Battery state information terminal cloud cooperative communication method, device and equipment and storage medium

Abstract

This application provides a cloud-edge collaborative communication method, apparatus, device, and storage medium for battery status information. The method includes: a cloud platform generating battery status information based on the battery's operating data; responding to a handshake request sent by a vehicle-side communication module, performing a handshake process with the vehicle-side communication module that includes two-way certificate verification at the transmission security protocol layer to establish a secure transmission channel and generate a session key; constructing an application layer data packet containing status information and verification information for preventing replay attacks; encrypting the application layer data packet according to the session key to generate encrypted data; and sending the encrypted data to the vehicle-side communication module through the secure transmission channel, so that the vehicle-side communication module can decrypt the encrypted data based on the session key to obtain the status information and verification information, perform replay attack verification based on the verification information, and transmit the status information to the battery management system after successful verification, thus ensuring the secure and reliable transmission of cloud-generated status information to the vehicle.

Description

Technical Field

[0001] This application relates to the field of vehicle technology, specifically to a cloud-edge collaborative communication method, apparatus, device, and storage medium for battery status information. Background Technology

[0002] With the rapid development of intelligent connected vehicle technology, edge-cloud collaborative communication is increasingly becoming an important means to improve the overall intelligence level of vehicles. In the field of electric vehicles, edge-cloud collaborative communication typically refers to establishing a data interaction channel between the vehicle and the cloud to collect, transmit, and process vehicle operation data, thereby providing services such as remote monitoring, fault warning, and performance optimization. Among these, the battery management system, as the core control unit of an electric vehicle, plays a crucial role in ensuring the safety, reliability, and lifespan of the power battery through its collaborative communication with the cloud platform.

[0003] In related technologies, the operating data of the power battery is uploaded to a cloud-based big data platform via a mobile communication network. The cloud platform then stores and analyzes the data for offline display or statistical reports, but no mechanism is designed to transmit the data to the vehicle. Under this architecture, the vehicle-side battery management system can only obtain locally generated data and cannot access the more precise power battery status information generated by the cloud platform.

[0004] However, due to the limitations of local computing power and storage resources, the state estimation generated by the vehicle-side battery management system based on short-term operating data has inherent limitations in accuracy, making it difficult to further improve the state monitoring accuracy and control decision accuracy of the battery management system.

[0005] It should be noted that the information disclosed in the background section of this application is intended only to enhance the understanding of the general background of this application, and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0006] In view of this, this application provides a battery status information edge-cloud collaborative communication method, device, equipment and storage medium to help solve the problem in related technologies that the vehicle-side battery management system cannot obtain the battery status estimation results generated by the cloud, resulting in the status monitoring accuracy being limited by local computing power and data scale and difficult to further improve.

[0007] In a first aspect, embodiments of this application provide a cloud-edge collaborative communication method for battery status information, applied to a cloud platform, including: Based on the operating data of the power battery, the state information of the power battery is generated; In response to a handshake request sent by the vehicle-side communication module, a transport security protocol layer handshake process is performed with the vehicle-side communication module to establish a secure transmission channel, and a session key for protecting the secure transmission channel is generated during the handshake process; wherein, the handshake process includes two-way certificate verification; Construct an application layer data packet to be sent, wherein the application layer data packet includes at least the status information of the power battery and verification information for preventing replay attacks; Based on the session key, the application layer data packet is encrypted to generate encrypted data; The encrypted data is sent to the vehicle-side communication module through the secure transmission channel, so that the vehicle-side communication module can decrypt the encrypted data based on the session key, obtain the status information of the power battery and the verification information, and perform anti-replay attack verification based on the verification information. After the verification is successful, the status information of the power battery is transmitted to the battery management system.

[0008] In this embodiment, the cloud platform generates status information based on the power battery's operating data and responds to the handshake request sent by the vehicle-side communication module. A secure transmission channel and session key are established through a handshake process that includes two-way certificate verification. The cloud platform constructs an application-layer data packet containing status information and anti-replay attack verification information, encrypts it with the session key, and sends it to the vehicle-side communication module through the secure channel. The vehicle-side communication module decrypts the data to obtain the status information and verification information. After passing the anti-replay attack verification, it transmits the status information to the battery management system. It can be understood that the status information generated by the cloud platform can be transmitted to the vehicle and utilized by the battery management system under the premise of trusted identity, secure channel, encrypted data, and anti-replay protection, providing a foundation for the vehicle-side battery management system to overcome the limitations of local computing power and data scale.

[0009] In one possible implementation, the handshake process performed with the vehicle-side communication module to establish a secure transmission channel includes: Send a cloud certificate to the vehicle-side communication module so that the vehicle-side communication module can verify the identity of the cloud platform; Receive the vehicle certificate sent by the vehicle communication module and verify the validity of the vehicle certificate; After successful verification, a secure transmission channel is established with the vehicle-side communication module.

[0010] In this embodiment of the application, through two-way certificate verification, the cloud platform can confirm the legitimacy of the vehicle-side communication module's identity, and the vehicle-side communication module can also confirm the authenticity of the cloud platform's identity, thereby ensuring the mutual trust between the identities of the two communicating parties and providing an identity authentication basis for the establishment of a secure transmission channel.

[0011] In one possible implementation, verifying the legitimacy of the vehicle-side certificate includes at least one of the following: Verify the validity of the digital signature of the vehicle certificate, verify the validity period of the vehicle certificate, and verify the revocation status of the vehicle certificate.

[0012] In this embodiment of the application, by verifying the validity, expiration date and revocation status of the digital signature of the vehicle certificate, the legitimacy of the vehicle certificate can be confirmed from multiple dimensions of authenticity, timeliness and validity, thereby preventing the use of forged, expired or revoked certificates to establish a secure transmission channel, and further improving the reliability of identity authentication between the two communicating parties.

[0013] In one possible implementation, the verification information used by the vehicle-side communication module for replay attack verification includes: a timestamp and a random number.

[0014] In this embodiment, timestamps and random numbers are introduced as verification information to prevent replay attacks. Timestamps are used to verify the timeliness of data, and random numbers are used to ensure the uniqueness of each data. The combination of the two can effectively identify and intercept past data packets that have been maliciously replayed, thereby ensuring the freshness and authenticity of the data received by the vehicle-side communication module.

[0015] In one possible implementation, encrypting the application layer data packet based on the session key to generate encrypted data includes: The application layer data packets are encrypted using an authentication encryption algorithm to generate encrypted data and its corresponding integrity authentication tag; Sending the encrypted data to the vehicle-side communication module through the secure transmission channel includes sending the encrypted data and the integrity authentication tag together to the vehicle-side communication module.

[0016] In this embodiment, by employing an authentication encryption algorithm to encrypt application layer data packets and generate integrity authentication tags, integrity protection can be provided while encrypting the data. The receiver can confirm that the data has not been tampered with during transmission by verifying the authentication tag. Sending the encrypted data and integrity authentication tag together allows the vehicle-side communication module to simultaneously complete data integrity verification during decryption, improving data processing efficiency.

[0017] In one possible implementation, generating a session key for protecting the secure transmission channel during the handshake process includes: The session key is generated by negotiating with the vehicle-side communication module through a key exchange algorithm, wherein the key exchange algorithm includes the elliptic curve Diffie-Hellman key exchange algorithm.

[0018] In this embodiment, the session key is negotiated and generated using the Elliptic Curve Diffie-Hellman key exchange algorithm, enabling both communicating parties to jointly calculate the same session key without transmitting their private keys. This algorithm possesses forward security; even if the long-term private key of the cloud platform is leaked in the future, it cannot be used to decrypt data encrypted during past communications, thus ensuring the long-term security of historical communication data.

[0019] In one possible implementation, after sending the encrypted data to the vehicle-side communication module through the secure transmission channel, the method further includes: Receive confirmation information returned by the vehicle-side communication module; If the confirmation information is not received within a preset time, the encrypted data will be resent until the preset maximum number of retries is reached.

[0020] In this embodiment, by receiving confirmation information returned by the vehicle-side communication module, the cloud platform can determine whether the encrypted data has been successfully received. If no confirmation information is received within a preset time, a retransmission mechanism is triggered to resend the encrypted data until the maximum number of retries is reached. This improves the reliability of data transmission in complex network environments and ensures that critical data can ultimately be delivered to the vehicle.

[0021] Secondly, embodiments of this application provide a battery status information edge-cloud collaborative communication device, including: The status information generation module is used to generate the status information of the power battery based on the operating data of the power battery; A secure transmission channel is used to respond to a handshake request sent by the vehicle-side communication module, perform a transport security protocol layer handshake process with the vehicle-side communication module to establish a secure transmission channel, and generate a session key for protecting the secure transmission channel during the handshake process; wherein, the handshake process includes two-way certificate verification; The data packet delivery module is used to construct application layer data packets to be delivered. The application layer data packets include at least the status information of the power battery and verification information for preventing replay attacks. An encryption module is used to encrypt the application layer data packets according to the session key to generate encrypted data; An encrypted data sending module is used to send the encrypted data to the vehicle-side communication module through the secure transmission channel, so that the vehicle-side communication module can decrypt the encrypted data based on the session key, obtain the status information of the power battery and the verification information, and perform anti-replay attack verification based on the verification information. After the verification is successful, the status information of the power battery is transmitted to the battery management system.

[0022] Thirdly, embodiments of this application provide an electronic device, including: processor; Memory; And a computer program, wherein the computer program is stored in the memory, the computer program including instructions that, when executed by the processor, cause the electronic device to perform the method described in any one of the first aspects.

[0023] Fourthly, embodiments of this application provide a computer-readable storage medium including a stored program, wherein, when the program is executed, it controls the device where the computer-readable storage medium is located to perform the method described in any one of the first aspects.

[0024] It is understood that the battery status information terminal-cloud collaborative communication device provided in the second aspect, the electronic device provided in the third aspect, and the computer-readable storage medium provided in the fourth aspect are all used to execute some or all of the methods provided in this application. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods, and will not be repeated here. Attached Figure Description

[0025] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0026] Figure 1 This is a schematic diagram of an application scenario provided by an embodiment of this application.

[0027] Figure 2 This is a flowchart illustrating a cloud-edge collaborative communication method for battery status information, provided in an embodiment of this application.

[0028] Figure 3 This is a schematic diagram of the structure of a battery status information edge-cloud collaborative communication device provided in an embodiment of this application.

[0029] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0030] To better understand the technical solution of this application, the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0031] It should be understood that the described embodiments are merely some, not all, of the embodiments in this application. All other embodiments obtained by those skilled in the art based on the embodiments in this application without inventive effort are within the scope of protection of this application.

[0032] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. The singular forms “a,” “the,” and “the” used in the embodiments of this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0033] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0034] See Figure 1 This is a schematic diagram illustrating an application scenario provided by an embodiment of this application. For example... Figure 1 As shown, this application scenario includes a vehicle-side unit 101 and a cloud platform 102. The vehicle-side unit 101 is equipped with a power battery, a battery management system connected to the power battery, and a vehicle-side communication module connected to the battery management system. The battery management system is used to monitor and manage the operating status of the power battery in real time, and the vehicle-side communication module is used to establish communication between the vehicle-side unit 101 and an external network. The cloud platform 102 is a remotely deployed server cluster or big data platform with massive data storage and high-performance computing capabilities. The vehicle-side communication module and the cloud platform 102 establish a communication connection through a mobile communication network to achieve bidirectional data transmission.

[0035] In related technologies, vehicle-side communication modules typically upload battery operating data collected by the battery management system, such as parameters like current, voltage, and temperature, to a cloud platform for storage and analysis via mobile communication networks. Based on the massive amounts of received operating data, the cloud platform can use algorithms such as deep learning to perform offline estimations of the battery's health status and lifespan degradation. However, the edge-cloud collaborative architecture of these technologies primarily focuses on data collection and centralized processing from the vehicle to the cloud. The data analysis results generated by the cloud platform remain only on the cloud platform, without a mechanism for transmission to the vehicle. Under this architecture, the vehicle-side battery management system can only obtain locally generated data and cannot access the more precise battery status information generated by the cloud platform.

[0036] However, due to the limitations of local computing power and storage resources, the state estimation generated by the vehicle-side battery management system based on short-term operating data has inherent limitations in accuracy, making it difficult to further improve the state monitoring accuracy and control decision accuracy of the battery management system.

[0037] To address the aforementioned issues, in this embodiment, the cloud platform generates status information based on the power battery's operating data and responds to the handshake request sent by the vehicle-side communication module. A secure transmission channel and session key are established through a handshake process including two-way certificate verification. The cloud platform constructs an application-layer data packet containing status information and anti-replay attack verification information, encrypts it with the session key, and sends it to the vehicle-side communication module through the secure channel. The vehicle-side communication module decrypts the data to obtain the status information and verification information. After passing the anti-replay attack verification, it transmits the status information to the battery management system. It can be understood that the status information generated by the cloud platform can be transmitted to the vehicle and utilized by the battery management system under the premise of trusted identity, secure channel, encrypted data, and anti-replay protection, providing a foundation for the vehicle-side battery management system to overcome the limitations of local computing power and data scale. Specifically, detailed descriptions are provided below in conjunction with the accompanying drawings and specific embodiments.

[0038] See Figure 2 This is a flowchart illustrating a cloud-edge collaborative communication method for battery status information provided in an embodiment of this application. This method can be applied to the application scenarios described above, such as... Figure 2 As shown, it mainly includes the following steps.

[0039] Step S201: Generate the state information of the power battery based on the operating data of the power battery.

[0040] In practical applications, the vehicle-side communication module and the cloud platform first establish a Transmission Control Protocol (TCP) connection. The vehicle-side communication module sends a synchronization request message to the cloud platform. Upon receiving the message, the cloud platform replies with a synchronization confirmation message. The vehicle-side communication module then sends an confirmation message back to the cloud platform, completing the three-way handshake process of the TCP, thereby establishing a reliable TCP connection between the vehicle-side communication module and the cloud platform. This TCP connection provides connection-oriented, reliable underlying transmission services for subsequent data transmission.

[0041] Based on the established transmission control protocol connection, the vehicle-side communication module collects the operating parameters of the power battery monitored by the battery management system in real time through the vehicle network, and uploads this operating data to the cloud platform via the mobile communication network. It should be noted that the upload channel for the power battery operating data can be established based on a transmission security protocol to ensure the confidentiality and integrity of the operating data during the upload process. This upload channel and the secure transmission channel involved in this application can be independent of each other, and they can employ the same or different security mechanisms; this application does not impose specific restrictions on this.

[0042] The cloud platform receives and stores this uploaded operational data, forming a historical operational record of the power battery. Based on this, the cloud platform utilizes its computing resources to process the received operational data. For example, the cloud platform is equipped with a data analysis model. This data analysis model, through learning from the historical operational data of the power battery, grasps the general laws of power battery performance degradation and can extract characteristic information reflecting the intrinsic properties of the power battery from basic operational parameters such as current, voltage, and temperature. Based on this historical operational data and current operational data, the cloud platform calculates an assessment result that can characterize the current state of the power battery, such as the power battery's health status, state of charge, power status, or lifespan degradation trend.

[0043] Taking the health status of a power battery as an example, the cloud platform can generate a more accurate health status value than the local estimation on the vehicle by comparing relevant data of the power battery itself and combining the battery's degradation pattern. This status information generated by the cloud platform will be used as data to be sent to the vehicle's communication module in subsequent steps.

[0044] Step S202: In response to the handshake request sent by the vehicle-side communication module, perform a handshake process at the transmission security protocol layer with the vehicle-side communication module to establish a secure transmission channel, and generate a session key for protecting the secure transmission channel during the handshake process.

[0045] In this embodiment, the cloud platform responds to the handshake request sent by the vehicle-side communication module, performs a transport security protocol layer handshake process with the vehicle-side communication module to establish a secure transmission channel, and generates a session key for protecting the secure transmission channel during the handshake process. The handshake process includes two-way certificate verification.

[0046] Specifically, after the vehicle-side communication module and the cloud platform establish a transmission control protocol connection, the vehicle-side communication module sends a handshake request message to the cloud platform to initiate the transmission security protocol layer handshake process. This handshake request message may include information about the transmission security protocol version supported by the vehicle-side communication module, cipher suite information, and a randomly generated client-side random number. Upon receiving the handshake request message, the cloud platform selects a cipher suite from those supported by the vehicle-side communication module for this communication and generates a server-side random number.

[0047] To achieve two-way certificate verification, the cloud platform and the vehicle-side communication module need to mutually verify each other's identities. In one possible implementation, the cloud platform sends a cloud certificate to the vehicle-side communication module. This cloud certificate, issued by a Certificate Authority (CA), contains the cloud platform's public key, identity information, and the CA's digital signature. Upon receiving the cloud certificate, the vehicle-side communication module verifies its validity. The vehicle-side communication module then sends its own vehicle certificate to the cloud platform. This vehicle certificate, issued by a CA, contains the vehicle-side communication module's public key, vehicle identity information, and the CA's digital signature. Upon receiving the vehicle certificate, the cloud platform also verifies its validity. Through this two-way certificate exchange and verification process, the cloud platform and the vehicle-side communication module mutually confirm each other's authenticity, ensuring that both parties in subsequent communications are trusted entities.

[0048] Verifying the legitimacy of a certificate can include multiple aspects. For example, the verification process may include verifying whether the certificate's digital signature was issued by a trusted certificate authority, ensuring that the certificate content has not been tampered with and its source is trustworthy. The verification process may also include verifying whether the certificate's current time is within its stated validity period, preventing the use of expired or ineffective certificates. Furthermore, the verification process may include querying the certificate's revocation status through an online certificate status protocol or a certificate revocation list, preventing the use of certificates revoked by a certificate authority. In addition, other attributes of the certificate can be verified according to actual security needs, such as verifying whether the identity information in the certificate matches the intended communication target. Through these multi-dimensional verifications, the use of forged, expired, or revoked certificates to establish secure transmission channels can be effectively prevented.

[0049] After successful two-way certificate verification, the cloud platform and the vehicle-side communication module need to negotiate and generate a session key to protect subsequent communications. In one possible implementation, the two parties negotiate and generate the session key using a key exchange algorithm. Specifically, based on the client's random number, the server's random number, and their respective public key information exchanged during the handshake process, the cloud platform and the vehicle-side communication module calculate the same session key using the key exchange algorithm. This session key will be used for subsequent encryption and decryption of application-layer data to protect the confidentiality and integrity of data transmitted through the secure transmission channel.

[0050] For example, the Elliptic Curve Diffie-Hellman (ECH) key exchange algorithm can be used. This algorithm utilizes the mathematical principles of elliptic curves, enabling communicating parties to jointly calculate the same session key by exchanging temporary public key parameters without transmitting their private keys. The session key negotiated using this algorithm possesses forward security; even if the cloud platform's long-term private key is leaked in the future, attackers cannot use it to decrypt data encrypted during past communications, thus ensuring the long-term security of historical communication data. Besides the ECH Diffie-Hellman algorithm, other key exchange algorithms can also be used, such as the traditional ECH Diffie-Hellman algorithm based on the discrete logarithm problem in finite fields, or key transmission methods based on the RSA algorithm. In practical applications, the specific key exchange algorithm used can be determined comprehensively based on factors such as security requirements, computing resources, and the support of the communication protocol.

[0051] At this point, the cloud platform and the vehicle-side communication module have completed a secure handshake process at the transport security protocol layer, including two-way certificate verification, establishing a secure transmission channel and generating a session key to protect this channel. This secure transmission channel provides a secure and reliable foundation for transmitting downlink data containing power battery status information.

[0052] Step S203: Construct the application layer data packet to be sent.

[0053] In this embodiment, after establishing a secure transmission channel and generating a session key, the cloud platform begins preparing the data to be sent to the vehicle-side communication module. The battery status information is an evaluation result generated by the cloud platform in step S201 based on the vehicle's historical operating data, such as the battery's health status, state of charge, power status, or lifespan degradation trend. This status information is the core data for this downlink transmission, aiming to provide the vehicle-side battery management system with a more accurate battery status reference.

[0054] To further ensure data transmission security, the cloud platform incorporates verification information to prevent replay attacks when constructing application-layer data packets. This verification information allows the vehicle-side communication module to determine whether the received data is newly generated and legitimate, rather than past data packets intercepted and retransmitted by an attacker. By introducing this verification information, replay attacks can be effectively identified and blocked, ensuring the real-time nature and validity of the status information received and processed by the vehicle-side battery management system.

[0055] Verification information used to prevent replay attacks can be implemented in several ways. In one implementation, the verification information may include a timestamp and a random number. The timestamp identifies the moment the data packet was generated. After receiving the data packet, the vehicle-side communication module compares the timestamp with the current time to determine whether the data packet was generated within the allowed time window, thus preventing replay attacks using expired data. The random number is a sufficiently random and unique value generated by the cloud platform. The vehicle-side communication module can record the received random numbers and discard duplicate random numbers, thereby preventing attackers from repeatedly sending the same data packets.

[0056] In another possible implementation, the verification information could consist solely of a monotonically increasing sequence number. The cloud platform assigns a sequentially increasing sequence number to each data packet, and the vehicle-side communication module determines whether the data packet is newly generated and valid by checking the monotonicity of the sequence number. Data packets with a sequence number less than or equal to the largest received sequence number are discarded. This approach is understandably simpler.

[0057] In another possible implementation, the verification information could include a one-time token generated based on a hash chain. The cloud platform pre-computes a set of hash chains, using the next value in the hash chain as verification information each time data is sent. The vehicle-side communication module verifies the token's validity through hash calculations. Understandably, this approach provides stronger security.

[0058] In another possible implementation, the verification information can be a combination of a timestamp and a monotonically increasing sequence number. The timestamp ensures the timeliness of the data packet, while the sequence number ensures the uniqueness and order of data packets within the same time window. The combination of the two can more comprehensively defend against various replay attacks.

[0059] In addition, application layer data packets can also include other auxiliary fields, such as protocol version number, command code, and data length, to ensure that the vehicle-side communication module can correctly parse and process the received data packets. The specific content and format of these fields can be defined according to actual application requirements. After the cloud platform completes the construction of the application layer data packet, this data packet will be used as the object for subsequent encryption processing and will ultimately be sent to the vehicle-side communication module through the established secure transmission channel. By introducing anti-replay attack verification information, the cloud platform provides the vehicle-side communication module with a basis for verifying the freshness and uniqueness of data, further enhancing the security of end-to-end cloud collaborative communication.

[0060] Understandably, by introducing anti-replay attack verification information, the cloud platform provides a basis for the vehicle-side communication module to verify the freshness and uniqueness of the data, further enhancing the security of end-to-cloud collaborative communication.

[0061] Step S204: Based on the session key, encrypt the application layer data packet to generate encrypted data.

[0062] In this embodiment of the application application, after the application layer data packet is constructed, it is encrypted according to the session key to generate encrypted data, so as to ensure its confidentiality in subsequent transmission.

[0063] Specifically, the encryption uses a session key negotiated during the handshake process. This key is known only to the cloud platform and the vehicle-side communication module, and cannot be obtained by third parties. By encrypting application-layer data packets, attackers can be prevented from eavesdropping on and obtaining plaintext status or verification information on the communication link, thereby protecting sensitive data from being leaked.

[0064] In one possible implementation, the cloud platform can employ an authentication encryption algorithm to encrypt application-layer data packets. This algorithm provides both confidentiality and integrity protection, generating an authentication tag for integrity verification while encrypting the data. The cloud platform inputs the application-layer data packets into the authentication encryption algorithm, performs encryption using a session key, and outputs encrypted data and its corresponding integrity authentication tag. The encrypted data is the ciphertext form of the application-layer data packets, and the integrity authentication tag is used by the receiver to verify whether the data has been tampered with during transmission. The cloud platform sends the encrypted data and integrity authentication tag together to the vehicle-side communication module, enabling the module to simultaneously verify the integrity and authenticity of the data during decryption.

[0065] Specifically, authentication encryption algorithms include the Advanced Encryption Standard (AES) in Galois / counter mode, the AES in Message Authentication Code mode with Ciphertext Block Chaining, and algorithms combining stream ciphers and multinomial authentication. These algorithms each have their own characteristics in terms of security strength and computational efficiency, and can be selected according to the actual application scenario.

[0066] In another possible implementation, the cloud platform can process application-layer data packets using both encryption algorithms and message authentication code algorithms. Specifically, the cloud platform first encrypts the application-layer data packets using the encryption key in the session key, generating encrypted data. Then, the cloud platform uses the integrity verification key in the session key to calculate the message authentication code on either the encrypted data or the original application-layer data packet, generating an integrity verification value. The cloud platform then sends both the encrypted data and the integrity verification value to the vehicle-side communication module.

[0067] Of course, cloud platforms can also use stream encryption algorithms to encrypt application-layer data packets. Stream encryption algorithms generate ciphertext by XORing the key stream with the plaintext data, and are characterized by fast processing speed and simple implementation. This approach is suitable for scenarios with high real-time requirements and limited computing resources.

[0068] Understandably, regardless of the encryption method used, the cloud platform ultimately generates encrypted data, which will be sent to the vehicle-side communication module via a secure transmission channel in step S205. Through the encryption process in step S204, the cloud platform effectively ensures the confidentiality of the power battery status information during transmission.

[0069] Step S205: Send the encrypted data to the vehicle-side communication module through a secure transmission channel.

[0070] In this embodiment, the cloud platform sends the encrypted data generated in step S204 to the vehicle communication module through the secure transmission channel established in step S202, so that the vehicle communication module can decrypt the encrypted data based on the session key to obtain the status information and verification information of the power battery, and perform anti-replay attack verification based on the verification information. After the verification is successful, the status information of the power battery is transmitted to the battery management system.

[0071] Specifically, the cloud platform encapsulates encrypted data into messages conforming to the Transmission Security Protocol Layer (TSL) format and sends them to the vehicle-side communication module through an established secure transmission channel. Upon receiving the encrypted data, the vehicle-side communication module first decrypts it using the same session key, reconstructing the application-layer data packet. Then, it parses the application-layer data packet to obtain the battery status information and verification information used to prevent replay attacks. If the verification passes, it indicates that the data is newly generated and legitimate, rather than a replay of a past data packet. The vehicle-side communication module then transmits the verified battery status information to the battery management system via the vehicle network for use in subsequent control strategies.

[0072] To further improve the reliability of data transmission, the cloud platform can introduce an acknowledgment mechanism after sending encrypted data. In one possible implementation, the cloud platform starts a timer after sending encrypted data, waiting for an acknowledgment from the vehicle-side communication module. The acknowledgment indicates that the vehicle-side communication module has successfully received and processed the encrypted data. If the cloud platform receives the acknowledgment within a preset time, the transmission process is complete, and subsequent operations can continue. If the cloud platform does not receive the acknowledgment within the preset time, the transmission is considered a failure, triggering a retransmission mechanism to resend the encrypted data. The retransmission operation can be repeated multiple times until a preset retry limit is reached. If no acknowledgment is received after reaching the retry limit, the cloud platform can record the transmission failure event for subsequent analysis and processing by maintenance personnel. It is understood that the acknowledgment and retransmission mechanisms effectively address data transmission failures caused by network transients or packet loss, improving the reliability of delivering critical status information to the vehicle.

[0073] In one possible implementation, after completing decryption and verification, the vehicle-side communication module can return not only confirmation information but also verification result information. For example, if the vehicle-side communication module detects a timestamp timeout or a duplicate random number during verification, it can return verification failure information and the reason for failure to the cloud platform. After receiving the verification failure information, the cloud platform can adjust its subsequent sending strategy based on the reason for failure, such as regenerating new verification information and resending it, or recording the security event for later analysis.

[0074] Furthermore, when transmitting battery status information to the battery management system, the vehicle-side communication module can select an appropriate transmission method based on the type and urgency of the information. For status information requiring real-time response, the vehicle-side communication module can transmit it immediately via a high-speed vehicle network; for non-real-time status information, it can be cached and transmitted on demand. After receiving the status information, the battery management system can apply it to specific control functions such as state-of-charge calibration, power limit adjustment, and equalization control strategy optimization, achieving more precise management of the battery.

[0075] In this embodiment, the cloud platform generates status information based on the power battery's operating data and responds to the handshake request sent by the vehicle-side communication module. A secure transmission channel and session key are established through a handshake process that includes two-way certificate verification. The cloud platform constructs an application-layer data packet containing status information and anti-replay attack verification information, encrypts it with the session key, and sends it to the vehicle-side communication module through the secure channel. The vehicle-side communication module decrypts the data to obtain the status information and verification information. After passing the anti-replay attack verification, it transmits the status information to the battery management system. It can be understood that the status information generated by the cloud platform can be transmitted to the vehicle and utilized by the battery management system under the premise of trusted identity, secure channel, encrypted data, and anti-replay protection, providing a foundation for the vehicle-side battery management system to overcome the limitations of local computing power and data scale.

[0076] Corresponding to the above embodiments, this application also provides a battery status information edge-cloud collaborative communication device. Specifically, see... Figure 3 This is a schematic diagram of a battery status information terminal-cloud collaborative communication device provided in an embodiment of this application. As shown in the figure, the battery status information terminal-cloud collaborative communication device 300 is illustrated. Specifically, the battery status information terminal-cloud collaborative communication device 300 includes: The status information generation module 301 is used to generate status information of the power battery based on the operating data of the power battery; The secure transmission channel 302 is used to respond to the handshake request sent by the vehicle-side communication module, perform a handshake process at the transmission security protocol layer with the vehicle-side communication module to establish a secure transmission channel, and generate a session key for protecting the secure transmission channel during the handshake process; The data packet delivery module 303 is used to construct the application layer data packet to be delivered; The encryption module 304 is used to encrypt application layer data packets according to the session key to generate encrypted data; The encrypted data sending module 305 is used to send encrypted data to the vehicle-side communication module through a secure transmission channel, so that the vehicle-side communication module can decrypt the encrypted data based on the session key, obtain the status information and verification information of the power battery, and perform anti-replay attack verification based on the verification information. After the verification is successful, the status information of the power battery is transmitted to the battery management system.

[0077] Specifically, please refer to the embodiments described above. For the sake of brevity, this application will not provide a detailed description here.

[0078] Corresponding to the above embodiments, this application also provides a schematic diagram of the structure of an electronic device. See also Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application. The electronic device 400 may include a processor 401, a memory 402, and a communication unit 403. These components communicate through one or more buses. Those skilled in the art will understand that the structure of the electronic device shown in the figure does not constitute a limitation on the embodiments of the present invention. It may be a bus-shaped structure or a star-shaped structure, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0079] The communication unit 403 is used to establish a communication channel, enabling the electronic device to communicate with other devices. It receives user data from other devices or sends user data to other devices.

[0080] Processor 401, serving as the control center of the electronic device, connects various parts of the device via various interfaces and lines. It executes software programs, instructions, and / or modules stored in memory 402, and calls data stored in memory to perform various functions and / or process data. The processor can be composed of integrated circuits (ICs), such as a single packaged IC or multiple packaged ICs with the same or different functions connected together. For example, processor 401 may consist only of a central processing unit (CPU). In this embodiment, the CPU may have a single processing core or include multiple processing cores.

[0081] Memory 402 is used to store the execution instructions of processor 401. Memory 402 can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk or optical disk.

[0082] When the execution instructions in memory 402 are executed by processor 401, the electronic device 400 is able to perform operations. Figure 2 Some or all of the steps in the illustrated embodiments.

[0083] In a specific implementation, this application also provides a computer storage medium, wherein the computer storage medium may store a program, and when the program is executed, it may include some or all of the steps of the various embodiments of the simulation scene generation method provided by this invention. The storage medium may be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.

[0084] In this application embodiment, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent the existence of A alone, the simultaneous existence of A and B, or the existence of B alone. A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects have an "or" relationship. "At least one of the following" and similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one of a, b, and c can represent: a, b, c, ab, ac, bc, or abc, where a, b, and c can be single or multiple.

[0085] Those skilled in the art will recognize that the units and algorithm steps described in the embodiments disclosed herein can be implemented using electronic hardware, computer software, or a combination of electronic hardware and software. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0086] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0087] In the several embodiments provided in this application, any function, if implemented as a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0088] The same or similar parts between the various embodiments in this specification can be referred to mutually. In particular, the device embodiments and terminal embodiments are basically similar to the method embodiments, so the description is relatively simple, and the relevant parts can be referred to the description in the method embodiments.

Claims

1. A cloud-edge collaborative communication method for battery status information, characterized in that, Applied to cloud platforms, including: Based on the operating data of the power battery, the state information of the power battery is generated; In response to a handshake request sent by the vehicle-side communication module, a transport security protocol layer handshake process is performed with the vehicle-side communication module to establish a secure transmission channel, and a session key for protecting the secure transmission channel is generated during the handshake process; wherein, the handshake process includes two-way certificate verification; Construct an application layer data packet to be sent, wherein the application layer data packet includes at least the status information of the power battery and verification information for preventing replay attacks; Based on the session key, the application layer data packet is encrypted to generate encrypted data; The encrypted data is sent to the vehicle-side communication module through the secure transmission channel, so that the vehicle-side communication module can decrypt the encrypted data based on the session key, obtain the status information of the power battery and the verification information, and perform anti-replay attack verification based on the verification information. After the verification is successful, the status information of the power battery is transmitted to the battery management system.

2. The method according to claim 1, characterized in that, The process of performing a handshake at the transmission security protocol layer with the vehicle-side communication module to establish a secure transmission channel includes: Send a cloud certificate to the vehicle-side communication module so that the vehicle-side communication module can verify the identity of the cloud platform; Receive the vehicle certificate sent by the vehicle communication module and verify the validity of the vehicle certificate; After successful verification, a secure transmission channel is established with the vehicle-side communication module.

3. The method according to claim 2, characterized in that, Verifying the legality of the vehicle-side certificate includes at least one of the following: Verify the validity of the digital signature of the vehicle certificate, verify the validity period of the vehicle certificate, and verify the revocation status of the vehicle certificate.

4. The method according to claim 1, characterized in that, The verification information for the line replay attack prevention verification includes: timestamp and random number.

5. The method according to claim 1, characterized in that, The step of encrypting the application layer data packet according to the session key to generate encrypted data includes: The application layer data packets are encrypted using an authentication encryption algorithm to generate encrypted data and its corresponding integrity authentication tag; Sending the encrypted data to the vehicle-side communication module through the secure transmission channel includes sending the encrypted data and the integrity authentication tag together to the vehicle-side communication module.

6. The method according to claim 1, characterized in that, The generation of a session key for protecting the secure transmission channel during the handshake process includes: The session key is generated by negotiating with the vehicle-side communication module through a key exchange algorithm, wherein the key exchange algorithm includes the elliptic curve Diffie-Hellman key exchange algorithm.

7. The method according to claim 1, characterized in that, After sending the encrypted data to the vehicle-side communication module through the secure transmission channel, the method further includes: Receive confirmation information returned by the vehicle-side communication module; If the confirmation information is not received within a preset time, the encrypted data will be resent until the preset maximum number of retries is reached.

8. A battery status information edge-cloud collaborative communication device, characterized in that, include: The status information generation module is used to generate the status information of the power battery based on the operating data of the power battery; A secure transmission channel is used to respond to a handshake request sent by the vehicle-side communication module, perform a transport security protocol layer handshake process with the vehicle-side communication module to establish a secure transmission channel, and generate a session key for protecting the secure transmission channel during the handshake process; wherein, the handshake process includes two-way certificate verification; The data packet delivery module is used to construct application layer data packets to be delivered. The application layer data packets include at least the status information of the power battery and verification information for preventing replay attacks. An encryption module is used to encrypt the application layer data packets according to the session key to generate encrypted data; An encrypted data sending module is used to send the encrypted data to the vehicle-side communication module through the secure transmission channel, so that the vehicle-side communication module can decrypt the encrypted data based on the session key, obtain the status information of the power battery and the verification information, and perform anti-replay attack verification based on the verification information. After the verification is successful, the status information of the power battery is transmitted to the battery management system.

9. An electronic device, characterized in that, include: processor; Memory; And a computer program, wherein the computer program is stored in the memory, the computer program including instructions that, when executed by the processor, cause the electronic device to perform the method of any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein, when the program is executed, it controls the device on which the computer-readable storage medium is located to perform the method according to any one of claims 1 to 8.

Images