware image data meeting the boot prerequisites such as the overall verification of the resource list passing and all pages having complete witnesses.

[0128] The firmware switching confirmation data is recorded data used to confirm that the switching conditions are met and trigger the firmware switching, and includes at least proof of root hash verification and summary information of all sealed page identification data;

[0129] The firmware switching is a controlled process of switching the operating environment of the electricity meter from an old firmware image to a new firmware image.

[0130] Optionally, the quota data for the guardian node is dynamic. The electricity meter adjusts the write byte quota, memory quota, and processing step quota using a sliding window based on real-time resource monitoring data. The resource monitoring data includes at least the remaining memory, processor utilization, and temperature threshold.

[0131] Optionally, window certificate data is set for each window. The window certificate data is the Merkle root of the hash data of all inserted chips in the window. The energy meter verifies the window certificate data in the S4 stage to quickly locate counterfeit or tampered chips in the window.

[0132] Optionally, the electricity meter adopts a tiered quota strategy for memory allocation during the resource verification process. The chip receiving buffer, decoding working area and write intent log area are each set with independent memory limits to prevent a single buffer from exhausting the meter's memory.

[0133] The beneficial effects of this invention are:

[0134] 1. Significantly improve upgrade success rate and transmission efficiency in weak network environments: By performing fountain code redundancy on inserted fragments only within the window, page alignment and fragment-level hash verification, combined with micro-instruction dependency and node ownership verification, it resists packet loss and out-of-order delivery, and reduces retransmission and bandwidth overhead.

[0135] 2. Enhance table-side security and resource control: By using restricted differential scripts and avoiding the execution of general decompression, combined with guardian node quotas and partition memory limits, window certificates and root hash verification, it effectively prevents decompression bombs and memory exhaustion, intercepts forged or tampered fragments, and reduces the risk of denial of service.

[0136] 3. Improve execution correctness and recoverability: By using dual anchor addresses and page certificates for pre-copy verification and mismatch rollback insertion, write intent persistence and monotonic advancement of the leading edge pointer, page sealing witness and page-by-page stop redundancy, crash consistency and rapid power failure recovery are achieved, and end-to-end verifiability is guaranteed. Attached Figure Description

[0137] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0138] Figure 1 This is a flowchart of a method for upgrading the security firmware of an electricity meter according to the present invention;

[0139] Figure 2 This is a flowchart of the resource list and dependency construction process for step S2 of the present invention;

[0140] Figure 3 This is a flowchart of step S5 of the present invention: monotonically advancing the leading pointer - copying the previous page certificate verification and rolling back to insertion - persisting the write intent - page sealing witness. Detailed Implementation

[0141] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0142] refer to Figure 1 A method for upgrading the security firmware of an electricity meter, comprising:

[0143] S1. Divide and compare the old firmware image and the new firmware image according to the preset page size, generate a restricted differential script containing only copy and insert instructions, encode the target address of each instruction into a dual anchor address, calculate the certificate data of each page of the old firmware, and extract the page-aligned insert slice data from the new firmware image according to the restricted differential script.

[0144] S2. Based on the restricted differential script, page certificate data, and inserted fragment data, construct a Merkle tree directed acyclic graph resource graph in the resource list, map copy, insert, and page seal instructions to nodes, determine window identifier data and page identifier data, establish dependencies based on page offset monotonically without decreasing and prohibiting cross-window references, form micro-instruction dependency relationship data, set guardian node quota data at the window layer and page layer, associate page certificate data with page layer quota, calculate root hash data and inserted fragment fragment-level hash data, and determine fountain code parameter data for each window;

[0145] S3. Based on the window identifier data and fountain code parameter data, perform fountain code redundancy encoding only on the inserted slice data in each window to generate fountain code redundant slice data, and generate encoding seed data according to the encoding seed derivation rule and window identifier data.

[0146] S4. At the electricity meter, decode and recover the inserted chip data based on the fountain code redundant chip data and the encoding seed data, perform chip-level verification based on the inserted chip chip-level hash data, perform node ownership verification based on the micro-instruction dependency data, and perform resource verification based on the guardian node quota data to form executable micro-instruction data. The electricity meter does not execute the general decompression algorithm.

[0147] S5. Based on the executable micro-instruction data, combined with the daemon node quota data and page certificate data, set the leading pointer and execute it in its monotonically advancing order. Before copying, verify the old firmware target page based on the page certificate data. If there is a mismatch, roll back to the corresponding insert instruction. Before inserting, generate and persist the write intent record data based on the target page index, page offset, write length and slice-level hash. When the insert instruction and copy instruction of a certain page are completed and the quota requirements are met, execute the page sealing instruction, generate page completion witness data and determine the sealed page identification data.

[0148] S6. Based on the page completion witness data and the sealed page identifier data, the resource list is verified in conjunction with the root hash data. The corresponding page fountain code redundancy is stopped based on the page completion witness data, forming a new firmware image data that can be started and firmware switching confirmation data. When all pages have generated page completion witness data and the root hash data verification is passed, the energy meter completes the firmware switch.

[0149] In this specific embodiment, S1 includes:

[0150] The sending end first sets the preset page size. (Unit: bytes), and for the old firmware image With the new firmware image Starting from the first byte Divide the pages into equal-length sections and number them sequentially to obtain the page index. Page offsets are established in bytes within each page. Then, at the page level, the necessary byte level is combined with the byte level. and The comparison is performed to generate a restricted difference script containing only copy and insert instructions. The target address of each instruction is encoded using a double-anchor address. And record the write length. Copy command from The source address reads a specified length of data and writes it to the target double-anchor address. The insert instruction directly writes the corresponding new content to the target double-anchor address and the inserted slice is aligned to the page and does not cross the page boundary.

[0151] To avoid unpredictable overwriting in weak network and resource-constrained environments, copy instructions with overlapping source and destination address ranges are prohibited during script generation. When potential overlap is detected, the range is rewritten as an insertion instruction and used accordingly. Extract the inserted slice data, and index the inserted slice data record by record page. Page offset Write length The content of the inserted image should be consistent with the image content, and the size of the inserted image should not exceed [the specified value]. ;

[0152] To support rapid consistency verification of the copied page content on the table later, page certificate data is calculated for each page of the old firmware image, with the page index as follows. The corresponding certificate for the page is obtained using the following formula:

[0153] ;

[0154] in Indicates page index is Old firmware page certificate data, Represents a cryptographic hash function. This indicates that the page index in the old firmware image is The page content, Represents the page index and is an unsigned integer starting from zero. Indicates the preset page size in bytes. "Indicates byte concatenation operation;

[0155] Output constrained difference script Page certificate data arranged in page order And the corresponding set of inserted slice data, for use in subsequent resource inventory building and upgrade execution.

[0156] In this specific embodiment, S2 includes:

[0157] The sending end uses a restricted differential script Page certificate data A Merkle tree directed acyclic graph resource graph is constructed in the resource list along with the inserted slice data. Copy instructions, insert instructions, and page seal instructions are mapped to nodes, and window identifier data and page identifier data are determined for each node. Within the same page, the offsets are calculated according to the page offset. (Unit: bytes) The monotonically non-decreasing order establishes dependencies and prohibits cross-window references, where the node corresponding to the page sealing instruction depends on all copied and inserted nodes of that page.

[0158] Set daemon node quota data at the window and page levels. Daemon node quotas should include at least write byte quota, memory quota, and processing step quota. Also, store page certificate data at the page level. Bind to the daemon node quota of this page for page content verification before subsequent copy commands are executed;

[0159] For each inserted slice, calculate the slice-level hash data and write it to the corresponding insertion instruction node to support fast location within the window and slice-level integrity verification;

[0160] Then, the root hash data of the resource graph is calculated according to the parent-child hash aggregation order. For ease of description, the final root hash can be simplified as follows:

[0161] ;

[0162] in This represents the root hash data of a Merkle tree directed acyclic graph resource graph. Represents a cryptographic hash function. Indicates the first The hash of each node's content is obtained by concatenating the node type, window identifier data, page identifier data, and dependency digest in a fixed order and then taking the hash. This represents the total number of nodes participating in the aggregation. "Indicates a byte concatenation operation in a fixed order;

[0163] In the root hash data Once determined, fountain code parameter data is assigned to each window, including redundancy ratio, coding degree distribution, and coding seed derivation rules. The construction results are then output as window identifier data, page identifier data, microinstruction dependency data, daemon node quota data, and root hash data. Insert slice-level hash data and fountain code parameter data.

[0164] In this specific embodiment, S3 includes:

[0165] The sending end organizes the inserted slice data within a window based on the window identifier data, and performs fountain code redundancy encoding on the inserted slice data only within each window, strictly prohibiting cross-window selection and combination;

[0166] The sending end reads the fountain code parameter data, which includes at least the redundancy ratio. With coding degree distribution Based on this, the number of fountain code redundant slice data to be generated in each window and the data participation degree of each redundant slice are determined, and it is made clear that no redundant slice data will be generated for the data corresponding to the copy instructions in the restricted differential script;

[0167] To ensure deterministic regeneration of the fountain code redundancy data at both the transmitting and energy meter ends, a unified coding seed derivation rule is used for the coding random source of each window, combined with the window identifier data of that window to generate coding seed data. The derivation relationship can be represented as follows:

[0168] ;

[0169] in The window identifier data is The window's encoded seed data, Represents a cryptographic hash function. This indicates the window's identifier data, which is unique within the resource list. This represents the redundancy ratio of the fountain code and is a non-negative real number parameter. A parameterized representation or summary of the coded degree distribution. "Indicates a byte concatenation operation in a fixed order;

[0170] The sending end uses by A deterministic pseudo-random selection process driven by degree distribution Within the same window's set of inserted chip data, a combination relationship is selected and generated using an XOR linear combination to produce fountain code redundant chip data. Simultaneously, each fountain code redundant chip data entry carries necessary metadata for meter-end attribution and decoding, including but not limited to window identification data. The system summarizes the local sequence number, degree, and selection relationship of redundant slices, thereby enabling the completion of missing insert slices and robust recovery of out-of-order slices in weak network environments.

[0171] Output fountain code redundant chip data and encoding seed data.

[0172] In this specific embodiment, S4 includes:

[0173] The electricity meter first uses the fountain code redundancy chip data and the coding seed data. Perform in-window decoding, according to the window identifier data. Restore the inserted slice data and index the restored inserted slices by page within the same window. Offset within page Grouping them for subsequent verification and scheduling;

[0174] Subsequently, a fragment-level integrity verification is performed on each recovered insert fragment, and the contents of the insert fragment are verified. The hash of the insert fragment-level hash data recorded in the resource list By comparing and verifying the relationship, it can be represented as follows:

[0175] ;

[0176] in Represents a cryptographic hash function. Indicates that the index is The inserted content originates from data identified by window. The result of decoding the fountain code. This indicates the slice-level hash data recorded in the resource manifest for the inserted slice and is used for slice-level integrity verification. The index of the inserted slice within the same window is an unsigned integer;

[0177] Inserted chips that fail verification are rejected and marked as awaiting redundancy completion, and are not included in subsequent execution; after passing chip-level integrity verification, the energy meter terminal combines the restricted differential script. Data related to microinstructions, based on window identifier data. Verify the ownership of the execution node with the page identifier data, confirm the page to which each insert and copy command belongs and the legal execution order within the page, and eliminate cross-window references and out-of-order writes;

[0178] For microinstructions intended to enter the execution queue, the energy meter performs resource checks based on the guardian node quota data, checking at least the write byte quota, memory quota, and processing step quota. Microinstructions that do not meet the quotas are postponed for execution.

[0179] In this implementation, the electricity meter does not execute the general decompression algorithm, thus avoiding the risk of memory exhaustion and decompression bomb caused by general decompression from the source;

[0180] Finally, the insert and copy instructions that have undergone fragment-level integrity verification, node ownership verification, and resource checking will be aggregated into executable micro-instruction data. This data records the micro-instruction type and target page index. Page offset With write length These execution parameters are used for the monotonic advancement of the leading edge pointer and the witnessing of page sealing in subsequent steps.

[0181] In this specific embodiment, S5 includes:

[0182] The electricity meter establishes a page-level execution queue and sets a leading-edge pointer based on the executable microinstruction data. ,in Indicates page index is The page write progress boundary is in bytes and monotonically advances only to higher offsets with valid writes, while imposing a "prohibit writes across leading edge pointers" constraint on the execution of insert and copy instructions to avoid out-of-bounds or out-of-order writes.

[0183] When preparing to execute a copy instruction, the energy meter reads the target dual-anchor address of the copy instruction. With write length The certificate of the target page in the old firmware is verified to confirm the prerequisites for copying. The verification relationship can be expressed as follows:

[0184] ;

[0185] in Represents a cryptographic hash function. This indicates that the page index in the old firmware image is The page content, Represents the page index and is an unsigned integer starting from zero. This indicates the preset page size in bytes. Indicates page index is The old firmware page certificate data, "Indicates a byte concatenation operation in a fixed order;

[0186] If the certificate does not match, the copy command will be rolled back to the corresponding insert command to ensure correct execution.

[0187] When preparing to execute an insert command, the energy meter terminal uses the target page index. Page offset Write length With slice-level hashing Generate write intent record data and will Persist to non-volatile memory for recovery after power failure. After persistence is complete, write the inserted slice data to the target page and set the leading edge pointer. Update to the new confirmed boundary;

[0188] During execution, the power meter performs resource quota checks on the micro-instructions to be executed based on the quota data of the guardian node. This includes at least the write byte quota, memory quota, and processing step quota. Micro-instructions that do not meet the quotas are postponed.

[0189] When all insert and copy instructions for a page are executed and the daemon node quota requirements are met, the page sealing instruction is executed to generate page completion witness data. Based on the page completion witness data, the sealed page identifier data for that page is determined. Subsequent scheduling only continues to advance the leading pointer and execute micro-instructions for unsealed pages.

[0190] In this specific embodiment, S6 includes:

[0191] The energy meter summarizes the completed witness data and sealed page identification data. First, based on the completed witness data, it updates the resource status of each page and confirms the sealing status and quota consumption records. Then, based on the sealed page identification data, it stops the fountain code redundancy of the corresponding page to avoid continuing to receive and send invalid redundant fragments. After the sealing status is stable and no more redundant fragments are received for that page, the energy meter renames the sealed page content according to the page index. The sequential combination forms the new firmware image data. Furthermore, a comprehensive verification of the Merkle tree directed acyclic graph resource graph is performed at the resource list level to confirm that it has not been tampered with. The equivalent representation of the comprehensive verification is:

[0192] ;

[0193] in Represents a cryptographic hash function. Indicates the first The hash of each node's content is obtained by concatenating the node type, window identifier data, page identifier data, and dependency digest in a fixed byte order and then hashing the result. Represents the node index and its value ranges from 1 to... This represents the total number of nodes participating in the aggregation. This represents the root hash data of a Merkle tree directed acyclic graph resource graph. "Indicates a byte concatenation operation in a fixed order;

[0194] When all pages have generated page completion witness data and the overall verification passes, the energy meter generates firmware switch confirmation data to trigger firmware switch. This firmware switch confirmation data includes at least proof of successful root hash verification and summary information of all sealed page identification data to support end-to-end verifiability and audit traceability. Finally, it outputs new firmware image data. Confirmation data for firmware switch.

[0195] In this specific embodiment, it includes:

[0196] The quota data for the guardian node is set to dynamic quota, and the quota at the electricity meter is set to a sliding window length. To periodically collect resource monitoring data and adjust write byte quotas, memory quotas, and processing step quotas accordingly, the resource monitoring data should include at least the following indicators: remaining memory and total memory capacity, processor utilization, and device temperature. Remaining memory is denoted as... (Unit: bytes), total memory capacity is denoted as (Unit: bytes), processor utilization is denoted as (An unsigned real number ranging from 0 to 1), the equipment temperature is denoted as... (Unit: degrees Celsius), temperature threshold is denoted as (Unit: degrees Celsius), the current adjustment cycle index is denoted as ;

[0197] To avoid jitter and over-response, the monitoring data at the electricity meter is standardized and weighted within a sliding window to obtain adjustment coefficients for regulating the three types of quotas. The adjustment coefficient for the written byte quota is denoted as... The adjustment factor for memory quota is denoted as The adjustment factor for the processing step quota is denoted as And set upper and lower limits for various quotas to form boundary protection, wherein the upper and lower limits for write byte quotas are respectively denoted as and The upper and lower limits of memory quotas are respectively denoted as and The upper and lower limits of the processing step quota are respectively denoted as and ;

[0198] The update relationship of write byte quotas between adjacent adjustment periods can be represented as:

[0199]

[0200] in Indicates the first Write byte quota per cycle, in bytes. This indicates the write byte quota for the next cycle, in bytes. Indicates based on the length of the sliding window The adjustment coefficients are calculated based on the resource monitoring data within the area using a fixed weight and then... and relatively The relationship changes monotonously. Indicates the real number Restricted to closed intervals The clipping function within, and These represent the lower and upper limits of the write byte quota, respectively, in bytes;

[0201] Memory quotas and processing step quotas adopt an update relationship isomorphic to write byte quotas, respectively using... and Drive it in the interval and The system prunes and updates the quotas, automatically tightening them when remaining memory decreases, processor utilization increases, or device temperature exceeds a threshold, and appropriately loosening them when resources are restored, thereby improving the security and stability of microinstruction execution in weak network and resource-constrained scenarios.

[0202] In this specific embodiment, it includes:

[0203] The sending end generates window certificate data for each window and publishes it along with the resource manifest. Specifically, it does so based on the window identifier data. Index the insert fragment-level hash data within the same window by the target page. Offset within page The data is deterministically sorted lexicographically, organized only within a window, and cross-window mixing is prohibited. Then, based on this ordered sequence, the window certificate data is calculated as the Merkle root of all inserted fragment-level hash data within that window, denoted as . , written as:

[0204] ;

[0205] in The window identifier data is The window certificate data is equivalent to the Merkle root of the fragmented hash data set inserted within that window. Represents a cryptographic hash function. The window identifier data is The first window The slice-level hash data of each inserted slice is derived from the hash calculated on the content of the inserted slice in step S2. This indicates that the window identifies the data and is unique within the resource list. This represents the local index of the inserted slice within the window, and its value ranges from 1 to... Display window The total number of inserts, "Indicates a byte concatenation operation in a fixed order;

[0206] The sending end will The position of each inserted piece within the window is recorded along with the corresponding Merkel path proof for table verification.

[0207] In step S4, after the energy meter completes the fountain code decoding and restores the inserted chip, it first checks the window certificate data. The slice-level hash data of the inserted slice The location and path proof carried with the chip is used for rapid membership verification. Inserted chips that pass the verification enter the chip-level integrity verification and node ownership verification process. Inserted chips that fail the verification are immediately marked as forged or tampered and are refused entry into the executable micro-instruction data. At the same time, the corresponding index range in the window is set to the waiting redundancy completion state.

[0208] When a window experiences consecutive member verification failures, the electricity meter data... The stable location quickly narrows down the problem area and only requests redundant fragment data of the fountain code in that window, thereby reducing the retransmission range and improving the efficiency and interception capability of locating forged or tampered fragments in weak network scenarios.

[0209] In this specific embodiment, it includes:

[0210] During resource verification at the electricity meter, a tiered quota strategy is adopted for memory allocation. Available memory is divided into three functional areas: a slice receive buffer, a decoding work area, and a write intent log area. Independent memory limits are set for each of these three areas. The memory limit for the slice receive buffer is denoted as... (Unit: bytes), the maximum memory limit of the decoding workspace is denoted as... (Unit: bytes), the maximum memory limit for writing to the intent log area is denoted as... (Unit: bytes), and also set the global memory limit for the daemon node quota data. (Unit: bytes) to constrain overall occupancy;

[0211] In the Record the current occupancy of the three types of areas within each quota check cycle, and record the occupancy of the slice receive buffer as follows: (Unit: bytes), the decoding workspace occupancy is recorded as... (Unit: bytes), the write intent log area occupancy is recorded as... (Unit: bytes) When a microinstruction triggers a memory allocation, the electricity meter determines the target area based on the allocated memory region. With application size (Unit: bytes) Perform admission determination; the admission rules can be expressed as:

[0212] ;

[0213] in Indicates the first Each inspection cycle covers the target area. The memory allocation admission flag has a value of 1 indicating that allocation is allowed and a value of 0 indicating that allocation is denied. Indicates that the indicator function is used to map Boolean conditions to value, This indicates the size of the memory requested in this application, expressed in bytes. This means taking the smaller of two real numbers. The memory limits corresponding to the three types of regions are respectively. and Corresponding to the three types of regions in the first Current usage per cycle and This indicates the global memory limit and is used to prevent the total memory usage of different regions from exceeding the overall threshold.

[0214] when At that time, the electricity meter reserves memory for that area and updates the corresponding occupancy count. At the same time, the electricity meter adopts differentiated backoff and recovery strategies based on the target area: for chip receiving buffers, it triggers discarding or rate limiting and requests the transmitter to suspend the transmission of redundant chips with fountain codes in the same window; for decoding work areas, it suspends low-priority decoding tasks and retryes after resource release; for write intent log areas, it prioritizes recording write intent data. Write to non-volatile storage to reclaim memory, thereby ensuring that no single buffer can exhaust table-end memory and maintain stable scheduling and secure execution of executable microinstruction data in weak network and resource-constrained scenarios.

[0215] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

[0216] This invention combines several key elements, including restricted differential scripts, dual-anchor addresses and page certificates, Merkle directed acyclic graph resource lists, fountain code redundancy applied only to inserted fragments within a window, fragment-level hashing and node ownership verification, daemon node quotas, leading-edge pointer advancement, write intent persistence, page sealing witness, and root hash verification. These elements address root causes such as packet loss and out-of-order delivery in weak networks, limited bandwidth, and limited table-end memory. Inserted fragments are filled in within the window using fountain codes, ensuring robustness against out-of-order delivery and packet loss. Page certificates are used to verify copy instructions before execution, and insertion is reversed if a mismatch occurs, guaranteeing update correctness. Micro-instruction dependencies and node ownership constraints determine the execution order and the page to which the fragment belongs. Fragment-level hashing and window certificates quickly eliminate forged fragments. Leading-edge pointers and page sealing witness provide a monotonic, bounded write process and completion evidence, and stop redundancy by page to save bandwidth. Daemon node quotas and partition memory limits suppress resource exhaustion, and general decompression is avoided to narrow the attack surface. Therefore, stable transmission and high-success-rate upgrades are achieved under weak network conditions, while improving end-to-end verifiability and recoverability after anomalies.

[0217] This invention improves the algorithm structure to address the aforementioned technical problems. The differential script retains only copy and insert micro-instructions and prohibits overlapping copying. The target address uses dual-anchor encoding of page index and intra-page offset, making the execution boundary clear and controllable. The resource list is constructed as a Merkle directed acyclic graph with window and page layers, ensuring that intra-page offsets are monotonically constant and prohibiting cross-window references. Multi-layered verification is formed in conjunction with window certificates and root hashes. The redundancy strategy is changed from full-mirror redundancy to intra-window fountain coding only for inserted slices. The encoding degree and seed derivation are bound to the window, reducing the redundancy range and facilitating deterministic regeneration on the end side. The execution strategy uses monotonically advancing leading-edge pointers and introduces persistent write intent and page sealing witnessing. Upon power failure, the page can be replayed according to the intent, and the witness determines the completion of the page. Resource governance uses dynamic sliding windows with guardian node quotas and partitioned memory limits to avoid filling a single buffer. These structural improvements, through collaboration on transmission, verification, and execution, further reduce bandwidth overhead and memory peaks, enhance anti-out-of-order and anti-attack capabilities, and thus better achieve stable, secure, and recoverable upgrades.

Claims

1. A method for secure firmware upgrade of an electric energy meter, characterized in that, The method comprises the following steps: S1, page division and comparison of the old firmware image and the new firmware image according to a preset page size, generation of a restricted difference script containing only copy instructions and insert instructions, encoding of each instruction target address into a double-anchor address, calculation of old firmware page certificate data, and extraction of page-aligned insert piece data from the new firmware image according to the restricted difference script; S2, construction of a Merkle tree directed acyclic graph resource graph in the resource list according to the restricted difference script, page certificate data and insert piece data, mapping of copy, insert and page sealing instructions into nodes, determination of window identifier data and page identifier data, establishment of dependencies according to the monotonic non-decrease of the page offset and the prohibition of cross-window references, formation of micro instruction dependency relationship data, setting of guardian node quota data at the window layer and the page layer, association of the page certificate data with the page layer quota, calculation of root hash data and insert piece piece-level hash data, and determination of fountain code parameter data for each window; S3, execution of fountain code redundant encoding on the insert piece data only in each window according to the window identifier data and the fountain code parameter data, generation of fountain code redundant piece data, and generation of encoding seed data in combination with the window identifier data according to the encoding seed derivation rule; S4, decoding and restoring of the insert piece data at the electric energy meter according to the fountain code redundant piece data and the encoding seed data, piece-level verification according to the insert piece piece-level hash data, node attribution verification according to the micro instruction dependency relationship data, and resource checking according to the guardian node quota data, formation of executable micro instruction data, and the electric energy meter not executing a general decompression algorithm; S5, setting of a front pointer and execution in a monotonic advancing order according to the executable micro instruction data, the guardian node quota data and the page certificate data, verification of an old firmware target page according to the page certificate data before copying, rollback to the corresponding insert instruction when the target page does not match, generation and persistent writing of write intention record data according to the target page index, page offset, writing length and piece-level hash before inserting, execution of a page sealing instruction when the insert instruction and the copy instruction of a certain page are completed and the quota requirement is met, generation of page completion witness data and determination of sealed page identifier data; S6, verification of the resource list according to the page completion witness data and the sealed page identifier data in combination with the root hash data, and stopping of the corresponding page fountain code redundancy according to the page completion witness data, formation of a startable new firmware image data and firmware switching confirmation data, and completion of the firmware switching of the electric energy meter when all pages generate the page completion witness data and the root hash data verification is passed.

2. The method of claim 1, wherein the method further comprises: S1 comprises: page division and comparison of the old firmware image and the new firmware image according to a preset page size, and formation of a restricted difference script containing only copy instructions and insert instructions based on the comparison result; double-anchor address encoding of the target address of each copy instruction and insert instruction, the double-anchor address being composed of a page index and a page offset and being offset in byte units; calculation of the hash digest of each page of the old firmware image as page certificate data for page content verification before execution of the copy instruction; extraction of page-aligned insert piece data from the new firmware image according to the restricted difference script, the insert piece data recording the corresponding page index, page offset, writing length and piece content, and the insert piece size not exceeding the preset page size; In the restricted differential script generation process, the copy instruction with the source address and the target address overlapping is prohibited, and the interval where the overlap may occur is converted into an insertion instruction; Output the restricted differential script, page certificate data, and insertion piece data.

3. The method of claim 1, wherein the method further comprises: S2 includes: According to the restricted differential script, the page certificate data, and the insertion piece data, a Merkle tree directed acyclic graph resource graph is constructed in the resource list; The copy instruction, the insertion instruction, and the page sealing instruction in the restricted differential script are mapped into nodes respectively, and the window identifier data and the page identifier data corresponding to each node are determined; According to the monotone non-decreasing order of the intra-page offset and the constraint of prohibiting cross-window reference, the dependency relationship between the nodes is established, and the micro-instruction dependency relationship data is formed, wherein the node corresponding to the page sealing instruction depends on all the copy instructions and the insertion instructions in the same page to complete; Guard node quota data is set at the window layer and the page layer, the guard node quota data at least includes the write byte quota, the memory quota, and the processing step quota, and the page certificate data and the guard node quota data at the page layer are associated for subsequent page content verification of the copy instruction; The hash digest of each insertion piece data is calculated to generate the insertion piece piece-level hash data and recorded to the corresponding insertion instruction node; The root hash data of the Merkle tree directed acyclic graph resource graph is calculated for overall verification; Fountain code parameter data is determined for each window, including the redundancy ratio, the encoding degree number distribution, and the encoding seed derivation rule, which is used for subsequent redundant encoding on the insertion piece; Output the window identifier data, the page identifier data, the micro-instruction dependency relationship data, the guard node quota data, the root hash data, the insertion piece piece-level hash data, and the fountain code parameter data.

4. The method of claim 1, wherein the method further comprises: S3 includes: According to the window identifier data, the insertion piece data is organized within the window, and the fountain code redundant encoding is only performed on the insertion piece data within the window; According to the fountain code parameter data, the redundancy ratio and the encoding degree number distribution are determined, and the combination relationship is selected from the insertion piece data of the same window according to the encoding degree number distribution, to generate the fountain code redundant piece data that can fill in the missing data in the weak network environment, and no redundant piece data is generated for the data corresponding to the copy instruction; According to the encoding seed derivation rule and in combination with the window identifier data, the encoding seed data is generated, so that the fountain code redundant piece data can be deterministically regenerated between the sending end and the electric energy meter; Output the fountain code redundant piece data and the encoding seed data.

5. The method of claim 1, wherein S4 It includes: At the electric energy meter end, the fountain code redundant piece data and the encoding seed data are decoded according to the window identifier data to recover the insertion piece data; According to the insertion piece piece-level hash data, the piece-level integrity of the recovered insertion piece data is verified, and the insertion piece data that fails the verification is rejected and recorded as waiting for redundant filling; According to the window identifier data and the page identifier data, the node attribution verification is performed in combination with the restricted differential script and the micro-instruction dependency relationship data, to determine the belonging page and the execution order of each insertion instruction and copy instruction; According to the guard node quota data, the resource of the micro-instruction to be executed is checked, and the resource checking at least includes the write byte quota, the memory quota, and the processing step quota, and the micro-instruction that does not meet the quota is delayed for execution; In the method, the electric energy meter does not execute the general decompression algorithm; The insertion instruction and the copy instruction passing through the chip-level integrity verification, the node attribution verification and the resource checking are converged into executable micro-instruction data, and the executable micro-instruction data records execution parameters such as micro-instruction type, target page index, in-page offset and write length; The executable micro-instruction data is outputted.

6. The method of claim 1, wherein the method further comprises: S5 comprises: The front pointer is set according to the executable micro-instruction data, and the insertion instruction and the copy instruction are executed in the monotonic advancing order of the front pointer, and the write operation across the front pointer is prohibited; The double-anchor address is read before the copy instruction is executed, and the certificate check is performed on the old firmware target page according to the page certificate data, and when the certificate does not match, the copy instruction is rolled back to the corresponding insertion instruction to maintain the execution correctness; Before the insertion instruction is executed, the write intention record data is generated according to the target page index, the in-page offset, the write length and the chip-level hash, and the write intention record data is persisted for recovery after power failure, and after the persistence is completed, the insertion chip data is written into the target page and the front pointer is updated; In the execution process, the resource quota checking is performed on the micro-instruction to be executed according to the daemon node quota data, and the micro-instruction that does not meet the daemon node quota data is delayed for execution; When the insertion instruction and the copy instruction of a page are all executed and meet the requirements of the daemon node quota data, the page sealing instruction is executed to generate page completion witness data, and the sealed page identification data of the page is determined according to the page completion witness data; The page completion witness data, the sealed page identification data and the write intention record data are outputted.

7. The method of claim 1, wherein S6 Comprise: The resource state of each page is updated according to the page completion witness data, and the corresponding page fountain code redundancy is stopped from the sending end; According to the sealed page identification data, the contents of the sealed pages are combined into new firmware image data in the order of page index; The overall check is performed on the resource list in combination with the root hash data, and when the check is passed, the launchability of the new firmware image data is confirmed; When all the pages generate the page completion witness data and the overall check is passed, the firmware switching confirmation data is generated and the firmware switching is executed; The new firmware image data and the firmware switching confirmation data are outputted.

8. The method of claim 3, wherein the method further comprises: The daemon node quota data is a dynamic quota, and the write byte quota, the memory quota and the processing step quota are adjusted in a sliding window according to the real-time resource monitoring data of the electric energy meter terminal, and the resource monitoring data at least includes residual memory, processor occupancy rate and temperature threshold.

9. The method of claim 3, wherein the method further comprises: Window certificate data is set for each window, and the window certificate data is the Merkle root of all insertion chip chip-level hash data in the window, and the electric energy meter terminal verifies the window certificate data in the S4 stage, which is used to quickly locate the forged or tampered chip in the window.

10. The method of claim 5, wherein the method further comprises: In the resource checking process, the electric energy meter terminal adopts a layered quota strategy for the memory quota, and the chip receiving buffer area, the decoding work area and the write intention log area are respectively set with independent memory upper limits to prevent a single buffer area from exhausting the terminal memory.

Images