Photovoltaic data security assurance method, system and device fusing trusted computing and block chain, and medium

Abstract

The invention discloses a photovoltaic data security guarantee method and system fusing trusted computing and a block chain, equipment and a medium. The method comprises the following steps: performing integrity measurement on photovoltaic acquisition equipment through a trusted measurement mechanism to generate an equipment measurement log; when the equipment credibility verification result is passed, encrypting photovoltaic data acquired by the photovoltaic acquisition equipment in the credible execution environment and generating a data abstract, and signing the data abstract through the credible platform module to form an encrypted data packet; extracting voucher information from the encrypted data packet, writing the voucher information into the block chain after the voucher information passes the verification of the smart contract to obtain an evidence storage receipt, and establishing an encrypted transmission channel after the identity authentication is passed; and transmitting the encrypted data packet through the encrypted transmission channel. The problems that in an existing data security guarantee method, integrity verification of collection equipment is not comprehensive, data processing lacks credible protection, identity authentication reliability is insufficient, transmission log traceability is poor, and stored data is prone to being tampered and difficult to recover are solved.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to a method, system, device and medium for photovoltaic data security that integrates trusted computing and blockchain. Background Technology

[0002] The energy transition is driving the rapid development of the photovoltaic industry. During the operation of photovoltaic systems, a large amount of data related to power generation and component status is generated. This data is the core basis for operation and maintenance monitoring and fault diagnosis, and it also directly affects grid dispatch and revenue settlement.

[0003] However, existing data security methods are not comprehensive enough in verifying the integrity of photovoltaic data acquisition equipment. They focus only on software status while ignoring hardware characteristics and fail to combine blockchain benchmarks to determine the trustworthiness of the equipment, resulting in data from untrusted equipment flowing into the photovoltaic system. Furthermore, the data processing stage lacks protection of a trusted execution environment, making encrypted signatures vulnerable to attacks, and trusted credentials are not confirmed with the help of smart contracts. In addition, identity authentication mostly adopts a simple two-way mode without a multi-role architecture, resulting in insufficient reliability. At the same time, data transmission logs are incomplete, and digests are not synchronized to the blockchain, making it difficult to trace anomalies. Finally, the storage stage lacks partitioned encrypted management and does not regularly generate verification values ​​and upload them to the blockchain, making it difficult to detect and recover data after tampering in a timely manner. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a photovoltaic data security assurance method, system, device, and medium that integrates trusted computing and blockchain to solve the problems of incomplete integrity verification of acquisition equipment, lack of trusted protection in data processing, insufficient reliability of identity authentication, poor traceability of transmission logs, and easy tampering and difficulty in recovery of stored data in existing data security assurance methods.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, the present invention provides a photovoltaic data security assurance method integrating trusted computing and blockchain, comprising: performing integrity measurement on photovoltaic data acquisition equipment through a trusted measurement mechanism to generate equipment measurement logs; comparing the equipment measurement logs with pre-stored benchmark measurement values ​​in the blockchain to obtain a trusted verification result for the equipment; when the trusted verification result is passed, encrypting the photovoltaic data acquired by the photovoltaic data acquisition equipment in a trusted execution environment and generating a data digest; signing the data digest through a trusted platform module to form an encrypted data packet; extracting credential information from the encrypted data packet; when the credential information is verified by a smart contract and written to the blockchain to obtain a proof receipt; authenticating the data sender and data receiver based on the proof receipt and the equipment measurement logs; establishing an encrypted transmission channel after successful authentication; transmitting the encrypted data packet through the encrypted transmission channel and performing real-time integrity verification during the transmission process; synchronizing the transmission behavior logs and log digests to the blockchain; writing the received encrypted data packet to an encrypted storage area bound to the trusted platform module; periodically generating integrity verification values ​​for the encrypted storage area and uploading them to the blockchain.

[0007] As a preferred embodiment of the photovoltaic data security assurance method integrating trusted computing and blockchain described in this invention, the step of generating a device measurement log by performing integrity measurement on the photovoltaic data acquisition device through a trusted measurement mechanism includes: independently monitoring the hardware components of the photovoltaic data acquisition device through a third-party measurement module to generate hardware feature values, and calculating hash values ​​for the software components of the photovoltaic data acquisition device through the third-party measurement module when the photovoltaic data acquisition device starts up to obtain software measurement values; and writing the hardware feature values ​​and software measurement values ​​together into the device measurement log.

[0008] The beneficial effects of this preferred technical solution are as follows: Hardware characteristic values ​​are generated by independently monitoring the hardware components of the photovoltaic data acquisition device through a third-party measurement module. This monitoring process is unaffected by the operating status of the photovoltaic data acquisition device itself, ensuring that the hardware characteristic values ​​accurately reflect the actual state of the hardware components. When the photovoltaic data acquisition device starts up, the same third-party measurement module calculates the hash value of the software components to obtain software measurement values, accurately capturing the initial state characteristics at startup and avoiding the impact of potential state changes during software operation on the measurement results. Hardware characteristic values ​​and software measurement values ​​are jointly written into the device measurement log, ensuring that the device measurement log simultaneously covers the core measurement information of both hardware and software. This allows the integrity measurement of the photovoltaic data acquisition device to cover its key components, avoiding the biased integrity judgment caused by measuring only a single component. The entire process relies on the independent operation of the third-party module and the comprehensive integration of hardware and software measurement data, enabling the device measurement log to objectively and comprehensively present the integrity status of the photovoltaic data acquisition device.

[0009] As a preferred embodiment of the photovoltaic data security assurance method integrating trusted computing and blockchain described in this invention, the step of signing the data digest to form an encrypted data packet through a trusted platform module includes: generating an encryption key by the trusted platform module, encrypting the photovoltaic data using the encryption key in a trusted execution environment to generate ciphertext; performing a hash operation on the ciphertext to generate a data digest, signing the data digest using the private key of the trusted platform module to generate a signature value, and encapsulating the ciphertext, data digest, signature value, device measurement log, and device identity identifier corresponding to the photovoltaic acquisition device together to form an encrypted data packet.

[0010] The beneficial effects of this preferred technical solution are as follows: The trusted platform module generates an encryption key and encrypts photovoltaic data into ciphertext within a trusted execution environment, isolating the encryption process from external untrusted environments and avoiding the risk of leakage during key transmission and storage. This also prevents unauthorized tampering or theft of photovoltaic data during the encryption stage. A hash operation is performed on the ciphertext to generate a data digest, ensuring a unique correspondence between the data digest and the ciphertext. The private key of the trusted platform module is used to sign the data digest, generating a signature value that provides a verifiable basis for the authenticity and integrity of the data source. The ciphertext, data digest, signature value, device measurement logs, and the device identification of the photovoltaic data acquisition device are jointly encapsulated into an encrypted data packet. This encrypted data packet integrates the data itself with all the core information required for verification. The entire process, through the connection of key generation, encryption operation, signature verification, and multi-dimensional information encapsulation, ensures that the encrypted data packet not only guarantees the confidentiality of photovoltaic data but also possesses the characteristics of traceable source and verifiable status, achieving a secure closed loop in the data processing stage.

[0011] As a preferred embodiment of the photovoltaic data security assurance method integrating trusted computing and blockchain described in this invention, the step of writing the credential information into the blockchain after verification by a smart contract to obtain a proof receipt includes: using the data digest, signature value, and device measurement log in the encrypted data packet as credential information, and verifying the signature value using the device public key pre-stored in the blockchain to verify the authenticity of the credential information source; comparing the device measurement log in the credential information with the benchmark measurement value pre-stored in the blockchain to confirm that the photovoltaic data acquisition device is in a trusted state; when the authenticity of the source is verified and the photovoltaic data acquisition device is in a trusted state, writing the credential information into the blockchain through a smart contract to generate a proof receipt, and binding the proof receipt with the encrypted data packet and storing it in the storage area bound to the trusted platform module.

[0012] The beneficial effects of this preferred technical solution are as follows: The data digest, signature value, and device measurement log in the encrypted data packet are used as credential information. The signature value is verified using the device public key pre-stored on the blockchain, ensuring that the credential information originates from legitimate photovoltaic data acquisition equipment and preventing unauthorized entities from forging information. The device measurement log in the credential information is compared with the benchmark measurement value pre-stored on the blockchain to confirm that the operating status of the photovoltaic data acquisition equipment meets the trust standard, directly linking the validity of the credential information to the trust status of the equipment. Only when the authenticity of the source is verified and the equipment is in a trust state can the credential information be written to the blockchain through a smart contract to generate a storage receipt. The immutability of the blockchain is used to fix the credential information, and the storage receipt is bound to the encrypted data packet and stored in a storage area bound to the trusted platform module, thus associating the data with the corresponding verification credential. The entire process, through the connection of dual verification, on-chain storage, and bound storage, clearly confirms the authenticity of the credential information and the trustworthiness of the equipment status, while simultaneously achieving the corresponding retention of credential information and data.

[0013] As a preferred embodiment of the photovoltaic data security assurance method integrating trusted computing and blockchain described in this invention, the identity authentication is based on a three-role architecture, which includes a data sender as the requester, a control terminal as the relay, and a decision-making terminal as the decision-maker. The steps of authenticating the data sender and data receiver based on the evidence receipt and device measurement log include: the data sender sending an authentication request containing a device identity identifier, device measurement log, and data digest to the control terminal; the control terminal verifying the authentication request and verifying the evidence receipt of the data sender; after verification, the control terminal attaches the authentication request to the device measurement log of the control terminal and forwards it to the decision-making terminal; the decision-making terminal comparing the device measurement logs of the data sender and control terminal with the pre-stored benchmark measurement value in the blockchain, and comparing the data digest with the evidence receipt stored in the blockchain; when the comparison results of the decision-making terminal are consistent, an authentication pass instruction is issued to the data sender and control terminal, and an encrypted transmission channel is established between the data sender and data receiver.

[0014] The beneficial effects of this preferred technical solution are as follows: Identity authentication is conducted based on a three-role architecture comprising a data sender, a control unit, and a decision-maker. The data sender submits an authentication request to the control unit, including the device identity identifier, device measurement logs, and a data summary. The control unit first verifies the authentication request and checks the evidence receipt, filtering out invalid requests to avoid invalid transmission. After successful verification, the control unit attaches its own device measurement logs and forwards them to the decision-maker, enabling the decision-maker to simultaneously obtain the operating status information of both devices. The decision-maker compares the device measurement logs from the data sender and control unit with the benchmark measurement values ​​pre-stored on the blockchain, while simultaneously verifying the data summary and the evidence receipt stored on the blockchain to ensure the device identity is legitimate and the relevant information has not been tampered with. Only when all comparison results are consistent is the decision-maker issuing an authentication pass command. The data sender and data receiver then establish an encrypted transmission channel. The entire process, through the connection of multi-role layered verification and multi-dimensional information comparison, ensures that identity authentication covers the entire process from request initiation and intermediate verification to final decision-making, guaranteeing the authenticity and trustworthiness of the entities at both ends of the system.

[0015] As a preferred embodiment of the photovoltaic data security assurance method integrating trusted computing and blockchain described in this invention, the step of synchronizing the transmission behavior log and log digest to the blockchain includes: during data transmission, the control terminal records transmission details in real time and generates a transmission behavior log; the transmission behavior log is written into the private chain of the blockchain, and a hash value is calculated on the transmission behavior log stored in the private chain to generate a log digest; the log digest and abnormal information generated during transmission are periodically submitted to the consortium chain of the blockchain, and after the smart contract is verified, they are stored in the consortium chain to form a transmission certificate.

[0016] The beneficial effects of this preferred technical solution are as follows: During data transmission, the control terminal records transmission details in real time, generates transmission behavior logs, and writes them to the private chain, enabling centralized retention of all transmission information and preventing the transmission records from being scattered or lost. A hash value is calculated on the transmission behavior logs in the private chain to generate a log digest, ensuring a unique correspondence between the log digest and the original log, guaranteeing that the log content has not been tampered with. The log digests and transmission anomaly information are periodically submitted to the consortium blockchain, and after verification by the smart contract, they are stored to form transmission credentials. The characteristics of the consortium blockchain allow these core information to be verified by authorized parties and cannot be unilaterally modified. Synchronization of transmission anomaly information ensures accurate recording of anomalies. The entire process, through the cooperation of storing all logs on the private chain and storing core digests and anomaly information on the consortium blockchain, combined with hash calculations and smart contract verification, achieves a complete record of transmission behavior and reliable fixation of key information, making every detail of the transmission process verifiable.

[0017] As a preferred embodiment of the photovoltaic data security assurance method integrating trusted computing and blockchain described in this invention, the step of periodically generating integrity verification values ​​for the encrypted storage area and uploading them to the blockchain includes: partitioning the encrypted storage area according to the device type of the photovoltaic data acquisition equipment and the data acquisition date; encrypting each partition using an independent encryption key; periodically calculating integrity verification values ​​for each partition; summarizing the integrity verification values ​​and uploading them to the blockchain; when an inconsistency is detected between the integrity verification value and the integrity verification value already stored in the blockchain, generating an anomaly alarm and writing it to the blockchain; and restoring the tampered photovoltaic data from the backup data based on the integrity verification value already stored in the blockchain.

[0018] The beneficial effects of this preferred technical solution are as follows: Encrypted storage is managed in zones according to the type of photovoltaic data acquisition equipment and the data acquisition date. Each zone uses an independent encryption key, preventing a problem in a single encryption step from affecting the entire photovoltaic data set. Integrity check values ​​are periodically calculated for each zone and uploaded to the blockchain, providing a clear comparison benchmark for the stored data status. When an inconsistency is detected between the integrity check value and the one already stored in the blockchain, an anomaly alarm is generated and written to the blockchain, ensuring that the anomaly is clearly recorded. Simultaneously, the tampered photovoltaic data is restored from the backup data based on the integrity check value already stored in the blockchain, returning the photovoltaic data to its true state. The entire process, through the connection of zone encryption, integrity check value uploading to the blockchain, and anomaly recovery, achieves zone protection of stored data and reliable repair after anomalies, ensuring that the stored photovoltaic data is always verifiable and recoverable.

[0019] Secondly, the present invention provides a photovoltaic data security system that integrates trusted computing and blockchain, comprising: Acquisition and Encapsulation Module: Used to perform integrity measurement of photovoltaic acquisition equipment, and to complete the encryption of photovoltaic data and the signing of data digests within a trusted execution environment, forming encrypted data packets; On-chain evidence storage module: used to extract credential information from encrypted data packets, verify it through a smart contract, write it to the blockchain, and obtain evidence storage receipt; Identity authentication module: used to complete identity authentication and establish an encrypted transmission channel based on the evidence receipt and device measurement log, according to the three-element role architecture; Transmission monitoring module: used to transmit data in encrypted transmission channels, perform real-time integrity verification, and synchronize transmission behavior logs and log summaries to the blockchain; Secure storage module: Used to store received encrypted data packets into an encrypted storage area bound to the trusted platform module, and periodically generate integrity verification values ​​to upload to the blockchain.

[0020] Thirdly, the present invention provides an electronic device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, the steps of the photovoltaic data security assurance method integrating trusted computing and blockchain are implemented.

[0021] Fourthly, the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the steps of the photovoltaic data security assurance method integrating trusted computing and blockchain.

[0022] Compared with existing technologies, the beneficial effects of this invention are as follows: By integrating trusted computing and blockchain technologies, a security system for the entire lifecycle of photovoltaic data is constructed, forming a closed-loop protection from trusted device verification to data storage. For photovoltaic data acquisition equipment, a trusted measurement mechanism is used to extract hardware feature values ​​and software measurement values ​​of the hardware and software components, which are then compared and verified with pre-stored benchmark measurement values ​​on the blockchain. This ensures that only data streams from trusted photovoltaic data acquisition equipment can enter the photovoltaic system, avoiding security risks from untrusted photovoltaic data acquisition equipment. When processing photovoltaic data, encryption and digest generation are completed within a trusted execution environment, and then encrypted data packets are formed through signature by a trusted platform module. This not only prevents photovoltaic data from being tampered with or leaked during processing but also provides reliable proof of the authenticity of the photovoltaic data. The credential information is then verified by a smart contract and stored on the blockchain. The system employs a three-element role-based authentication architecture, enhancing the reliability of identity verification between data senders and receivers. An encrypted transmission channel ensures secure data transmission. Real-time integrity checks are performed during transmission, and transmission activity logs are simultaneously recorded and log summaries are uploaded to the blockchain for easy tracing of the source in case of anomalies. Encrypted data packets are ultimately written to an encrypted storage area bound to the trusted platform module, with integrity verification values ​​periodically generated and uploaded to the blockchain. This allows for timely detection of data tampering and enables data recovery via blockchain backup, comprehensively strengthening the security and reliability of photovoltaic data across all stages of collection, processing, transmission, and storage. Attached Figure Description

[0023] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a schematic diagram of the overall process of a photovoltaic data security assurance method that integrates trusted computing and blockchain, as described in one embodiment of the present invention. Detailed Implementation

[0025] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of the present invention.

[0026] Example 1, referring to Figure 1 As an embodiment of the present invention, a photovoltaic data security assurance method integrating trusted computing and blockchain is provided, including steps S100 to S500: S100. The integrity of the photovoltaic data acquisition equipment is measured through a trusted measurement mechanism to generate an equipment measurement log. The equipment measurement log is compared with the benchmark measurement value pre-stored in the blockchain to obtain the trusted verification result of the equipment.

[0027] S200. When the device trust verification result is passed, the photovoltaic data collected by the photovoltaic acquisition device is encrypted and a data digest is generated in the trusted execution environment. The data digest is signed by the trusted platform module to form an encrypted data packet.

[0028] S300: Extract credential information from encrypted data packets. After the credential information is verified by the smart contract, it is written to the blockchain to obtain a proof receipt. Based on the proof receipt and the device measurement log, the data sender and data receiver are authenticated. After the authentication is successful, an encrypted transmission channel is established.

[0029] S400 transmits encrypted data packets through an encrypted transmission channel, performs real-time integrity verification of the transmission process, and synchronizes the transmission behavior log and log summary to the blockchain.

[0030] S500 writes the received encrypted data packets into the encrypted storage area bound to the trusted platform module, periodically generates the integrity verification value of the encrypted storage area and uploads it to the blockchain.

[0031] It should be noted that photovoltaic (PV) data acquisition equipment is mostly deployed in open outdoor environments, making it vulnerable to security threats such as malicious tampering and illegal intrusion. Furthermore, PV data is also at risk of being stolen or altered throughout the entire process of acquisition, transmission, and storage. Traditional security measures lack reliable verification of the equipment's integrity, and the credibility of data encryption and storage is insufficient. At the same time, lax identity authentication and lack of integrity checks during transmission can easily lead to unreliable data, thereby affecting the reliable operation of PV system scheduling, metering, and other services. Therefore, ensuring reliable security for PV data throughout the entire process is crucial.

[0032] Therefore, to address the aforementioned issues of insufficient equipment trustworthiness, high data security risks, and unreliable transmission and storage, steps S100~S500 are used to verify the integrity of photovoltaic data acquisition equipment through a trusted measurement mechanism. Data is encrypted within a trusted execution environment and stored using blockchain evidence. An encrypted transmission channel is established through smart contracts and identity authentication. Logs are simultaneously transmitted to the blockchain and stored in encrypted form. This achieves trusted verification and security protection for photovoltaic equipment and data throughout the entire process, ensuring the integrity, confidentiality, and traceability of photovoltaic data, and providing security support for the reliable operation of the photovoltaic system.

[0033] Example 2, refer to Figure 1 As an embodiment of the present invention, based on the above embodiment, a photovoltaic data security assurance method integrating trusted computing and blockchain is provided.

[0034] In this embodiment of the application, step S100, which involves generating a device measurement log by performing integrity measurement on the photovoltaic data acquisition device using a trusted measurement mechanism, includes steps A1 to A2: A1. Independently monitor the hardware components of the photovoltaic data acquisition device through a third-party measurement module to generate hardware characteristic values, and calculate the hash value of the software components of the photovoltaic data acquisition device through the third-party measurement module when the photovoltaic data acquisition device starts up to obtain the software measurement value. In this embodiment, the third-party measurement module is implemented based on an FPGA dynamically reconfigurable circuit and runs independently of the main processor of the photovoltaic data acquisition device. First, the third-party measurement module periodically reads the configuration information and status data of hardware components such as the TPM / TCM chip, storage controller, and network interface of the photovoltaic data acquisition device through the hardware bus interface. Then, it uses the SM3 algorithm to perform hash operations on the read data to generate hardware feature values. The reading period is set to 10 to 60 seconds. When the photovoltaic data acquisition device starts up, the third-party measurement module triggers the DRTM measurement process, calculating the SM3 hash value for the BIOS firmware, operating system kernel, device driver, and data acquisition application in sequence. The measurement process follows a trust chain transmission mechanism. The hash value of each software component is accumulated and extended to the platform configuration register (PCR). The new platform configuration register (PCR) value is obtained by concatenating the old platform configuration register (PCR) value with the hash value of the current software component and performing another SM3 hash operation, ultimately forming a software measurement value that reflects the complete software loading chain.

[0035] For example, the TPM chip version of the photovoltaic data acquisition device is 2.0, the storage controller firmware version is v3.2, and the network interface MAC address is AA:BB:CC:DD:EE:FF. After reading these values, the third-party measurement module concatenates them and performs an SM3 hash operation to generate a hardware feature value of 0x1A2B3C4D. At startup, the SM3 hash value of the BIOS firmware is 0x5E6F7A8B, which is stored in PCR0. The hash value of the operating system bootloader is 0x9C0D1E2F. The PCR0 value 0x5E6F7A8B is concatenated with 0x9C0D1E2F and then subjected to an SM3 hash operation to obtain the PCR1 value 0x3A4B5C6D. This process continues until the final software measurement value of PCR7 is 0x7D8E9F0A, reflecting the complete software loading chain state.

[0036] A2. Write both hardware characteristic values ​​and software measurement values ​​into the device measurement log; In this embodiment, the third-party measurement module structures and encapsulates the hardware feature values ​​and software measurement values ​​generated in step A1 to form a device measurement log. The device measurement log includes a millisecond-level UTC timestamp, the device identity identifier of the photovoltaic data acquisition device, hardware feature values, software measurement values ​​of each slot in the platform configuration registers PCR0 to PCR7, and an SM2 signature value generated by the TPM private key. After encapsulation, the third-party measurement module writes the device measurement log to a local encrypted storage area bound to the TPM / TCM chip. This storage area is key protected by the Trusted Storage Root (RTS) and uses a storage key dynamically generated by the TPM to encrypt the log data. Access is only allowed to the third-party measurement module and authorized processes within the Trusted Execution Environment (TEE) to prevent the device measurement log from being illegally tampered with or deleted.

[0037] For example, the photovoltaic data acquisition device completed the startup measurement at 10:30:45.123 on January 15, 2025. The generated device measurement log is as follows: timestamp = 2025-01-15T10:30:45.123Z, device identifier = DEV20250115001, hardware feature value = 0x1A2B3C4D, software measurement value array = [0x5E6F7A8B, 0x3A4B5C6D, 0x2F3E4D5C, 0x6A7B8C9D, 0x4E5F6A7B, 0x8D9E0F1A, 0x1C2D3E4F, 0x7D8E9F0A], signature value = 0x9A8B7C6D5E4F. This log record is encrypted and written to the local TPM encrypted storage area, completing the generation and storage of the device measurement log.

[0038] In this embodiment of the application, the step S200, which involves signing the data digest using the trusted platform module to form an encrypted data packet, includes steps B1 to B2: B1. The trusted platform module generates an encryption key, and the encryption key is used to encrypt the photovoltaic data within the trusted execution environment to generate ciphertext data; In this embodiment, a trusted timer deployed within the Trusted Execution Environment (TEE) triggers photovoltaic data acquisition operations according to a preset cycle. The raw signals acquired by the sensors are converted by an analog-to-digital converter (ADC) and then directly transmitted to the TEE via a hardware bus. The TEE then calls the key generation function of the trusted platform module, which generates an SM4 symmetric encryption key based on a true random number generator. The encryption key uses a batch update mechanism, updating once after each batch of photovoltaic data is acquired. The encryption key only exists briefly in the isolated memory of the TEE and is immediately destroyed after use without being stored on the ground. Finally, the TEE uses the generated encryption key to perform the SM4 encryption algorithm on the photovoltaic data to generate ciphertext.

[0039] For example, the sensor collects photovoltaic voltage of 600 volts, photovoltaic current of 10 amps, and photovoltaic power of 6 kilowatts. After being transmitted to the Trusted Execution Environment (TEE), the Trusted Platform Module generates a 128-bit SM4 encryption key 0x2C3D4E5F6A7B8C9D0E1F2A3B4C5D6E7F. This encryption key is then used to perform SM4 encryption on the photovoltaic data to generate the ciphertext 0xA1B2C3D4E5F6A7B8C9D0E1F2A3B4C5D6.

[0040] B2. Perform a hash operation on the encrypted data to generate a data digest. Use the private key of the trusted platform module to sign the data digest to generate a signature value. Then, encapsulate the encrypted data, data digest, signature value, device measurement log, and device identity identifier corresponding to the photovoltaic data acquisition device to form an encrypted data packet. In this embodiment, the Trusted Execution Environment (TEE) performs the SM3 hash algorithm on the ciphertext generated in step B1 to generate a 256-bit data digest. Then, it calls the signature function of the Trusted Platform Module and uses the TPM private key to perform an SM2 digital signature on the data digest to generate a signature value. The signing process is completed in the hardware isolation environment of the Trusted Platform Module. After the signature is completed, the TEE encapsulates the ciphertext, data digest, signature value, and device measurement log and photovoltaic data acquisition device identification from step A2 according to a predefined structure to form an encrypted data packet, which is temporarily stored in the local trusted storage area bound to the Trusted Platform Module.

[0041] For example, the SM3 hash is performed on the ciphertext 0xA1B2C3D4E5F6A7B8C9D0E1F2A3B4C5D6 to obtain the data digest 0x3F4E5D6C7B8A9D0E1F2A3B4C5D6E7F8A. Then, the trusted platform module uses the TPM private key to perform SM2 digital signature and generate a signature value 0x8B9A0C1D2E3F4A5B6C7D8E9F0A1B2C3D. During encapsulation, the device metric log and device identity DEV20250115001 from step A2 are extracted to form an encrypted data packet and written to the local trusted storage area.

[0042] In an optional implementation, the step S200, in which the trusted platform module signs the data digest to form an encrypted data packet, can also adopt a batch processing mode. After the trusted execution environment (TEE) has accumulated multiple batches of photovoltaic data, the trusted platform module generates a unique encryption key for the entire batch. SM4 encryption is performed on each batch of photovoltaic data to generate multiple ciphertexts. Then, SM3 hashing is performed on each ciphertext to generate multiple data digests. The multiple data digests are then subjected to hierarchical hashing according to a Merkle tree structure to obtain the root hash value as the batch data digest. The TPM private key of the trusted platform module is used to perform SM2 signing on the batch data digest to generate a signature value. Finally, the multiple ciphertexts, their respective data digests, the batch data digest, the signature value, the device measurement log, and the device identity identifier corresponding to the photovoltaic acquisition device are jointly encapsulated to form a batch encrypted data packet. This scheme can reduce the number of signing operations and lower the frequency of on-chain evidence storage, making it suitable for data processing optimization needs in high-frequency acquisition scenarios.

[0043] In this application embodiment, step S300, where the credential information is written to the blockchain after verification by the smart contract to obtain a proof of evidence receipt, includes steps C1 to C3: C1. Use the data digest, signature value, and device measurement log in the encrypted data packet as credential information, and verify the authenticity of the credential information source by verifying the signature value through the device public key pre-stored in the blockchain. In this embodiment, the photovoltaic data acquisition device extracts the data digest, signature value, and device measurement log from the encrypted data packet generated in step B2 through a built-in lightweight blockchain node, and removes the encrypted data to reduce on-chain storage pressure. The extracted information is then submitted to the blockchain as credential information. After receiving the credential information, the blockchain verification node retrieves the device public key pre-stored during the initialization phase of the photovoltaic data acquisition device from the blockchain based on the device identity identifier carried in the credential information. Then, the verification node uses the retrieved device public key to decrypt the signature value using the SM2 signature verification algorithm and compares the decryption result with the data digest in the credential information. If the two match, it proves that the signature value was indeed generated by the TPM private key of the photovoltaic data acquisition device, and the credential information is authentic, reliable, and has not been tampered with.

[0044] For example, credential information is extracted from the encrypted data packet in step B2, including the device identity DEV20250115001, data digest 0x3F4E5D6C7B8A9D0E1F2A3B4C5D6E7F8A, signature value 0x8B9A0C1D2E3F4A5B6C7D8E9F0A1B2C3D, and device metric log digest 0x1A2B3C4D & 0x7D8E9F0 A; Then, the blockchain verification node retrieves the pre-stored device public key 0x4D5E6F7A8B9C0D1E2F3A4B5C6D7E8F9A based on the device identity identifier DEV20250115001, uses the public key to perform SM2 verification on the signature value, and decrypts it to obtain 0x3F4E5D6C7B8A9D0E1F2A3B4C5D6E7F8A, which is consistent with the data digest in the credential information, and the verification is successful.

[0045] C2. Compare the device measurement log in the voucher information with the benchmark measurement value pre-stored in the blockchain to confirm that the photovoltaic data acquisition device is in a trusted state. In this embodiment, after completing the source authenticity verification in step C1, the blockchain verification node extracts the software metric value from the device metric log in the credential information. This software metric value corresponds to the final accumulated value of the platform configuration register PCR7 in step A1. The verification node retrieves a pre-stored baseline metric value from the blockchain. The baseline metric value is the standard software metric value of the photovoltaic data acquisition device in a trusted state, generated and uploaded to the blockchain by the system administrator during device initialization through a trusted startup process. The verification node compares the software metric value in the credential information with the baseline metric value bit by bit. If they are completely consistent, it confirms that the software loading chain of the photovoltaic data acquisition device at the time of data acquisition has not been tampered with and is in a trusted state; if they are inconsistent, it is determined that the device may have been attacked or is abnormal, and the credential information is rejected from being uploaded to the blockchain.

[0046] For example, the device measurement log is extracted from the credential information verified in step C1, where the software measurement value is 0x7D8E9F0A. Then, the blockchain verification node retrieves the baseline measurement value corresponding to the device identity identifier DEV20250115001, which is 0x7D8E9F0A. The two are compared bit by bit and are completely consistent, confirming that the photovoltaic data acquisition device is in a trustworthy state, and can proceed to the next step of the evidence storage process.

[0047] C3. When the authenticity of the source is verified and the photovoltaic data acquisition device is in a trusted state, the certificate information is written into the blockchain through a smart contract to generate a proof receipt, and the proof receipt is bound to the encrypted data packet and stored in the storage area bound to the trusted platform module. In this embodiment, after the blockchain verification node passes both verifications in steps C1 and C2, it triggers the blockchain's smart contract to execute the notarization logic. The smart contract packages the credential information according to a standard data format, including the device identity identifier, data digest, signature value, device measurement log digest, and verification timestamp. The packaged credential information is then written into a newly generated block using the blockchain's consensus mechanism. After the block is successfully written, the blockchain generates a notarization receipt, which contains two key pieces of information: block height and transaction hash, serving as immutable proof that the credential information has been successfully uploaded to the blockchain. Upon receiving the notarization receipt, the lightweight blockchain node of the photovoltaic data acquisition device associates and binds the notarization receipt with the encrypted data packet temporarily stored in step B2, and writes them together into the storage area bound to the trusted platform module, forming a two-way mapping relationship between local data and on-chain credentials.

[0048] For example, after confirming that the photovoltaic data acquisition device is in a trusted state in step C2, the smart contract begins to package the credential information: Device Identity = DEV20250115001, Data Digest = 0x3F4E5D6C7B8A9D0E1F2A3B4C5D6E7F8A, Signature Value = 0x8B9A0C1D2E3F4A5B6C7D8E9F0A1B2C3D, Device Metric Log Digest = 0x7D8E9F0A, Verification Timestamp = 2025-01-15T10:31:00.456Z. Then, the credential information is written to a new block with a block height of 15678 through the blockchain consensus mechanism, generating a proof receipt containing block height = 15678 and transaction hash = 0xDEF123456789ABC; after the photovoltaic data acquisition device receives the proof receipt, it binds the proof receipt with the encrypted data packet and stores it in the storage area bound to the trusted platform module.

[0049] In one optional implementation, step S300, where the credential information is written to the blockchain after verification by the smart contract to obtain a certificate of authenticity, can also adopt a time-window batch certificate of authenticity mode. First, a fixed time window is set on the blockchain verification node. Then, within the window period, credential information submitted by multiple photovoltaic data acquisition devices is accumulated and received. The verification node performs device public key verification and device metric log comparison on each credential information in sequence. After sorting the multiple verified credential information according to the device identity, a Merkle tree is constructed. The root hash value of the Merkle tree is calculated as the batch credential digest. The smart contract writes the batch credential digest and the list of device identity to the blockchain to generate a batch certificate of authenticity. The batch certificate of authenticity includes the block height, transaction hash, and path information of each device in the Merkle tree. Each photovoltaic data acquisition device can independently verify whether its own credential has been uploaded to the chain based on the path information. This scheme can reduce the blockchain storage overhead and improve the certificate of authenticity throughput, and is suitable for application scenarios where multiple devices in a large-scale photovoltaic power plant are uploaded to the chain concurrently.

[0050] It's important to know that identity authentication is based on a three-role architecture, which includes a data sender as the requester, a control unit as the intermediary, and a decision-maker.

[0051] In this embodiment of the application, step S300, which involves authenticating the data sender and data receiver based on the evidence receipt and device measurement log, includes steps D1 to D3: D1. The data sender sends an authentication request containing the device identification, device measurement log and data summary to the control end. The control end verifies the authentication request and checks the data sender's evidence receipt. After verification, the control end attaches the authentication request to the control end's device measurement log and forwards it to the decision end. After completing the on-chain notarization in step C3, the data sender initiates a transmission authentication request to the control terminal. In this embodiment, the authentication request includes the data sender's device identity identifier, the device measurement log generated in step A2, and the data digest generated in step B2. Upon receiving the authentication request, the control terminal first verifies the signature in the authentication request using the data sender's device public key to confirm the authenticity of the request source. Subsequently, the control terminal queries the data sender's notarization receipt through the blockchain node and verifies the data digest in the authentication request with the notarization receipt returned by the blockchain in step C3 to verify that the data collected by the data sender has completed on-chain notarization. After both verification and validation are successful, the control terminal attaches its own device measurement log to the authentication request and forwards it to the decision terminal.

[0052] For example, the data sender DEV20250115001 sends an authentication request, including the device identity DEV20250115001, the device metric log digest 0x7D8E9F0A, and the data digest 0x3F4E5D6C7B8A9D0E1F2A3B4C5D6E7F8A. The control end verifies the signature, first querying the blockchain and finding that the data digest corresponding to the transaction hash 0xDEF123456789ABC matches the request, thus verifying the request. Then, the control end appends its own device metric log digest 0x8E9F0A1B and forwards it to the decision-making end.

[0053] D2. The decision-making end compares the device measurement logs of the data sending end and the control end with the benchmark measurement values ​​pre-stored in the blockchain, and compares the data summary with the evidence storage receipts stored in the blockchain. In this embodiment, after receiving the authentication request forwarded in step D1, the decision-making end first extracts the device measurement logs of the data sending end and the control end, and compares them with the benchmark measurement values ​​pre-stored in the blockchain to verify that both devices are in a trustworthy state at the time of transmission. At the same time, the decision-making end retrieves the evidence storage receipt generated in step C3 from the blockchain, extracts the data digest recorded in the evidence storage receipt, and compares it with the data digest carried in the authentication request to confirm that the transmitted data is consistent with the data stored on the blockchain during the collection stage, thus preventing the data from being replaced or tampered with.

[0054] For example, the decision-making end extracts the measurement log digest 0x7D8E9F0A from the data sending device and compares it with the benchmark measurement value in the blockchain. The measurement log digest 0x8E9F0A1B from the control end device also matches the benchmark value, confirming that both devices are trustworthy. Then, the decision-making end retrieves the evidence receipt corresponding to the transaction hash 0xDEF123456789ABC from the blockchain and extracts the data digest 0x3F4E5D6C7B8A9D0E1F2A3B4C5D6E7F8A, which matches the data digest in the authentication request.

[0055] D3. When the comparison results at the decision end are consistent, an authentication pass instruction is issued to the data sending end and the control end, and an encrypted transmission channel is established between the data sending end and the data receiving end. In this embodiment, after the decision-making end completes the dual comparison in step D2, if the comparison results are consistent, the decision-making end sends authentication pass instructions to both the data sender and the control end via SM2 encryption. Upon receiving the instructions, the data sender and the data receiver generate SM4 session keys within their respective Trusted Execution Environments (TEEs) and securely negotiate the session keys using the SM2 key exchange protocol. Both parties sign the session key using their TPM private keys and verify each other's signatures. After confirming the authenticity and integrity of the key negotiation process, a transmission channel based on SM4 session key encryption is established for the secure transmission of subsequent encrypted data packets.

[0056] For example, the decision-making end sends authentication approval instructions to the data sending end and the control end. Then, the data sending end generates an SM4 session key 0x5F6A7B8C9D0E1F2A in the Trusted Execution Environment (TEE), and the data receiving end generates an SM4 session key 0x5F6A7B8C9D0E1F2A. Key negotiation is completed through the SM2 key exchange protocol, and the two parties establish an encrypted transmission channel after verifying each other's signatures.

[0057] In this embodiment of the application, step S400, which synchronizes the transmission behavior log and log digest to the blockchain, includes steps E1 to E2: E1. During data transmission, the control terminal records transmission details in real time and generates a transmission behavior log. The transmission behavior log is written into the private chain of the blockchain, and the hash value of the transmission behavior log stored in the private chain is calculated to generate a log summary. In this embodiment, when the control terminal forwards encrypted data packets in the encrypted transmission channel established in step D3, it records transmission details in real time to generate a transmission behavior log. The transmission behavior log includes the device identity of the data sender, the device identity of the data receiver, the transmission timestamp, the data packet sequence number, the data digest, the transmission status, and the TPM signature of the control terminal. Simultaneously, the control terminal writes the transmission behavior log to the private blockchain in real time through a full blockchain node. The private blockchain uses a practical Byzantine fault-tolerant algorithm as its consensus mechanism to ensure rapid consensus and consistent storage of the transmission log, meeting the requirements for real-time transmission of photovoltaic data. The control terminal periodically executes the SM3 hash algorithm on the transmission behavior log stored in the private blockchain to generate a log digest for subsequent synchronization with the consortium blockchain.

[0058] For example, the control terminal records the transmission details: data sender DEV20250115001, data receiver RCV20250115002, transmission time 2025-01-15T10:32:00.123Z, data packet sequence number 00001, data digest 0x3F4E5D6C7B8A9D0E1F2A3B4C5D6E7F8A, and transmission status successful. This log is written to the private blockchain using a practical Byzantine fault-tolerant algorithm. The control terminal calculates the SM3 hash every 10 data packets, generating a log digest of 0x6B7C8D9E0F1A2B3C.

[0059] E2. Periodically submit log summaries and abnormal information generated during transmission to the consortium blockchain. After the smart contract verifies them, they are stored in the consortium blockchain to form a transmission certificate. The control terminal submits the log digest generated in step E1 and the abnormal information generated during transmission to the consortium blockchain according to a preset synchronization cycle. In this embodiment, the synchronization cycle is set to once a day to ensure the timeliness and integrity of the transmission credentials stored in the consortium blockchain. The abnormal information includes records of abnormal events such as transmission interruption, data packet loss, and hash value mismatch. After receiving the log digest and abnormal information, the smart contract of the consortium blockchain first verifies the integrity of the TPM signature and log digest of the control terminal. After successful verification, it writes the log digest and abnormal information into a new block of the consortium blockchain, forming an immutable transmission credential.

[0060] For example, at 24:00 on January 15, 2025, the control terminal submits the log digest 0x6B7C8D9E0F1A2B3C and the exception information (data packet 00105 transmission failure) generated on that day to the consortium blockchain. After the smart contract verifies that the control terminal's TPM signature is passed, it writes the log digest and exception information into the consortium blockchain block height 16789 and generates a transmission certificate containing block height 16789 and transaction hash 0xFED987654321CBA.

[0061] In one optional implementation, the synchronization of transmission behavior logs and log summaries to the blockchain in step S400 can also employ an anomaly-triggered hierarchical synchronization mechanism. First, the control terminal monitors the transmission status in real time during data transmission. When anomalies such as mismatched data packet hash values, transmission timeouts, or continuous packet loss are detected, the transmission behavior log containing anomaly details is immediately written to the private chain of the blockchain, and an emergency reporting process to the consortium blockchain is triggered simultaneously. After receiving the anomaly logs, the smart contract prioritizes processing them and writes them to the consortium blockchain to generate anomaly alarm credentials. For normally transmitted data packets, the control terminal performs batch aggregation according to a preset data packet quantity threshold or time threshold. The aggregated transmission behavior logs are calculated using SM3 hashes to generate log summaries, which are then written to the private chain. The log summaries of normally transmitted data packets in the private chain are periodically synchronized to the consortium blockchain at a fixed cycle to form regular transmission credentials. This scheme achieves rapid response to anomalies and efficient evidence storage for normal transmission, making it suitable for real-time monitoring scenarios of photovoltaic data with high transmission security requirements.

[0062] In this embodiment of the application, the step S500, which involves periodically generating an integrity verification value for the encrypted storage area and uploading it to the blockchain, includes F1~F2: F1. The encrypted storage area is partitioned according to the equipment type of the photovoltaic data acquisition equipment and the date of data acquisition. Each partition is encrypted with an independent encryption key, and the integrity check value of each partition is calculated periodically. The integrity check values ​​are then aggregated and uploaded to the blockchain. After receiving the encrypted data packet transmitted in step D3 through the encrypted transmission channel, the data receiving end manages the encrypted storage area by partitioning it according to the device type of the photovoltaic data acquisition equipment and the data acquisition date. In this embodiment, the partition naming rule is "device type_date", and different partitions are physically isolated. The data receiving end calls the trusted platform module to generate an independent SM4 encryption key for each partition, and uses the dedicated encryption key to encrypt and store the photovoltaic data within the partition. The encryption key is protected by the trusted storage root RTS and can only be accessed within the trusted execution environment (TEE). The data receiving end periodically performs the SM3 hash algorithm to calculate the integrity check value for each partition, summarizes the integrity check values ​​of each partition according to the partition identifier, and uploads them to the consortium blockchain through the blockchain node. After verification by the consortium blockchain smart contract, the data is written into a new block to form a storage certificate.

[0063] For example, photovoltaic data collected by inverter-type device DEV20250115001 on January 15, 2025, is stored in partition Inverter_20250115, and data collected by sensor-type device DEV20250115003 on the same day is stored in partition Sensor_20250115. Every day at midnight, an SM3 hash is calculated for each partition, resulting in the integrity check value 0x7A8B9C0D for Inverter_20250115 and the integrity check value 0x1E2F3A4B for Sensor_20250115. These are then aggregated and uploaded to the consortium blockchain, written to block height 17890.

[0064] F2. When an integrity check value is detected to be inconsistent with the integrity check value already stored in the blockchain, an abnormal alarm is generated and written to the blockchain. The tampered photovoltaic data is then restored from the backup data based on the integrity check value already stored in the blockchain. When performing the periodic verification in step F1, the data receiver compares the currently calculated integrity verification values ​​of each partition with the integrity verification values ​​already stored in the consortium blockchain. If the integrity verification value of a partition is found to be inconsistent with the consortium blockchain record, it is determined that the photovoltaic data of that partition may have been tampered with. The data receiver immediately generates an anomaly alarm. In this embodiment, the anomaly alarm includes the partition identifier, the current integrity verification value, the integrity verification value stored in the consortium blockchain, and the detection timestamp, which is written to the consortium blockchain after being signed by TPM. Subsequently, the data receiver retrieves the historical integrity verification value corresponding to the partition from the consortium blockchain, locates the correct version in the backup data based on the verification value, performs a data recovery operation in the Trusted Execution Environment (TEE), decrypts the backup data and overwrites the tampered partition data, and recalculates the integrity verification value after recovery and verifies that it is consistent with the consortium blockchain record.

[0065] For example, at dawn on January 16, 2025, the integrity check value of partition Inverter_20250115 was detected as 0x8C9D0E1F, which is inconsistent with 0x7A8B9C0D recorded at block height 17890 of the consortium blockchain. At this time, the data receiving end generated an anomaly alarm and wrote it to block height 18001 of the consortium blockchain. Subsequently, the correct integrity check value of 0x7A8B9C0D was retrieved from the consortium blockchain, the backup data was located, and partition Inverter_20250115 was restored in the Trusted Execution Environment (TEE). After restoration, the integrity check value was recalculated as 0x7A8B9C0D, which is consistent with the consortium blockchain record, and the data recovery was completed.

[0066] In one optional implementation, the step S500 of periodically generating integrity verification values ​​for the encrypted storage area and uploading them to the blockchain can also employ a layered verification mechanism combining incremental and full verification. Each time the data receiver writes new photovoltaic data to the encrypted storage area, it first performs an SM3 hash calculation on the newly written data block within the Trusted Execution Environment (TEE) to generate an incremental verification value. Then, it concatenates the incremental verification value with the previous integrity verification value of the partition and performs another SM3 hash operation to obtain the updated partition integrity verification value, which is then uploaded to the private chain of the blockchain in real time. The private chain records the dynamic change history of the integrity verification values ​​of each partition. The data receiver periodically performs a full SM3 hash calculation on each partition to generate a full integrity verification value. This full integrity verification value is then compared and verified with the latest incremental update value recorded in the private chain. Once verified, the full integrity verification value is uploaded to the consortium blockchain to form an authoritative storage certificate. This scheme provides dual protection through real-time monitoring and periodic verification, making it suitable for application scenarios where photovoltaic data is frequently written and storage integrity requirements are extremely high.

[0067] In summary, by integrating trusted computing and blockchain technologies, a comprehensive security system for photovoltaic (PV) data throughout its entire lifecycle is constructed, forming a closed-loop protection from device verification to data storage. For PV acquisition equipment, a trusted measurement mechanism is used to extract hardware characteristic values ​​and software measurement values ​​of the hardware and software components, which are then compared and verified against pre-stored benchmark measurement values ​​on the blockchain. This ensures that only data streams from trusted PV acquisition equipment can enter the PV system, avoiding security risks from untrusted PV acquisition equipment. When processing PV data, encryption and digest generation are performed within a trusted execution environment, and then encrypted data packets are formed through signature by a trusted platform module. This prevents tampering or leakage of PV data during processing and provides reliable proof of the data's authenticity. The credential information is verified by a smart contract and then stored on the blockchain. The system employs a three-element role-based authentication architecture, enhancing the reliability of identity verification between data senders and receivers. An encrypted transmission channel ensures secure data transmission. Real-time integrity checks are performed during transmission, and transmission activity logs are simultaneously recorded and log summaries are uploaded to the blockchain for easy tracing of the source in case of anomalies. Encrypted data packets are ultimately written to an encrypted storage area bound to the trusted platform module, with integrity verification values ​​periodically generated and uploaded to the blockchain. This allows for timely detection of data tampering and enables data recovery via blockchain backup, comprehensively strengthening the security and reliability of photovoltaic data across all stages of collection, processing, transmission, and storage.

[0068] Example 3 illustrates a method for ensuring photovoltaic data security by integrating trusted computing and blockchain. It should be noted that the technical solution of this photovoltaic data security system integrating trusted computing and blockchain belongs to the same concept as the aforementioned photovoltaic data security method integrating trusted computing and blockchain. Details not described in detail in this example can be found in the description of the aforementioned photovoltaic data security method integrating trusted computing and blockchain.

[0069] This embodiment also provides a photovoltaic data security system that integrates trusted computing and blockchain, including: Acquisition and Encapsulation Module: Used to perform integrity measurement of photovoltaic acquisition equipment, and to complete the encryption of photovoltaic data and the signing of data digests within a trusted execution environment, forming encrypted data packets; On-chain evidence storage module: used to extract credential information from encrypted data packets, verify it through a smart contract, write it to the blockchain, and obtain evidence storage receipt; Identity authentication module: used to complete identity authentication and establish an encrypted transmission channel based on the evidence storage receipt and device measurement log, according to the three-element role architecture; Transmission monitoring module: used to transmit data in encrypted transmission channels, perform real-time integrity verification, and synchronize transmission behavior logs and log summaries to the blockchain; Secure storage module: Used to store received encrypted data packets into an encrypted storage area bound to the trusted platform module, and periodically generate integrity verification values ​​to upload to the blockchain.

[0070] This embodiment also provides an electronic device suitable for photovoltaic data security protection that integrates trusted computing and blockchain, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to realize the photovoltaic data security protection method that integrates trusted computing and blockchain as proposed in the above embodiment.

[0071] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, it implements the photovoltaic data security assurance method that integrates trusted computing and blockchain as proposed in the above embodiments.

[0072] The storage medium proposed in this embodiment and the photovoltaic data security protection method integrating trusted computing and blockchain proposed in the above embodiments belong to the same inventive concept. Technical details not described in detail in this embodiment can be found in the above embodiments, and this embodiment has the same beneficial effects as the above embodiments.

[0073] Based on the above description of the implementation methods, those skilled in the art can clearly understand that the present invention can be implemented using software and necessary general-purpose hardware, and of course, it can also be implemented using hardware. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as a computer floppy disk, read-only memory (ROM), random access memory (RAM), flash memory, hard disk, or optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0074] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for ensuring photovoltaic data security that integrates trusted computing and blockchain, characterized in that, include: The integrity of the photovoltaic data acquisition equipment is measured by a trusted measurement mechanism to generate an equipment measurement log. The equipment measurement log is then compared with the benchmark measurement value pre-stored in the blockchain to obtain the equipment trusted verification result. When the device's trusted verification result is passed, the photovoltaic data collected by the photovoltaic acquisition device is encrypted and a data digest is generated within the trusted execution environment. The trusted platform module then signs the data digest to form an encrypted data packet. The credential information is extracted from the encrypted data packet. After the credential information is verified by the smart contract, it is written into the blockchain to obtain a proof of storage receipt. The data sender and data receiver are authenticated according to the proof of storage receipt and the device measurement log. After the authentication is successful, an encrypted transmission channel is established. The encrypted data packets are transmitted through the encrypted transmission channel, and the integrity of the transmission process is verified in real time. The transmission behavior log and log summary are synchronized to the blockchain. The received encrypted data packets are written to the encrypted storage area bound to the trusted platform module, and the integrity verification value of the encrypted storage area is generated periodically and uploaded to the blockchain.

2. The photovoltaic data security assurance method integrating trusted computing and blockchain as described in claim 1, characterized in that, The steps for generating device measurement logs by performing integrity measurement on photovoltaic data acquisition equipment using a trusted measurement mechanism include: The hardware components of the photovoltaic data acquisition device are independently monitored by a third-party measurement module to generate hardware characteristic values. When the photovoltaic data acquisition device is started, the software components of the photovoltaic data acquisition device are calculated using the third-party measurement module to obtain software measurement values. The hardware feature values ​​and software metric values ​​are written together into the device metric log.

3. The photovoltaic data security assurance method integrating trusted computing and blockchain as described in claim 2, characterized in that, The steps of signing the data digest using a trusted platform module to form an encrypted data packet include: The trusted platform module generates an encryption key, and the encryption key is used to encrypt photovoltaic data within a trusted execution environment to generate ciphertext data. A hash operation is performed on the encrypted data to generate a data digest. The private key of the trusted platform module is used to sign the data digest to generate a signature value. The encrypted data, the data digest, the signature value, the device measurement log, and the device identity identifier corresponding to the photovoltaic data acquisition device are then encapsulated together to form an encrypted data packet.

4. The photovoltaic data security assurance method integrating trusted computing and blockchain as described in claim 3, characterized in that, The steps for obtaining a proof of evidence receipt after the credential information is verified by a smart contract and written into the blockchain include: The data digest, signature value, and device measurement log in the encrypted data packet are used as credentials, and the signature value is verified by the device public key pre-stored in the blockchain to verify the authenticity of the credential information. The device measurement log in the certificate information is compared with the benchmark measurement value pre-stored in the blockchain to confirm that the photovoltaic data acquisition device is in a trusted state. When the authenticity of the source is verified and the photovoltaic data acquisition device is in a trusted state, the certificate information is written into the blockchain through a smart contract to generate a proof receipt, and the proof receipt is bound to the encrypted data packet and stored in the storage area bound to the trusted platform module.

5. The photovoltaic data security assurance method integrating trusted computing and blockchain as described in claim 4, characterized in that, The identity authentication is based on a three-element role architecture, which includes a data sender as the requester, a control unit as the relayer, and a decision-maker as the decision-maker. The steps for authenticating the data sender and data receiver based on the evidence receipt and device measurement log include: The data sending end sends an authentication request containing device identification, device measurement log and data summary to the control end. The control end verifies the authentication request and checks the evidence receipt of the data sending end. After verification and confirmation, the authentication request is appended to the device measurement log of the control end and forwarded to the decision end. The decision-making end compares the device measurement logs of the data sending end and the control end with the benchmark measurement values ​​pre-stored in the blockchain, and compares the data digest with the evidence storage receipts stored in the blockchain; When the comparison results of the decision-making end are consistent, an authentication pass instruction is issued to the data sending end and the control end, and the data sending end and the data receiving end establish an encrypted transmission channel.

6. The photovoltaic data security assurance method integrating trusted computing and blockchain as described in claim 5, characterized in that, The steps to synchronize transmission behavior logs and log summaries to the blockchain include: During data transmission, the control terminal records transmission details in real time and generates a transmission behavior log, writes the transmission behavior log into the private chain of the blockchain, and calculates the hash value of the transmission behavior log stored in the private chain to generate a log digest. The log summaries and abnormal information generated during transmission are periodically submitted to the consortium blockchain. After the smart contract verifies them, they are stored in the consortium blockchain to form a transmission certificate.

7. The photovoltaic data security assurance method integrating trusted computing and blockchain as described in claim 6, characterized in that, The steps of periodically generating integrity verification values ​​for the encrypted storage area and uploading them to the blockchain include: The encrypted storage area is partitioned according to the type of photovoltaic data acquisition equipment and the date of data acquisition. Each partition is encrypted with an independent encryption key, and the integrity check value of each partition is calculated periodically. The integrity check values ​​are then aggregated and uploaded to the blockchain. When the integrity verification value is detected to be inconsistent with the integrity verification value already stored in the blockchain, an abnormal alarm is generated and written to the blockchain, and the tampered photovoltaic data is restored from the backup data according to the integrity verification value already stored in the blockchain.

8. A photovoltaic data security system integrating trusted computing and blockchain, employing the method described in any one of claims 1-7, characterized in that, include: Acquisition and Encapsulation Module: Used to perform integrity measurement of photovoltaic acquisition equipment, and to complete the encryption of photovoltaic data and the signing of data digests within a trusted execution environment, forming encrypted data packets; On-chain evidence storage module: used to extract credential information from encrypted data packets, verify it through a smart contract, write it to the blockchain, and obtain evidence storage receipt; Identity authentication module: used to complete identity authentication and establish an encrypted transmission channel based on the evidence receipt and device measurement log, according to the three-element role architecture; Transmission monitoring module: used to transmit data in encrypted transmission channels, perform real-time integrity verification, and synchronize transmission behavior logs and log summaries to the blockchain; Secure storage module: Used to store received encrypted data packets into an encrypted storage area bound to the trusted platform module, and periodically generate integrity verification values ​​to upload to the blockchain.

9. An electronic device, comprising: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the computer-executable instructions are executed by the processor, they implement the steps of the photovoltaic data security assurance method integrating trusted computing and blockchain as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing computer-executable instructions that, when executed by a processor, implement the steps of the photovoltaic data security assurance method integrating trusted computing and blockchain as described in any one of claims 1 to 7.

Images