Power multi-source measurement data cross-platform trusted transmission method and device

Abstract

The application discloses a kind of electric power multi-source measurement data cross-platform trusted transmission method and device.The method realizes unified identity authentication and trust transmission by constructing cross-platform certificate chain system, vehicle networking platform server uses SM2 algorithm to sign and encrypt measurement data, and electric power load management system decrypts by private key and verifies signature legality to ensure data integrity and credibility.System generates and distributes session key using digital envelope mechanism, and realizes efficient encryption communication based on AES algorithm.At the same time, by monitoring network state and computing resource occupancy rate in real time, dynamically adjust certificate chain verification level and encryption algorithm parameters according to security level index, realize high security and high transmission efficiency of cross-platform measurement data.

Description

Technical Field

[0001] This invention relates to the field of power information security and cross-platform data transmission technology, specifically to a method and apparatus for cross-platform trusted transmission of multi-source power measurement data between a vehicle network platform and a power load management system, and particularly to a data encryption and trusted communication method that combines certificate chain authentication mechanism, digital envelope technology and dynamic security strategy. Background Technology

[0002] With the increasing integration of electric vehicles and power distribution networks, cross-platform and cross-network transmission of multi-source measurement data has become quite common. Current practices typically employ a PKI / CA-based identity system, establishing encrypted channels via TLS / SSL or VPN, with the source end digitally signing and symmetrically encrypting the data to ensure confidentiality and integrity.

[0003] In scenarios where operator platforms and power management platforms are interconnected, the common process is that each platform builds root / intermediate certificates, and terminal credentials are issued by their respective platforms. During the data transmission phase, session keys are often used in conjunction with symmetric algorithms for protection, and public key mechanisms are used for key negotiation or to encapsulate keys in digital envelopes.

[0004] In engineering implementation, certificate lifecycles and verification processes are mostly fixed configurations. Cross-domain trust boundaries and multi-agency collaboration increase the complexity of certificate management. Key distribution often relies on periodic updates or manual distribution. When the number of nodes is large and there are significant differences in bandwidth and computing power, public key computation and full-chain verification may incur additional overhead, affecting latency and throughput.

[0005] Transmission reliability typically relies on TCP / TLS retransmission and handshake, application-layer verification, and VPN tunnels. Under conditions involving cross-public / private networks, multi-path switching, jitter, and packet loss, both reliability and security requirements exist simultaneously. Different types of measurement data have varying timeliness and sensitivity, while existing solutions often employ uniform security strategies and encapsulation granularities, leaving room for improvement in balancing real-time performance and resource utilization. Summary of the Invention

[0006] To address the aforementioned problems in the prior art, this invention proposes a reliable cross-platform transmission method for multi-source power measurement data, characterized by: Includes the following steps: Step (1): Construct a cross-platform certificate chain system to establish cross-platform identity authentication and trust relationships; Step (2): The vehicle network platform server uses its own private key to digitally sign the measurement data and uses the public key of the power load management system to encrypt and generate encapsulated data; Step (3): The power load management system decrypts the encapsulated data using its own private key and verifies the validity of the digital signature based on the certificate chain; Step (4): The vehicle network platform server generates a session key using digital envelope technology, encrypts the session key based on the public key of the power load management system, and sends it to the power load management system. Step (5): The power load management system decrypts the session key, and both parties perform AES symmetric encryption and decryption based on the session key to achieve secure transmission of measurement data; Throughout the data transmission process, the system monitors network status, computing resource utilization, and business security level in real time, calculates security level index values, and dynamically adjusts the certificate chain verification level and encryption algorithm parameters based on the security level indexes.

[0007] Step (1) specifically includes: The cross-platform certificate authority generates a master key pair (mpk, msk) using the national cryptographic algorithm SM2, and uses the master private key to sign the public key of intermediate certificate nodes to generate intermediate certificates. Intermediate certificate nodes generate their own key pairs (pk_inter, sk_inter), and use their own private keys to sign the public keys of edge certificate nodes to generate edge certificates. Trust is transferred between communication nodes through a step-by-step verification method. The receiver uses the public key of the superior node to verify the validity of the lower-level node's certificate in turn, and finally verifies the complete trust chain through the master public key of the cross-platform certificate authority. Certificates at all levels are configured with validity periods and revocation mechanisms. The certificate authority maintains the certificate registry and revocation list (CRL) to achieve certificate status management.

[0008] Step (2) specifically includes: Before transmitting measurement data, the vehicle-to-everything (V2X) platform server performs secure encapsulation on the measurement data. The server uses its private key to perform SM2 digital signature on the measurement data digest, generating a signature value. The server uses the receiver's public key to perform SM2 public key encryption on the signed data, generating an encrypted data package containing elliptic curve point information, ciphertext data, and a check value. The server combines the signature value and the encrypted data package to form a transmission data packet, which is then sent to the receiver through a secure communication module.

[0009] Step (3) specifically includes: After receiving encrypted and encapsulated data from the vehicle network platform server, the power load management system uses its own private key to execute SM2 public key decryption, extracting elliptic curve point information, ciphertext data, and checksum from the ciphertext. It then generates a session key stream by calculating shared points and recovers the signed and encapsulated data, verifying the consistency between the plaintext and the checksum. Upon successful verification, it extracts the signature value and measurement data content, and obtains the corresponding certificate based on the certificate serial number and signer identifier. It verifies the legitimacy of the server's public key using the root and intermediate certificates in the cross-platform certificate chain, confirming that it is not expired and is not on the revocation list. After confirming the public key's legitimacy, it verifies the signature value using the SM2 signature verification algorithm. If the signature is valid, it confirms that the data has not been tampered with and its source is trustworthy.

[0010] Step (4) specifically includes: After completing data signing and encryption encapsulation, the vehicle-to-everything (V2X) platform server generates and distributes a session key using digital envelope technology. The server calls a true random number generator to generate a random number sequence as the session key, which is only valid within the current communication session. The server uses the receiver's public key to perform SM2 public key encryption, encrypting the session key to generate key encapsulation data containing elliptic curve point information, ciphertext data, and a checksum. The encrypted key encapsulation data and the session identifier are combined to form a digital envelope structure and sent to the receiver through a secure communication channel. The receiver uses its own private key to decrypt the key encapsulation data, calculates the shared point, and generates a keystream to recover the session key. After successful verification, the recovered session key is loaded into the communication key buffer for subsequent AES encryption and decryption operations.

[0011] Step (5) specifically includes: The vehicle-to-everything (V2X) platform server shares a session key with the power load management system and performs AES symmetric encryption and decryption operations based on this key; The server initializes the AES encryption module based on the key length determined by the dynamic security policy module; The server generates an initialization vector IV and performs AES encryption to obtain ciphertext. If necessary, it calculates a message authentication code to verify data integrity. In scenarios with high security requirements, the AES-GCM mode is adopted, while in scenarios with low computing power or high real-time requirements, the AES-CTR mode is adopted. The encrypted data packet is sent to the receiving end through a secure communication channel; The receiving end parses the encrypted data packet, performs AES decryption using the shared session key and IV to recover the plaintext, and compares it with the message authentication code; If the verification passes, the data is confirmed to be complete and reliable.

[0012] During cross-platform power multi-source measurement data transmission, the system continuously monitors network communication status, node computing resource utilization, and service demand levels, and calculates security level index values. ;

[0013] in, For real-time bandwidth utilization, Reference bandwidth; The available computing resources for the current node. Calculate the total resources for each node; The current number of security tasks, This represents the total number of system tasks. This represents the average link latency. The maximum acceptable latency; , , , This is the system adjustment coefficient.

[0014] Security control module according to Numerical judgment operation scenario: a) When When a high-security scenario is identified, the system enables full certificate chain verification, including full-chain signature verification of the root node, intermediate nodes, and edge nodes, and performs encryption using the SM2 algorithm with a long key parameter set and AES-GCM mode; b) When In scenarios deemed to require high real-time performance, the system retains only the root and intermediate node verification steps, employing lightweight SM2 parameters and AES-CTR mode for encryption. For a high security threshold, This is a low security threshold.

[0015] On the other hand, the present invention also proposes an apparatus for implementing the aforementioned method for reliable cross-platform transmission of multi-source power measurement data, the apparatus comprising: The encryption processing module is used to perform SM2 signature and SM2 public key encryption operations on the server side of the vehicle network platform, and to perform decryption and signature verification on the power load management system side. The key management module is used to generate, encrypt, distribute, and update session keys, and adjust the SM2 key length and AES algorithm mode according to dynamic security policies. The security control module is used to monitor network status, computing resource utilization, and security requirement levels in real time, and to calculate security level indicators. And according to The numerical values ​​adaptively switch the certificate chain verification level and encryption algorithm parameters.

[0016] On the other hand, the present invention also proposes a computer device, including a processor, a memory and a communication interface, wherein the memory stores a computer program, and when the computer program is executed by the processor, it implements the cross-platform reliable transmission method for multi-source power measurement data as described above.

[0017] On the other hand, the present invention also proposes a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the cross-platform reliable transmission method for multi-source power measurement data as described in any of the above claims.

[0018] Beneficial effects: This invention constructs a cross-platform certificate chain system, achieving unified identity authentication and trust transfer between the vehicle network platform and the power load management system, avoiding the security vulnerabilities caused by isolated certificates in traditional multi-platform communication. The system combines SM2 digital signatures, SM2 encryption, and AES symmetric encryption technologies to achieve end-to-end data confidentiality, integrity, and verifiability. By introducing a digital envelope mechanism and a dynamic security level adjustment model, the encryption algorithm parameters and certificate verification levels can be adjusted in real time based on network status and computing resources, improving data transmission efficiency while ensuring security. The overall solution achieves highly secure, high-performance, scalable, and reliable transmission of cross-domain measurement data. Attached Figure Description

[0019] The accompanying drawings, which are provided to further illustrate the invention and form part of this application, are not intended to unduly limit the scope of the invention. In the drawings: Figure 1 This invention illustrates the overall process of a cross-platform reliable transmission method for multi-source power measurement data in an embodiment of the present invention. Detailed Implementation

[0020] Example 1 The present invention will now be described in detail with reference to the accompanying drawings and specific embodiments. The illustrative embodiments and descriptions are only used to explain the present invention and are not intended to limit the present invention.

[0021] To better understand the present invention, a specific embodiment of a method for cross-platform trusted transmission of multi-source power measurement data based on digital envelopes and certificate chains is described in detail below with reference to the accompanying drawings.

[0022] Figure 1 The overall process of the method is shown, covering certificate chain construction, data signing and encryption, cross-platform verification, digital envelope generation and session key distribution, AES symmetric encryption and decryption, and adaptive adjustment of dynamic security policies.

[0023] Step 1: Build a cross-platform certificate chain system.

[0024] In this embodiment, a cross-platform certificate chain system is first established, consisting of a cross-platform certificate authority, intermediate certificate nodes, and edge certificate nodes. The cross-platform certificate authority, acting as the root trusted institution, is responsible for generating the master public and private keys and issuing intermediate certificates to the intermediate certificate nodes. The intermediate certificate nodes include the certificate authorities of the vehicle-to-everything (V2X) platform and the power load management system, each generating intermediate public-private key pairs and obtaining legitimate identities through the signature of the cross-platform certificate authority. Edge certificate nodes include the terminal devices of the V2X platform and the load management devices of the power system, completing registration and authentication using certificates issued by their respective intermediate certificate nodes. Through the construction of this multi-level certificate chain, the legitimacy of the identities and trust relationships among the cross-platform participants are guaranteed.

[0025] Step 2: The vehicle network platform server performs data signing and encryption encapsulation.

[0026] Before actual transmission, the vehicle-to-everything (V2X) platform server processes the measurement data. First, it uses its private key to perform an SM2 digital signature operation on the data, generating a signature value to ensure data integrity and source credibility. Then, the V2X platform server uses the public key of the power load management system to encrypt the signed data using SM2, obtaining the final encapsulated data. This process not only guarantees the confidentiality of the transmitted data but also binds the data to the sender's identity at the source.

[0027] Step 3: Decryption and signature verification of the power load management system.

[0028] After receiving the encapsulated data, the power load management system first decrypts the ciphertext using its private key to obtain the signature and data content. Next, the system verifies the legitimacy of the vehicle network server's public key using the root and intermediate certificates in the cross-platform certificate chain, and then confirms the data has not been tampered with by combining this verification with the signature verification process. This verification step ensures the authenticity and consistency of data during cross-platform transmission.

[0029] Step 4: Generate and distribute session keys.

[0030] To improve subsequent communication efficiency, the vehicle-to-everything (V2X) platform server uses digital envelope technology to generate session keys. The session key is generated using a random number generator and encrypted using the public key of the power load management system, forming an encrypted key envelope. This envelope is sent to the power load management system through a secure channel, where it decrypts it using its private key, thus establishing a secure, shared temporary session key between the two parties.

[0031] Step 5: AES symmetric encryption and decryption based on the session key.

[0032] After the session key is established, both parties use it to perform AES symmetric encryption and decryption operations. The vehicle network platform server encrypts the measurement data using the AES algorithm, and the power load management system decrypts it using the same session key to recover the original data content. This symmetric encryption method ensures both efficiency and security for large-scale data transmission.

[0033] Throughout the transmission process, the system continuously monitors network status, computing resource utilization, and service demand levels to generate security level indicators. Based on these indicators, the system dynamically adjusts the certificate chain verification layer and encryption algorithm parameters. a) In high-security scenarios, enable full certificate chain verification, including full-chain signature verification of root node, intermediate node and edge node, and adopt SM2 parameters with long key length and AES-GCM mode to enhance security. b) In scenarios with low computing power or high real-time performance, only some certificate chain verification steps are retained, and lightweight SM2 parameters and AES-CTR mode are adopted to reduce computational overhead and improve real-time performance. c) The system dynamically selects appropriate SM2 curve parameters and AES working mode under different operating conditions to achieve an adaptive balance between security and performance.

[0034] Through the above, this embodiment effectively achieves secure transmission of multi-source power measurement data across platforms between the vehicle network platform and the power load management system. This method balances identity authentication, data integrity protection, encryption efficiency, and dynamic adaptive optimization capabilities, providing secure, reliable, and efficient communication guarantees under different network and computing conditions.

[0035] The specific implementation of each step is as follows: Step 1: Build a cross-platform certificate chain system In this embodiment, the construction process of the cross-platform certificate chain system includes multiple stages such as the establishment of a certificate center, key pair generation, certificate issuance and verification, node registration, and trust chain formation. To achieve trusted communication between different platforms, a cross-platform certificate center is first established as the root trust institution of the entire system. During the initialization phase, the certificate center uses the security parameter λ to generate a master key pair (mpk, msk) using the Chinese national cryptographic SM2 elliptic curve algorithm, where mpk is the master public key and msk is the master private key. The master public key is used for public distribution within the system, while the master private key is only stored internally within the cross-platform certificate center and protected by an encryption hardware module (such as HSM) to prevent unauthorized access.

[0036] After generating the master key pair, the certificate center establishes identity information for each intermediate certificate node, including node number, platform affiliation, validity period, and authorization scope. Intermediate certificate nodes include the certificate centers of the vehicle-to-everything (V2X) platform and the power load management system, each responsible for secondary certificate issuance and management within its respective system. Each intermediate certificate node independently generates an intermediate key pair (pk_inter, sk_inter) using the SM2 algorithm and submits its public key and identity information to the cross-platform certificate center requesting issuance. Upon receiving the request, the cross-platform certificate center uses the master private key msk to sign the intermediate node's public key pk_inter, generating an intermediate certificate σ_root = SM2_Sign(pk_inter, msk), and returns the signature result along with certificate metadata to the intermediate certificate node. Upon receiving the intermediate certificate, the intermediate certificate node verifies the signature using mpk; once its legitimacy is confirmed, it becomes a trusted intermediate entity.

[0037] Edge certificate nodes primarily include terminal devices in the vehicle-to-everything (V2X) platform and load management devices in the power system. Each edge node generates its own key pair (pk_edge, sk_edge) during the initialization phase and sends its public key and device identification information to its associated intermediate certificate node. The intermediate certificate node uses its private key sk_inter to sign the edge node's public key pk_edge, generating an edge certificate σ_inter = SM2_Sign(pk_edge, sk_inter), thereby verifying the edge node's legitimate identity. All certificate issuance processes are recorded in the system's certificate registry to support subsequent verification operations and revocation management.

[0038] During system operation, each participating node achieves trust transfer through certificate verification. When communicating between edge nodes, the receiver first verifies the validity of the sender's certificate: firstly, it checks whether the edge certificate's issuing authority is on the trust list, and then uses the public key of the upper-level intermediate node to verify the signature's correctness; if the verification is successful, it then uses the master public key mpk of the cross-platform certificate authority to verify the validity of the intermediate certificate σ_root. Through this top-down hierarchical verification process, a complete trust link is achieved from root to intermediate to edge.

[0039] Furthermore, to ensure the long-term security of the system, certificates at each level of the certificate chain have expiration and revocation mechanisms. The validity period of intermediate and edge certificates is typically shorter than that of the root certificate, and they are reissued by their corresponding superior nodes before expiration. The certificate authority maintains a Certificate Revocation List (CRL) to record invalid or abnormal certificates. Both communicating parties must simultaneously query this list when verifying certificates to avoid using revoked certificates.

[0040] The cross-platform certificate chain system constructed through the above steps forms a layered trust structure, enabling all participating nodes of the vehicle network platform and the power load management system to operate under a unified root of trust, thereby ensuring the accuracy of identity authentication and the overall security and reliability of the system in cross-platform communication.

[0041] Step 2: The vehicle network platform server performs data signing and encryption encapsulation.

[0042] In this embodiment, the vehicle-to-everything (V2X) platform server performs secure encapsulation of the measurement data before transmission to ensure the integrity, confidentiality, and source reliability of the data during cross-platform transmission. Specifically, the V2X platform server first reads the pre-set SM2 private key sk_A from the local security module and obtains the public key pk_B of the power load management system from the key management system. Both key pairs are registered and stored in the database after being authenticated through a cross-platform certificate chain system during the system deployment phase, ensuring their legitimate and reliable origin.

[0043] After receiving the measurement data *m*, the server first performs standardization and digest calculation operations on the data. To prevent performance degradation caused by large-scale data directly participating in the signature operation, the system uses the SM3 hash algorithm to calculate the digest value of the measurement data, obtaining a data digest value *h* = SM3(m). Subsequently, the vehicle network platform server uses its private key *sk_A* to perform an SM2 digital signature operation on the digest value *h*, generating a signature value *sig* = SM2_Sign(h, *sk_A*). The signature result *sig* is appended to the header of the data structure in byte stream form, forming a signature encapsulation, so that the receiver can perform integrity verification and authentication after decryption.

[0044] After signing, the vehicle-to-everything (V2X) platform server uses the public key pk_B of the power load management system to encrypt the signed data. The encryption process employs the SM2 public-key encryption algorithm, where the system first generates a random number r∈[1,n]. [1] Calculate the elliptic curve point C1 = rG, then calculate the shared point (x2, y2) = r·pk_B, and then generate a keystream using KDF(x2||y2, klen). Perform an XOR operation on the signature encapsulated data to obtain the ciphertext C2. Finally, calculate the data checksum C3 = SM3(x2||m||y2). The encryption result consists of three parts: C1, C2, and C3, forming the final encrypted data encapsulated body c = {C1, C2, C3}. In this encapsulated body, C1 is used for shared key recovery, C2 is the data ciphertext, and C3 is used for integrity verification.

[0045] To ensure the data structure is clear and parsable during transmission, this embodiment uses a unified format for the encrypted encapsulation. The packet header includes the protocol version number, encryption algorithm identifier, signature algorithm identifier, and certificate chain reference information; the packet body includes the signature value sig and the encrypted data segment c; and the packet tail records a timestamp and a random sequence number to prevent data replay attacks. The entire packet is quickly verified through length check and sequence number matching, improving the efficiency of transport layer unpacking.

[0046] During the transmission phase, the vehicle-to-everything (V2X) platform server calls the transmission interface through the secure communication module to send the encapsulated data to the power load management system according to the established protocol. The system supports asynchronous signature and parallel encryption mechanisms, that is, SM2 signature and encryption operations are executed in parallel in a multi-threaded environment to shorten the overall data encapsulation time. After encapsulation is completed, the V2X platform server will synchronously record the signature metadata (signer ID, certificate serial number, signature time) to the log database for subsequent traceability and auditing.

[0047] Through the above steps, the vehicle network platform server implements end-side signature and encryption dual encapsulation of measurement data, ensuring the security and verifiability of data in the transmission link. This not only prevents data from being stolen or tampered with during transmission, but also enables the receiver to verify the legitimacy of the data source based on the certificate chain, thereby realizing a highly secure and reliable transmission mechanism for cross-platform communication.

[0048] Step 3: Decryption and signature verification of the power load management system.

[0049] In this embodiment, after receiving the encapsulated data transmitted from the vehicle network platform server, the power load management system first performs a preliminary check on the integrity and structure of the data packet. The system parses the header of the received data packet to confirm that the protocol version number, encryption algorithm identifier, and data length fields are consistent with expectations. If the check results are correct, the system proceeds to the decryption stage. The power load management system calls the local key management module to retrieve the private key sk_B corresponding to its own certificate from secure storage. This private key is stored in the hardware security module (HSM) to ensure the security of the key during the decryption process.

[0050] The decryption process employs the SM2 public-key decryption algorithm, a national standard for cryptography. The system first extracts three parts of data from the ciphertext structure: C1, C2, and C3. C1 represents elliptic curve point information used to generate the shared key; C2 is the encrypted data body; and C3 is the integrity check value. The power load management system obtains the temporary session key seed by calculating the shared point (x2, y2) = sk_B·C1. Then, it uses the key derivation function KDF(x2||y2, klen) to generate the keystream K, and finally recovers the signature-encapsulated data m' = C2⊕K through an XOR operation. Next, the system uses the SM3 algorithm to verify the consistency between the recovered plaintext data and C3. If the verification result passes, it indicates that the ciphertext has not been tampered with during transmission.

[0051] After successful decryption and integrity verification, the power load management system extracts the signature value sig and measurement data from the plaintext m'. It then proceeds to the signature verification stage. Based on the certificate serial number and signer identifier attached to the encapsulated data, the system retrieves the intermediate and edge certificates of the vehicle network platform server from its local certificate cache. If not cached locally, the corresponding certificate is dynamically obtained through the cross-platform certificate chain service interface. The system sequentially verifies the legality of the server's public key pk_A using the root certificate and intermediate certificate from the cross-platform certificate center. The verification order is: the root certificate center verifies the validity of the intermediate certificate signature, and the intermediate certificate verifies the validity of the edge node certificate signature. After verification, if all certificates are valid and not expired or on the Certificate Revocation List (CRL), the vehicle network server's identity is confirmed as legitimate.

[0052] After confirming the validity of the public key, the system uses the SM2 signature verification algorithm to verify the signature value sig. The verification steps are as follows: (1) Read the signer's public key pk_A from the certificate; (2) Recalculate the summary value h=SM3(m) of the measurement data using the SM3 algorithm; (3) Call the SM2_Verify function, inputting the signature sig, digest h, and public key pk_A, and calculate the signature verification result. If the return value b=1, it means that the signature is valid, that is, the data has not been tampered with and the source is trustworthy; if the return value b=0, the data packet is rejected and the security log recording and abnormal alarm mechanism is triggered.

[0053] To improve processing efficiency, the system employs an asynchronous pipelined verification mechanism, which immediately initiates parallel threads for certificate verification and signature verification after decryption to reduce overall processing latency. If signature verification is successful, the power load management system imports the measurement data m into subsequent data processing modules for monitoring, control, or analysis.

[0054] Through the above steps, the power load management system completes decryption, integrity verification, certificate validity verification, and signature authenticity confirmation during the receiving phase, thereby ensuring the authenticity, consistency, and security of cross-platform data transmission. This allows the entire communication process to maintain highly reliable and verifiable security attributes even in untrusted network environments. Step 4: Generate and distribute session keys.

[0055] In this embodiment, after completing the measurement data signing and encrypted encapsulation, the vehicle-to-everything (V2X) platform server uses digital envelope technology to generate and distribute session keys to achieve efficient encrypted communication of large-scale data in subsequent communications. This process ensures data confidentiality during the session while reducing the computational burden of performing public-key encryption operations for each communication.

[0056] The vehicle-to-everything (V2X) platform server first calls the system's built-in True Random Number Generator (TRNG) to generate a 128-bit or 256-bit random number sequence as the session key k. The random number generator uses an entropy acquisition mechanism based on hardware noise sources to ensure the unpredictability and randomness of the key. The generated session key is only valid within the current communication session period and expires or is destroyed immediately after the session ends. The key's lifespan is controlled by the system policy module, and it is generally triggered to automatically update when one of the following expires: a single communication, a short period (e.g., 30 minutes), or a maximum number of data packets (e.g., 1000 packets).

[0057] After generating the session key, the vehicle-to-everything (V2X) platform server encrypts the session key using the public key pk_B of the power load management system. The encryption operation is performed based on the Chinese national cryptographic standard SM2 public key encryption algorithm. The specific process is as follows: (1) The server generates random numbers r∈[1,n] 1]; (2) Calculate the point C1=rG on the elliptic curve; (3) Calculate the shared point (x2, y2) = r·pk_B; (4) Generate the key stream K using the key derivation function KDF(x2||y2,klen); (5) Perform an XOR operation on the session key k to obtain the ciphertext C2=k⊕K; (6) Calculate the data check value C3=SM3(x2||k||y2), which is used to verify the integrity of the ciphertext during transmission; (7) Combine to obtain the encrypted key-encapsulated data c={C1,C2,C3}.

[0058] The vehicle-to-everything (V2X) platform server combines the generated key encapsulation data with the session identifier (Session_ID) to form a digital envelope structure. The digital envelope's data format includes an envelope header, an encryption key body, and an integrity check segment. The envelope header records the version number, encryption algorithm identifier, key length, and issuance timestamp; the encryption key body contains the aforementioned encapsulated data (c); and the integrity check segment includes the issuer's signature information to prevent man-in-the-middle attacks or envelope tampering.

[0059] After key encapsulation, the vehicle-to-everything (V2X) platform server sends the digital envelope to the power load management system via a secure communication channel (such as TLS 1.3 or SSL). The secure channel relies on the previous certificate chain verification results during connection establishment to ensure the encryption of the transmission channel and the trustworthiness of the endpoints. During transmission, a segmented transmission and data integrity detection mechanism is employed, with each data fragment accompanied by a CRC-32 checksum to prevent key data from being corrupted due to packet loss or interference during link transmission.

[0060] Upon receiving a digital envelope, the power load management system parses its structure and extracts the encrypted key body c={C1,C2,C3}, then decrypts it using its private key sk_B. The decryption process is symmetrical to the encryption process. The system first calculates the shared point (x2',y2')=sk_B·C1, then executes KDF(x2'||y2',klen) to generate the keystream K', and then calculates k'=C2⊕K' to recover the original session key. Finally, it calculates a checksum using SM3(x2'||k'||y2') and compares it with the received C3. If they match, it indicates that the key transmission was correct and has not been tampered with.

[0061] After successful verification, the power load management system loads the session key k' into the communication key cache and marks it as the active key for the current session. To prevent key leakage, the system only retains a transient image of the key in memory, without storing it in plaintext, and completely erases it after the session ends using a secure erasure algorithm (such as multiple overwrite operations). The vehicle network platform server and the power load management system then share the same temporary session key, and all subsequent measurement data transmissions are encrypted and decrypted using AES based on this key.

[0062] Through the above technical process, the vehicle network platform server achieves secure and efficient session key generation and distribution, which not only ensures the confidentiality and integrity of the key during transmission, but also reduces the computational overhead caused by frequent use of public key encryption algorithms, thereby realizing dynamic security control and high-performance encrypted transmission in cross-platform communication of multi-source power measurement data.

[0063] Step 5: AES symmetric encryption and decryption based on the session key.

[0064] In this embodiment, after a shared session key is successfully established between the vehicle network platform server and the power load management system, both parties use this key to perform AES symmetric encryption and decryption operations to achieve efficient and secure transmission of measurement data. The length of the session key can be 128 bits, 192 bits, or 256 bits depending on the system configuration, and the specific length is automatically determined by the dynamic security policy module based on the network status and security level.

[0065] Before encrypting the transmission, the vehicle-to-everything (V2X) platform server standardizes the measurement data, including removing redundant fields, padding the data frame length, and calculating checksums. Subsequently, the server calls the AES encryption module to load the currently valid session key k and initialize the encryption parameters. The system adopts the AES-GCM (Galois / Counter Mode) or AES-CTR (Counter Mode) working modes recommended by the national cryptographic standard. If the system operates in a high-security scenario, the AES-GCM mode is selected; this mode, in addition to encryption, can also generate a Message Authentication Code (MAC) to verify data integrity. If operating in a low-computing-power or high-real-time-requirement scenario, the AES-CTR mode is used to reduce computational complexity.

[0066] During the encryption process, the server first generates an Initialization Vector (IV), which is 96 bits long and is generated using a True Random Number Generator (TRNG) to ensure uniqueness in each encryption process. Then, it performs AES encryption, calculating the ciphertext C = AES_Encrypt(k, IV, m), where m is the original measurement data. If AES-GCM mode is used, the message authentication code Tag = GCM_Auth(k, IV, m) is calculated synchronously and appended to the end of the ciphertext. The final data packet structure includes an encryption header, ciphertext body, and authentication code field. The encryption header records the algorithm identifier, IV value, timestamp, and session identifier (Session_ID) for correct decryption by the receiver.

[0067] The generated encrypted data packets are sent to the power load management system through a secure communication channel. To improve transmission efficiency, the system adopts a data segmentation mechanism, encrypting the massive data in segments. Each segment independently generates an IV and performs encryption processing. The receiver reassembles the original data according to the segment order to ensure stable transmission of large-scale measurement data.

[0068] Upon receiving an encrypted data packet, the power load management system parses the algorithm identifier and IV value from the packet header. It then calls the AES decryption module to load the corresponding session key k and performs the AES_Decrypt(k,IV,C) operation to recover the plaintext data m'. In AES-GCM mode, the system simultaneously calculates the authentication code Tag' and compares it with the Tag transmitted by the sender. If they match, the data has not been tampered with. If verification fails, the data packet is immediately discarded and an alarm is triggered.

[0069] To prevent replay attacks and data tampering, the system verifies the validity of the timestamp field of each data packet. When the timestamp of a received packet exceeds the allowed delay threshold (e.g., 5 seconds), the system automatically rejects the packet and records the abnormal event. All encryption and decryption operations are performed by hardware acceleration modules (such as AES-NI or SM series encryption chips) to ensure that processing performance meets real-time transmission requirements.

[0070] Through the above steps, the vehicle-to-everything (V2X) platform server and the power load management system have implemented a symmetric encrypted communication mechanism based on a shared session key. This method significantly improves encryption and decryption efficiency while ensuring data confidentiality and integrity. It is suitable for large-scale, multi-node, real-time cross-platform transmission scenarios of power measurement data, thus providing the system with a low-latency, highly reliable, and secure communication foundation. In this embodiment, to achieve the optimal balance between system security and performance under different operating environments, a dynamic security policy control mechanism is introduced throughout the data transmission process. This mechanism continuously monitors key parameters such as network communication status, node computing resource utilization, and business application demand levels to calculate the security level index value S in real time. The system analyzes and judges S through the security control module. When S is higher than a preset threshold, it is determined to be a high-security demand scenario; when S is lower than a lower threshold, it is determined to be a low-computing-power or high-real-time-performance scenario, thereby automatically triggering the corresponding security policy switch.

[0071] In high-security scenarios, the system prioritizes ensuring the confidentiality and integrity of communication. The security control module instructs the certificate verification module to enable a complete certificate chain verification mechanism, including full-chain signature verification of the root node, intermediate nodes, and edge nodes. At this point, the system loads the root certificate center's master public key, the public keys of each intermediate node, and the target edge node's certificate to verify the identities of both communicating parties step-by-step. During verification, a long key parameter set (such as 256-bit curve parameters) of the SM2 algorithm is used, and the AES-GCM mode is selected in the encryption algorithm module. In addition to encryption, the AES-GCM mode generates a message authentication code (Tag) for subsequent data integrity verification. This mode effectively prevents data forgery, tampering, or replay attacks, ensuring that critical measurement data has the highest level of security protection during transmission.

[0072] In scenarios with low computing power or high real-time requirements, the system automatically reduces computational complexity to improve processing performance. When the security control module detects that CPU utilization or memory load exceeds a set threshold, it automatically issues policy instructions to adjust the certificate chain verification level, retaining only the root node and intermediate node verification steps. At this time, the system calls a lightweight SM2 parameter set (such as 192-bit or 224-bit curve parameters) to reduce elliptic curve computation overhead and switches the encryption algorithm mode to AES-CTR mode. AES-CTR mode performs encryption through a counter, eliminating the need for additional message authentication computation, significantly reducing latency and improving encryption speed, making it suitable for edge computing nodes or scenarios with high real-time requirements.

[0073] In this embodiment, to achieve the optimal balance between system security and performance under different operating environments, a dynamic security policy control mechanism is introduced throughout the data transmission process. This mechanism continuously monitors key parameters such as network communication status, node computing resource utilization, and service demand levels to calculate security level index values ​​in real time. The system dynamically adjusts the certificate chain verification level and encryption algorithm parameters based on this indicator, thereby achieving a balance between security and performance.

[0074] Safety level indicators The formula is derived from a comprehensive calculation of multiple factors and is as follows:

[0075] in, For real-time bandwidth utilization, Reference bandwidth; The available computing resources for the current node. Calculate the total resources for each node; The current number of security tasks, This represents the total number of system tasks. This represents the average link latency. The maximum acceptable latency; This is the system adjustment coefficient, used to balance the weights of different indicators. Through this combined formula, the system can reflect the dynamic relationship between security and performance in a continuous, non-linear manner. When network load increases or node resources are strained, It automatically tends towards lower values, thereby triggering a lightweight security policy; conversely, when the communication environment is stable and resources are sufficient, The system will automatically increase the level of security protection.

[0076] When the security level index When the security threshold is reached, the system enters a high-security requirement mode. The security control module sends a command to the certificate verification module to enable full certificate chain verification, including full-chain signature verification of the root node, intermediate nodes, and edge nodes. At this time, the system loads the root certificate center's master public key, the public keys of each intermediate node, and the target edge node certificate to verify the identities of both communicating parties step by step. During the verification process, the long key parameter set (256-bit curve parameters) of the SM2 algorithm is used, and the AES-GCM encryption mode is selected to perform data protection, generating an additional authentication code. To ensure data integrity.

[0077] When the security level index At low security thresholds, the system switches to high real-time mode. The security control module instructs the certificate verification module to retain only the verification levels of the root node and intermediate nodes, and calls the lightweight SM2 parameters (192-bit curve parameters). The encryption algorithm module switches to AES-CTR mode to perform fast encryption. This mode generates a keystream by incrementing a counter, reducing MAC computation and thus significantly reducing latency and improving data throughput.

[0078] To ensure a continuous and stable switching process, a safety adjustment function is set in the system. Used to smooth the parameter transition between different security levels:

[0079] in, As a neutral security point in the system, This is the sensitivity coefficient. The function output range is... ,when near At this time, the system partially loads different security parameters by interpolation to achieve gradual switching and prevent communication jitter caused by frequent switching.

[0080] The system periodically calculates security level indicators. The cycle can be set to 5–10 seconds, and the parameter status, including the threshold, mode switch time, and old and new parameter groups, is recorded each time an adjustment is made. This information is stored in a secure log database to support post-event auditing. The log data is protected for integrity using hash digests and digital signatures to prevent tampering.

[0081] By introducing the above security level formula With smoothing adjustment function The system can automatically optimize the certificate chain verification depth, SM2 key parameters and AES encryption mode according to the real-time operating environment, so as to achieve coordinated control of security and performance, thereby ensuring that cross-platform measurement data still has high adaptability, high security and high transmission efficiency under complex network conditions.

[0082] Meanwhile, the system records parameter information for each dynamic policy adjustment, including the switching time, triggering conditions, security level value, and new and old parameter configurations, and stores this information in the security log for auditing and traceability. The log information is hash-encrypted and uploaded to the security management server to prevent log tampering or loss.

[0083] Through the above mechanism, the system can intelligently and adaptively adjust its security policies under different operating conditions. When the external environment changes or the node load fluctuates, the system can instantly switch the certificate verification level and encryption algorithm mode, optimizing system performance while ensuring communication security, and achieving secure, stable, and efficient operation of cross-platform power measurement data transmission.

[0084] Example 2 This application utilizes digital signatures, encryption, and certificate chain technologies to address issues such as data tampering and data security leaks during transmission, ensuring the secure distribution of cloud communication keys and achieving highly secure and efficient information communication transmission. The specific implementation plan is as follows: Establish a secure key distribution mechanism for inter-cloud communication and a reliable method for measurement data transmission. 1) Underlying measurement encapsulation is completed using digital signatures and encryption technology. Digital signature technology is a crucial means of verifying identity and data integrity. By signing electronic documents using encryption algorithms and keys, it ensures that information is not tampered with or forged during transmission. Adding a digital signature to each data packet ensures data integrity and verifiability of its origin. Simultaneously, employing strong encryption algorithms protects data privacy and security during transmission. Even if data is intercepted during transmission, unauthorized third parties cannot decipher its content, thus guaranteeing the trustworthy encapsulation of measurement data in the initial stage.

[0085] 2) Implementing Digital Envelope Technology: Digital envelope technology is a data transmission encryption method that combines symmetric and asymmetric encryption techniques. This technology encrypts data using the recipient's public key or a pre-shared symmetric key, ensuring that only a specific recipient can access the message content. The working principle of a digital envelope includes the following steps: Data Encryption: First, the sender uses a symmetric encryption algorithm (such as AES) to encrypt the data to be transmitted. Key Encryption: Next, the sender uses the recipient's public key and an asymmetric encryption algorithm (such as RSA) to encrypt the previously generated symmetric key. Data Transmission: The encrypted data and the encrypted key (i.e., the digital envelope) are sent to the recipient. Data Decryption: After receiving the digital envelope, the recipient first uses their private key to decrypt the key, obtaining the original symmetric key. Then, they use this symmetric key to decrypt the data, obtaining the original plaintext information. During this process, even if someone intercepts the encrypted data and the encrypted key, without the recipient's private key, they cannot decrypt the key and therefore cannot decrypt the data. In the data transmission process, the digital envelope provides an additional layer of security, preventing data tampering during transmission.

[0086] 3) Utilizing certificate chain technology: By establishing a certificate chain, the identity of each entity participating in data transmission is verified, ensuring that data is processed by a trusted entity at every node in the transmission link.

[0087] The above description is only a preferred embodiment of the present invention. Therefore, all equivalent changes or modifications made to the structure, features and principles described in the claims of this patent application are included in the scope of this patent application.

Claims

1. A reliable cross-platform transmission method for multi-source power measurement data, characterized in that: Includes the following steps: Step (1): Construct a cross-platform certificate chain system to establish cross-platform identity authentication and trust relationships; Step (2): The vehicle network platform server uses its own private key to digitally sign the measurement data and uses the public key of the power load management system to encrypt and generate encapsulated data; Step (3): The power load management system decrypts the encapsulated data using its own private key and verifies the validity of the digital signature based on the certificate chain; Step (4): The vehicle network platform server generates a session key using digital envelope technology, encrypts the session key based on the public key of the power load management system, and sends it to the power load management system. Step (5): The power load management system decrypts the session key, and both parties perform AES symmetric encryption and decryption based on the session key to achieve secure transmission of measurement data; Throughout the data transmission process, the system monitors network status, computing resource utilization, and business security level in real time, calculates security level index values, and dynamically adjusts the certificate chain verification level and encryption algorithm parameters based on the security level indexes.

2. The method for reliable cross-platform transmission of multi-source power measurement data as described in claim 1, characterized in that: Step (1) specifically includes: The cross-platform certificate authority generates a master key pair (mpk, msk) using the national cryptographic algorithm SM2, and uses the master private key to sign the public key of intermediate certificate nodes to generate intermediate certificates. Intermediate certificate nodes generate their own key pairs (pk_inter, sk_inter), and use their own private keys to sign the public keys of edge certificate nodes to generate edge certificates. Trust is transferred between communication nodes through a hierarchical verification process. The receiver sequentially verifies the validity of the lower-level node's certificate using the public key of the higher-level node, and finally verifies the complete trust chain using the master public key of the cross-platform certificate authority. Certificates at each level have validity periods and revocation mechanisms, and the certificate authority maintains a certificate registry and revocation list (CRL) to manage certificate status. The step-by-step verification method includes: root certificate validity verification, intermediate certificate revocation status query verification, and edge certificate signature chain verification. When a node certificate validity verification fails, the CRL list update mechanism is automatically triggered and cross-platform certificate synchronization is re-initiated.

3. The method for reliable cross-platform transmission of multi-source power measurement data as described in claim 1, characterized in that: Step (2) specifically includes: Before transmitting measurement data, the vehicle-to-everything (V2X) platform server performs secure encapsulation on the measurement data. The server uses its private key to perform SM2 digital signature on the measurement data digest, generating a signature value. The server uses the receiver's public key to perform SM2 public key encryption on the signed data, generating an encrypted data package containing elliptic curve point information, ciphertext data, and a check value. The server combines the signature value and the encrypted data package to form a transmission data packet, which is then sent to the receiver through a secure communication module. The digital signature uses the SM3 hash algorithm to generate a data digest and the SM2 algorithm to sign the digest; the encryption process uses the recipient's public key to perform elliptic curve point operations and key derivation encryption on the signed data.

4. The method for reliable cross-platform transmission of multi-source power measurement data as described in claim 1, characterized in that: Step (3) specifically includes: After receiving encrypted and encapsulated data from the vehicle network platform server, the power load management system uses its own private key to execute SM2 public key decryption, extracting elliptic curve point information, ciphertext data, and checksum from the ciphertext. It then generates a session key stream by calculating shared points and recovers the signed and encapsulated data, verifying the consistency between the plaintext and the checksum. Upon successful verification, it extracts the signature value and measurement data content, and obtains the corresponding certificate based on the certificate serial number and signer identifier. It verifies the legality of the server's public key using the root and intermediate certificates in the cross-platform certificate chain, confirming that it is not expired and is not on the revocation list. After confirming the public key's legality, it verifies the signature value using the SM2 signature verification algorithm. If the signature is valid, it confirms that the data has not been tampered with and its source is trustworthy. The symmetric encryption uses the AES-256-GCM mode to generate the session key, while the asymmetric encryption uses the SM2 algorithm to encrypt and encapsulate the session key to generate a digital envelope.

5. A reliable cross-platform transmission method for multi-source power measurement data as described in claim 1, characterized in that: Step (4) specifically includes: After completing data signing and encryption encapsulation, the vehicle-to-everything (V2X) platform server generates and distributes a session key using digital envelope technology. The server calls a true random number generator to generate a random number sequence as the session key, which is only valid within the current communication session. The server uses the receiver's public key to perform SM2 public key encryption, encrypting the session key to generate key encapsulation data containing elliptic curve point information, ciphertext data, and a checksum. The encrypted key encapsulation data and the session identifier are combined to form a digital envelope structure and sent to the receiver through a secure communication channel. The receiver uses its own private key to decrypt the key encapsulation data, calculates the shared point, and generates a keystream to recover the session key. After successful verification, the recovered session key is loaded into the communication key buffer for subsequent AES encryption and decryption operations.

6. The method for reliable cross-platform transmission of multi-source power measurement data as described in claim 1, characterized in that: Step (5) specifically includes: The vehicle-to-everything (V2X) platform server shares a session key with the power load management system and performs AES symmetric encryption and decryption operations based on this key; The server initializes the AES encryption module based on the key length determined by the dynamic security policy module; The server generates an initialization vector IV and performs AES encryption to obtain ciphertext. If necessary, it calculates a message authentication code to verify data integrity. In scenarios with high security requirements, the AES-GCM mode is adopted, while in scenarios with low computing power or high real-time requirements, the AES-CTR mode is adopted. The encrypted data packet is sent to the receiving end through a secure communication channel; The receiving end parses the encrypted data packet, performs AES decryption using the shared session key and IV to recover the plaintext, and compares it with the message authentication code; If the verification passes, the data is confirmed to be complete and reliable.

7. A reliable cross-platform transmission method for multi-source power measurement data as described in claim 1, characterized in that: During cross-platform power multi-source measurement data transmission, the system continuously monitors network communication status, node computing resource utilization, and service demand levels, and calculates security level index values. ; in, For real-time bandwidth utilization, Reference bandwidth; The available computing resources for the current node. Calculate the total resources for each node; The current number of security tasks, This represents the total number of system tasks. This represents the average link latency. The maximum acceptable latency; , , , This is the system adjustment coefficient.

8. A reliable cross-platform transmission method for multi-source power measurement data as described in claim 7, characterized in that: Security control module according to Numerical judgment operation scenario: a) When When a high-security scenario is identified, the system enables full certificate chain verification, including full-chain signature verification of the root node, intermediate nodes, and edge nodes, and performs encryption using the SM2 algorithm with a long key parameter set and AES-GCM mode; b) When In scenarios deemed to require high real-time performance, the system retains only the root and intermediate node verification steps, employing lightweight SM2 parameters and AES-CTR mode for encryption. For a high security threshold, This is a low security threshold.

9. An apparatus for implementing a reliable cross-platform transmission method for multi-source power measurement data as described in any one of claims 1 to 8, characterized in that, The device includes: The encryption processing module is used to perform SM2 signature and SM2 public key encryption operations on the server side of the vehicle network platform, and to perform decryption and signature verification on the power load management system side. The key management module is used to generate, encrypt, distribute, and update session keys, and adjust the SM2 key length and AES algorithm mode according to dynamic security policies. The security control module is used to monitor network status, computing resource utilization, and security requirement levels in real time, and to calculate security level indicators. And according to The numerical values ​​adaptively switch the certificate chain verification level and encryption algorithm parameters.

10. A computer storage medium, characterized in that, It includes a processor, a memory, and a communication interface. The memory stores a computer program, which, when executed by the processor, implements the cross-platform reliable transmission method for multi-source power measurement data as described in any one of claims 1 to 8.

Images