Authentication and control method and device for vehicle pile net and electronic equipment

Abstract

The application discloses a kind of authentication and control method, device and electronic equipment of vehicle pile net, wherein the method includes: obtaining the charging pile parameter of target charging pile, and the system public parameter released by vehicle pile net platform;According to charging pile parameter and system public parameter, the first level two-way authentication of target charging pile and target vehicle is executed, vehicle pile session key is generated, and according to charging pile parameter and system public parameter, the second level two-way authentication of target charging pile and target power grid platform is executed, and pile net session key is generated;After the first level two-way authentication and the second level two-way authentication are completed, hierarchical control instruction is generated according to target session key;Hierarchical control instruction is sent to corresponding target terminal, to make target terminal execute corresponding control.The application solves the technical problems of authentication relationship fragmentation, trust establishment mode not unified and trust vulnerability caused by the lack of multi-level subject unified authentication mechanism for vehicle network interaction in the prior art.

Description

Technical Field

[0001] This invention relates to the field of cryptographic authentication, and more specifically, to an authentication and control method, apparatus, and electronic device for a vehicle-to-charging-pile network. Background Technology

[0002] Currently, with the large-scale access of electric vehicles and the continuous advancement of vehicle-to-grid (V2G) services, data interaction and business collaboration between the vehicle side, charging pile side, and power grid platform side are becoming increasingly frequent. The vehicle side needs to submit access requests, status information, and other relevant parameters to the charging pile side. After completing local access support, the charging pile side also needs to upload relevant session information and operating status to the power grid platform side, which then further aggregates, analyzes, and distributes requests. In this process, different entities belong to different levels and have different management boundaries, and the interaction links typically operate in an open network environment. Therefore, establishing secure, reliable, and manageable trust relationships in multi-entity, multi-level, and multi-link business scenarios has become a key issue for the practical application of V2G systems.

[0003] In existing technologies, secure access and authentication for vehicle-to-grid (V2G) interaction scenarios typically focus more on authentication issues between single links or local entities. For example, this might only address identity verification between the vehicle and access nodes, or only focus on the platform's management of the legitimacy of access devices. While these approaches can meet local communication security requirements to some extent, they often fail to consider the overall design of the "vehicle-charging station-network" interaction path in V2G services, lacking consideration for the hierarchical access and verification process for multiple business entities. When different entities lack authentication mechanisms that match the business links, problems such as fragmented authentication relationships and unclear authentication process connections can easily arise, thus affecting the overall security and feasibility of the system.

[0004] Furthermore, there are significant differences in identity management requirements between the vehicle side, the charging pile side, and the power grid platform side. As the terminal entity directly involved in the interaction, the vehicle side's true identity, trip-related information, and behavioral characteristics are highly sensitive. Direct exposure during authentication could easily lead to user privacy leaks and behavioral association risks. On the other hand, the charging pile side and the power grid platform side, as support and management nodes in the system, place greater emphasis on clear identity, maintainable status, and manageable business operations. In existing technologies, some authentication schemes fail to adequately differentiate the varying needs of different entities regarding anonymity and real-name management, often employing a relatively simplistic identity processing approach. This makes it difficult to simultaneously address the anonymous access requirements of the vehicle side and the overall system's traceability and regulatory requirements.

[0005] Meanwhile, in multi-entity interaction scenarios, if the authentication process relies excessively on the real-time participation of a central entity, or if the authentication message interaction design is unreasonable, it can easily lead to additional communication burdens and implementation complexity, which is not conducive to the application requirements of frequent access and dynamic switching in vehicle-to-everything (V2X) interaction services. Therefore, existing technologies for multi-entity authentication in V2X interaction scenarios still have problems such as insufficient matching between the authentication structure and the business link, insufficient differentiation of identity requirements of different levels of entities, and inconsistent system trust establishment methods.

[0006] There is currently no effective solution to the above problems. Summary of the Invention

[0007] This invention provides a vehicle-charging-network authentication and control method, device, and electronic device to at least solve the technical problems of fragmented authentication relationships, inconsistent trust establishment methods, and trust vulnerabilities caused by the lack of a multi-level unified authentication mechanism for vehicle-network interaction in the prior art.

[0008] According to one aspect of the present invention, a vehicle-charging-pile network authentication and control method is provided, comprising: acquiring charging pile parameters of a target charging pile and system public parameters published by a vehicle-charging-pile network platform, wherein the charging pile parameters include a charging pile registration certificate and a security private key encapsulated in a security module, and the system public parameters include a platform public key; performing a first-level two-way authentication between the target charging pile and a target vehicle based on the charging pile parameters and the system public parameters to generate a vehicle-charging-pile session key, and performing a second-level two-way authentication between the target charging pile and a target power grid platform based on the charging pile parameters and the system public parameters to generate a charging-pile-network session key; after both the first-level two-way authentication and the second-level two-way authentication are completed, generating a hierarchical control command based on the target session key, wherein the target session key includes at least one of the following: the vehicle-charging-pile session key and the charging-pile-network session key; and sending the hierarchical control command to a corresponding target terminal to cause the target terminal to perform corresponding control, wherein the target terminal includes at least one of the following: a target power grid platform and a target vehicle.

[0009] Optionally, based on the charging pile parameters and the system common parameters, a first-level two-way authentication is performed between the target charging pile and the target vehicle to generate a vehicle-charging pile session key. This includes: obtaining vehicle-charging pile authentication request information sent by the target vehicle, wherein the vehicle-charging pile authentication request information includes an anonymous identity identifier temporarily assigned to the target vehicle by the vehicle-charging pile network platform, a vehicle temporary public key, and a registration auxiliary value. The vehicle temporary public key is determined based on the vehicle temporary private key generated by the target vehicle, and the registration auxiliary value represents the vehicle's legitimate registration identity; generating a charging pile-side authentication certificate based on the security private key and the charging pile temporary private key; and sending first feedback information to the target vehicle so that the target vehicle verifies the charging pile-side authentication certificate based on the platform public key published by the vehicle-charging pile network platform. If the verification passes, the identity of the target charging pile is confirmed as legitimate, and the anonymous identity identifier, vehicle temporary public key, and vehicle-side secret value are used to verify the authentication certificate. The system generates a vehicle-side shared intermediate quantity to generate a vehicle-side authentication response. The first feedback information includes the charging pile authentication certificate and the charging pile's temporary public key. The vehicle-side shared intermediate quantity is determined based on the vehicle's temporary private key and the charging pile's temporary public key. The vehicle-side secret value is determined based on the registration auxiliary value and the anonymous identity identifier. The system receives the vehicle-side authentication response sent by the target vehicle. Based on the charging pile's temporary private key and the vehicle's temporary public key, it determines the first charging pile-side shared intermediate quantity and determines the charging pile-side secret value based on the registration auxiliary value and the anonymous identity identifier. Based on the anonymous identity identifier, the vehicle's temporary public key, the registration auxiliary value, the first charging pile-side shared intermediate quantity, and the charging pile-side secret value, the system verifies the vehicle-side authentication response. If the verification passes, the system confirms the target vehicle's legitimacy and completes the first level of two-way authentication. Finally, based on the first charging pile-side shared intermediate quantity, it determines the vehicle-charging pile session key.

[0010] Optionally, based on the charging pile parameters and the system common parameters, a second-level two-way authentication is performed between the target charging pile and the target power grid platform to generate a charging pile-grid session key. This includes: obtaining charging pile-grid authentication request information sent by the target power grid platform, wherein the charging pile-grid authentication request information includes the platform identity identifier of the target power grid platform and a platform temporary public key, the platform temporary public key being determined based on the platform temporary private key generated by the target power grid platform; generating a charging pile-side authentication certificate based on the security private key and the charging pile temporary private key; determining a second charging pile-side shared intermediate quantity based on the charging pile temporary private key and the platform temporary public key; and sending second feedback information to the target power grid platform to enable the charging pile to perform a second-level two-way authentication. The target power grid platform verifies the charging pile-side authentication certificate based on the platform public key Y issued by the vehicle-charging pile network platform. If the verification passes, the target charging pile's identity is confirmed as legitimate. Based on the second shared intermediate quantity for the charging pile side, a session key is determined. A platform-side confirmation message is generated based on the session key. The second feedback information includes the charging pile-side authentication certificate and the charging pile's temporary public key. The platform platform receives the platform-side confirmation message returned by the target power grid platform, determines the charging pile network session key based on the second shared intermediate quantity for the charging pile side, and verifies the platform-side confirmation message based on the charging pile network session key. If the verification passes, the target power grid platform's identity is confirmed as legitimate, completing the second level of two-way authentication.

[0011] Optionally, generating a charging pile-side authentication certificate based on the secure private key and the charging pile temporary private key includes: if the vehicle-to-charging pile authentication request information also includes a vehicle-side timestamp generated by the target vehicle, verifying whether the vehicle-side timestamp meets a first valid time window; if the first valid time window is met, generating a first charging pile-side timestamp; and generating the charging pile-side authentication certificate based on the secure private key, the charging pile temporary private key, and the first charging pile-side timestamp.

[0012] Optionally, generating a charging pile-side authentication certificate based on the secure private key and the charging pile's temporary private key includes: if the charging pile authentication request information also includes a platform-side timestamp and authentication verification value generated by the target power grid platform, verifying whether the platform-side timestamp meets the validity of a second valid time window, wherein the authentication verification value is determined based on the platform identity identifier, the platform's temporary public key, the platform registration timestamp, the platform-side timestamp, and the authentication index, and the authentication index is obtained based on the secure private key; if the second valid time window is met, verifying the authentication verification value based on the secure private key to complete the verification of the target power grid platform's identity; if the verification passes, generating a second charging pile-side timestamp; and generating the charging pile-side authentication certificate based on the secure private key, the charging pile's temporary private key, and the second charging pile-side timestamp.

[0013] Optionally, before obtaining the charging pile parameters of the target charging pile, the method further includes: sending a charging pile registration request to the vehicle-charging pile network platform, so that the vehicle-charging pile network platform generates a registration timestamp and authentication index based on the real identity identifier, and encapsulates the security private key into the security module of the target charging pile, wherein the charging pile registration request information includes the real identity identifier of the target charging pile; and receiving registration confirmation information sent by the vehicle-charging pile network platform, wherein the registration confirmation information includes the authentication index and the registration timestamp.

[0014] Optionally, before obtaining the charging pile parameters of the target charging pile, the method further includes: obtaining a vehicle registration completion notification sent by the vehicle-charging-pile network platform, wherein the vehicle registration completion notification indicates that the vehicle-charging-pile network platform has generated an anonymous identity identifier and a registration auxiliary value for the target vehicle based on the real identity identifier of the target vehicle, and recorded the mapping relationship between the real identity identifier and the anonymous identity identifier.

[0015] According to one aspect of the present invention, a vehicle-charging-network authentication and control device is provided, comprising: an acquisition module, configured to acquire charging pile parameters of a target charging pile and system public parameters published by a vehicle-charging-network platform, wherein the charging pile parameters include a charging pile registration certificate and a security private key encapsulated in a security module, and the system public parameters include a platform public key; an execution module, configured to perform a first-level two-way authentication between the target charging pile and a target vehicle based on the charging pile parameters and the system public parameters, generating a vehicle-charging-network session key, and perform a second-level two-way authentication between the target charging pile and a target power grid platform based on the charging pile parameters and the system public parameters, generating a charging-network session key; a generation module, configured to generate a hierarchical control instruction based on the target session key after both the first-level and second-level two-way authentications are completed, wherein the target session key includes at least one of the following: the vehicle-charging-network session key and the charging-network session key; and a sending module, configured to send the hierarchical control instruction to a corresponding target terminal to cause the target terminal to perform corresponding control, wherein the target terminal includes at least one of the following: a target power grid platform and a target vehicle.

[0016] According to one aspect of the present invention, an electronic device is provided, comprising: a processor; and a memory for storing processor-executable instructions; wherein the processor is configured to execute the instructions to implement the vehicle-charging-network authentication and control method as described in any of the preceding claims.

[0017] According to one aspect of the present invention, a computer-readable storage medium is provided, wherein when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, the electronic device is enabled to perform the vehicle-charging network authentication and control method as described in any of the preceding claims.

[0018] In this embodiment of the invention, the charging pile parameters of the target charging pile and the system public parameters published by the vehicle-charging-network platform are obtained. The charging pile parameters include the charging pile registration certificate and the security private key encapsulated in the security module. The system public parameters include the platform public key. Based on the charging pile parameters and the system public parameters, a first-level two-way authentication is performed between the target charging pile and the target vehicle to generate a vehicle-charging-network session key. Then, based on the charging pile parameters and the system public parameters, a second-level two-way authentication is performed between the target charging pile and the target power grid platform to generate a charging-network session key. After both the first and second-level two-way authentications are completed, a hierarchical control command is generated based on the target session key. The target session key includes at least one of the following: a vehicle-charging-network session key and a charging-network session key. The hierarchical control command is sent to the corresponding target terminal to enable the target terminal to perform the corresponding control. The target terminal includes at least one of the following: a target power grid platform and a target vehicle. By employing a hierarchical two-way authentication and session key-based hierarchical control approach, the system generates vehicle-charging pile and charging pile-grid session keys and charging pile-grid session keys through first-level two-way authentication between the target charging pile and the target vehicle, and second-level two-way authentication between the target charging pile and the target power grid platform. Based on the target session keys, hierarchical control commands are generated and sent to the corresponding target terminals. This achieves the goal of unified authentication and hierarchical control for multiple entities at the vehicle, charging pile, and grid levels, thereby realizing the technical effect of integrated authentication and control and orderly establishment of trust relationships. Furthermore, it solves the technical problems of fragmented authentication relationships, inconsistent trust establishment methods, and trust vulnerabilities caused by the lack of a unified authentication mechanism for multi-level entities in vehicle-grid interaction in existing technologies. Attached Figure Description

[0019] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0020] Figure 1 This is a flowchart of the vehicle-charging station network authentication and control method according to an embodiment of the present invention;

[0021] Figure 2 This is a schematic diagram of a vehicle-charging station-network hierarchical authentication method for vehicle-network interaction provided by an optional embodiment of the present invention;

[0022] Figure 3 This is a schematic diagram of the vehicle-pile-network hierarchical system provided by an optional embodiment of the present invention;

[0023] Figure 4 This is a structural block diagram of the vehicle-charging station network authentication and control device according to an embodiment of the present invention. Detailed Implementation

[0024] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] Example 1

[0027] According to an embodiment of the present invention, an embodiment of a vehicle-charging network authentication and control method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0028] Figure 1 This is a flowchart of the vehicle-charging station network authentication and control method according to an embodiment of the present invention, such as... Figure 1 As shown, the method includes the following steps:

[0029] Step S102: Obtain the charging pile parameters of the target charging pile and the system public parameters published by the vehicle-charging-pile network platform. The charging pile parameters include the charging pile registration certificate and the security private key encapsulated in the security module. The system public parameters include the platform public key.

[0030] Among them, target charging piles refer to charging pile equipment that needs to be certified with vehicles and power grid platforms, and can serve as the certification execution subject, such as electric vehicle charging piles.

[0031] Among them, the charging pile parameters refer to the identity and key information obtained by the target charging pile during registration in the system, including the pile registration certificate and security private key, which can be used for subsequent authentication processes, such as the pile registration certificate and security private key.

[0032] Among them, the vehicle-charging-network platform refers to a trusted third-party platform that manages vehicles, charging piles, and power grid platforms in a unified manner. It can publish system public parameters and provide registration and verification services, such as the ECGIP platform.

[0033] Among them, the system public parameters refer to the publicly available cryptographic parameters released by the vehicle-charging network platform, including the platform's public key, which can be used by all participants to verify their identity and encrypt communication, such as elliptic curve parameters, base points, hash functions, etc.

[0034] Among them, the charging pile registration certificate refers to the identity certificate obtained by the target charging pile after registering on the vehicle-charging-network platform, which can prove its legal identity, such as registration timestamp and authentication index.

[0035] Among them, the security module refers to the protected hardware or software area in the target charging pile, which can securely store sensitive data, such as tamper-proof chips.

[0036] Among them, the security private key refers to the master private key of the target charging pile encapsulated in the security module, which can be used to generate signatures or authentication certificates, such as the system master private key α.

[0037] Among them, the platform public key refers to the public key published by the vehicle charging network platform, which can be used to verify data signed by the platform's private key.

[0038] This step involves obtaining the target charging pile's own charging pile parameters and the system's public parameters published by the vehicle-charging-network platform. This step provides the necessary identity credentials and public cryptographic parameters for subsequent two-level two-way authentication, ensuring a trustworthy foundation for the authentication process.

[0039] Step S104: Based on the charging pile parameters and the system common parameters, perform first-level two-way authentication between the target charging pile and the target vehicle to generate a vehicle-charging pile session key; and based on the charging pile parameters and the system common parameters, perform second-level two-way authentication between the target charging pile and the target power grid platform to generate a charging pile-grid session key.

[0040] The target vehicle refers to an electric vehicle or new energy vehicle that needs to be certified with the target charging station and is able to initiate a certification request, such as an electric vehicle.

[0041] The first level of two-way authentication refers to the process of mutual identity verification between the target charging pile and the target vehicle, which can ensure the legitimacy of both parties' identities, such as vehicle-charging pile authentication.

[0042] Among them, the vehicle-charging station session key refers to the key generated after the first-level two-way authentication is successful, which is used for encrypted communication and can protect the data transmission between the vehicle and the charging station.

[0043] The target power grid platform refers to the upper-level power grid management platform that needs to be authenticated with the target charging pile and is able to receive control commands, such as the power grid dispatch system.

[0044] The second level of two-way authentication refers to the process of mutual identity verification between the target charging pile and the target power grid platform, which can ensure the legitimacy of both parties' identities, such as pile-grid authentication.

[0045] Among them, the charging pile-grid session key refers to the key generated after successful second-level two-way authentication, which is used for encrypted communication and can protect the data transmission between the charging pile and the power grid platform.

[0046] In this step, based on the obtained charging pile parameters and system common parameters, the first-level two-way authentication between the charging pile and the vehicle, and the second-level two-way authentication between the charging pile and the power grid platform are performed respectively, and corresponding session keys are generated for each. Through this step, the hierarchical identity verification and encrypted channel establishment between the vehicle, charging pile, and grid entities are realized, solving the problem of fragmented multi-level authentication.

[0047] Step S106: After the first-level two-way authentication and the second-level two-way authentication are completed, a hierarchical control instruction is generated based on the target session key, wherein the target session key includes at least one of the following: the vehicle-to-pile session key, the pile-to-network session key;

[0048] Among them, hierarchical control commands refer to commands generated based on authenticated session keys for controlling different terminals, which can distinguish different levels of control permissions, such as authorized charging commands or vehicle-to-grid interaction commands.

[0049] The target session key refers to one or more keys selected from the generated vehicle-pile session keys and / or pile-network session keys, which can be used to generate hierarchical control instructions, such as vehicle-pile session keys or pile-network session keys.

[0050] In this step, after both levels of two-way authentication are completed, hierarchical control commands are generated based on the target session key (i.e., at least one generated session key). This step binds the authentication result to the command generation, ensuring that control commands can only be issued after valid authentication.

[0051] Step S108: Send hierarchical control instructions to the corresponding target terminal so that the target terminal performs the corresponding control, wherein the target terminal includes at least one of the following: target power grid platform, target vehicle.

[0052] The target terminal refers to the entity that receives hierarchical control commands. It can be a target power grid platform or a target vehicle, and it can perform corresponding control operations, such as a power grid platform or a vehicle.

[0053] The corresponding control refers to the specific operation performed according to the instructions, such as charging services or vehicle-to-grid interaction services, which can realize business functions.

[0054] In this step, the generated hierarchical control commands are sent to the corresponding target terminals (power grid platform or vehicle), thereby enabling the terminals to execute the corresponding control actions. This step achieves a closed loop from authentication to control, allowing the authentication results to directly impact business execution.

[0055] Through the above steps S102-S108, the charging pile parameters of the target charging pile and the system public parameters published by the vehicle-charging-network platform are obtained. The charging pile parameters include the charging pile registration certificate and the security private key encapsulated in the security module. The system public parameters include the platform public key. Based on the charging pile parameters and the system public parameters, the target charging pile and the target vehicle perform a first-level two-way authentication, generating a vehicle-charging-network session key. Based on the charging pile parameters and the system public parameters, the target charging pile and the target power grid platform perform a second-level two-way authentication, generating a charging-network session key. After both the first and second-level two-way authentications are completed, a hierarchical control command is generated based on the target session key. The target session key includes at least one of the following: a vehicle-charging-network session key and a charging-network session key. The hierarchical control command is sent to the corresponding target terminal to enable the target terminal to perform the corresponding control. The target terminal includes at least one of the following: a target power grid platform and a target vehicle. By employing a hierarchical two-way authentication and session key-based hierarchical control approach, the system generates vehicle-charging pile and charging pile-grid session keys and charging pile-grid session keys through first-level two-way authentication between the target charging pile and the target vehicle, and second-level two-way authentication between the target charging pile and the target power grid platform. Based on the target session keys, hierarchical control commands are generated and sent to the corresponding target terminals. This achieves the goal of unified authentication and hierarchical control for multiple entities at the vehicle, charging pile, and grid levels, thereby realizing the technical effect of integrated authentication and control and orderly establishment of trust relationships. Furthermore, it solves the technical problems of fragmented authentication relationships, inconsistent trust establishment methods, and trust vulnerabilities caused by the lack of a unified authentication mechanism for multi-level entities in vehicle-grid interaction in existing technologies.

[0056] As an optional embodiment, based on the charging pile parameters and system common parameters, the target charging pile and the target vehicle perform a first-level two-way authentication to generate a vehicle-charging pile session key. This includes: obtaining the vehicle-charging pile authentication request information sent by the target vehicle, wherein the vehicle-charging pile authentication request information includes an anonymous identity identifier temporarily assigned to the target vehicle by the vehicle-charging pile network platform, a vehicle temporary public key, and a registration auxiliary value. The vehicle temporary public key is determined based on the vehicle temporary private key generated by the target vehicle, and the registration auxiliary value represents the vehicle's legitimate registration identity; generating a charging pile-side authentication certificate based on the security private key and the charging pile temporary private key; and sending a first feedback message to the target vehicle so that the target vehicle verifies the charging pile-side authentication certificate based on the platform public key issued by the vehicle-charging pile network platform. If the verification passes, the identity of the target charging pile is confirmed as legitimate, and the vehicle... The system generates a vehicle-side authentication response using a temporary public key, a vehicle-side secret value, and a vehicle-side shared intermediate value. The first feedback information includes the charging pile authentication certificate and the charging pile's temporary public key. The vehicle-side shared intermediate value is determined based on the vehicle's temporary private key and the charging pile's temporary public key. The vehicle-side secret value is determined based on the registration auxiliary value and the anonymous identity identifier. The system receives the vehicle-side authentication response from the target vehicle, determines the first charging pile-side shared intermediate value based on the charging pile's temporary private key and the vehicle's temporary public key, and determines the charging pile-side secret value based on the registration auxiliary value and the anonymous identity identifier. The system verifies the vehicle-side authentication response using the anonymous identity identifier, the vehicle's temporary public key, the registration auxiliary value, the first charging pile-side shared intermediate value, and the charging pile-side secret value. If the verification passes, the target vehicle's identity is confirmed as legitimate, completing the first level of two-way authentication. Finally, the system determines the vehicle-charging pile session key based on the first charging pile-side shared intermediate value.

[0057] Among them, the vehicle-charging station authentication request information refers to the authentication message sent by the target vehicle to the charging station, which includes an anonymous identity identifier, a temporary public key and a registration auxiliary value, and can initiate the vehicle-charging station authentication process, such as message M1.

[0058] Among them, the anonymous identity identifier refers to the anonymous identity temporarily assigned to the target vehicle by the vehicle-charging-network platform, which can protect the privacy of the vehicle's real identity, for example... .

[0059] Among them, the vehicle's temporary public key refers to the public key generated by the target vehicle based on its temporary private key, which can be publicly used in authentication, for example... .

[0060] Among them, the registration auxiliary value refers to the parameters returned by the vehicle-charging network platform during vehicle registration. These parameters can be used to recover the vehicle-side secret value, indicating the vehicle's legitimate registration identity, for example... .

[0061] Among them, the vehicle's temporary private key refers to a temporary secret random number generated for the target vehicle, which can generate a temporary public key and a shared intermediate value, for example... .

[0062] Among them, the secure private key refers to the master private key encapsulated in the charging pile's security module, which can generate pile-side authentication proof, for example... .

[0063] Among them, the charging pile's temporary private key refers to the temporary secret random number generated for this authentication of the target charging pile, which can generate a temporary public key and a shared intermediate quantity, for example... .

[0064] Among them, the charging pile-side authentication certificate refers to the fact that the signature value generated by the charging pile based on the secure private key and the temporary private key can prove to the vehicle the legitimate authentication capability of the charging pile. For example, .

[0065] The first feedback information refers to the authentication response message returned by the charging pile to the target vehicle, which includes the charging pile-side authentication certificate and the charging pile's temporary public key, such as M2.

[0066] Among them, the platform public key refers to the public key published by the vehicle charging network platform, which can verify data signed by the platform's private key, such as Y.

[0067] Among them, the vehicle-side secret value refers to the secret parameters that the target vehicle recovers based on the registration auxiliary value and the anonymous identity identifier, which can participate in the generation of the vehicle-side authentication response, for example... .

[0068] Among them, the vehicle-side shared intermediate value refers to the Diffie-Hellman shared value calculated by the target vehicle based on the vehicle's temporary private key and the charging pile's temporary public key, which can be used to generate authentication responses and session keys, for example. .

[0069] Among them, the vehicle-side authentication response refers to the authentication certificate generated by the target vehicle, which can prove to the charging station that the vehicle holds a legitimate temporary private key, for example... .

[0070] Among them, the charging pile temporary public key refers to the public key generated by the charging pile based on the temporary private key, which can be publicly used in authentication, for example... .

[0071] The first shared intermediate value on the charging pile side refers to the shared value calculated by the charging pile based on its own temporary private key and the vehicle's temporary public key. This value is equal to the shared intermediate value on the vehicle side and can be used to verify the vehicle-side authentication response and derive the session key. For example... .

[0072] Among them, the charging pile-side secret value refers to the secret parameter recovered by the charging pile based on the registration auxiliary value and anonymous identity identifier. It is equal to the vehicle-side secret value and can be used to verify the vehicle-side authentication response. For example, .

[0073] Among them, the vehicle-charging station session key refers to the encryption key generated after successful first-level two-way authentication, which can protect the communication between the vehicle and the charging station, for example... .

[0074] In this embodiment, the charging pile receives an authentication request sent by the vehicle, which includes an anonymous identifier, a temporary public key, and a registration auxiliary value; the charging pile generates a pile-side authentication certificate using a secure private key and a temporary private key and returns a temporary public key; after the vehicle verifies the pile-side certificate, it restores the secret value, calculates the shared intermediate value, and generates an authentication response to return; the charging pile calculates the shared intermediate value, restores the secret value, and verifies the vehicle's response; after successful verification, both parties generate a session key based on the shared intermediate value.

[0075] This method achieves two-way authentication and session key negotiation between vehicles and charging stations, bringing multiple benefits: First, vehicles participate in authentication through anonymous identifiers, and their real identities are not transmitted over the network, effectively protecting user privacy. Simultaneously, the existence of a registration auxiliary value ensures that vehicles must register with the platform to complete authentication, preventing unauthorized vehicle access. Second, the shared intermediate quantity is calculated based on the Diffie-Hellman mechanism; both parties calculate and compare independently without transmitting the shared secret itself, avoiding the risk of secret leakage. Even if an attacker intercepts all public information (temporary public key, proof, response), they cannot deduce the temporary private key or the shared intermediate quantity, ensuring forward security. Third, the charging station-side authentication proof uses the master private key encapsulated in a security module, preventing attackers from forging proofs of legitimate charging stations and effectively preventing malicious charging stations from deceiving vehicles. Fourth, the vehicle-side authentication response is bound to the hash value and secret value of the shared intermediate quantity, ensuring that only vehicles possessing both the vehicle's temporary private key and legitimate registration information can generate the correct response, preventing replay attacks and impersonation attacks. Fifth, the session key derived after successful authentication can be used for encryption and integrity verification of subsequent charging service data, ensuring the confidentiality and authenticity of the vehicle-to-charging pile communication link. In summary, this embodiment provides a secure, anonymous, and traceable authentication mechanism for vehicle access in vehicle-to-grid interaction.

[0076] As an optional embodiment, based on the charging pile parameters and system common parameters, a second-level two-way authentication is performed between the target charging pile and the target power grid platform to generate a charging pile-grid session key. This includes: obtaining charging pile-grid authentication request information sent by the target power grid platform, wherein the charging pile-grid authentication request information includes the platform identity identifier of the target power grid platform, a platform temporary public key, and the platform temporary public key is determined based on the platform temporary private key generated by the target power grid platform; generating a charging pile-side authentication certificate based on the security private key and the charging pile temporary private key; determining a second charging pile-side shared intermediate quantity based on the charging pile temporary private key and the platform temporary public key; and sending second feedback information to the target power grid platform. The system enables the target power grid platform to verify the charging pile authentication certificate based on the platform public key Y issued by the vehicle-charging pile network platform. If the verification is successful, the identity of the target charging pile is confirmed as legitimate. Based on the second shared intermediate quantity of the charging pile side, a session key is determined. Based on the session key, a platform-side confirmation message is generated. The second feedback information includes the charging pile authentication certificate and the charging pile temporary public key. The system receives the platform-side confirmation message returned by the target power grid platform, determines the charging pile network session key based on the second shared intermediate quantity of the charging pile side, and verifies the platform-side confirmation message based on the charging pile network session key. If the verification is successful, the identity of the target power grid platform is confirmed as legitimate, thus completing the second level of two-way authentication.

[0077] Among them, the charging pile authentication request information refers to the authentication message sent by the target power grid platform to the charging pile, which includes the platform identity identifier and the platform temporary public key, and can initiate the charging pile-to-grid authentication process, such as message N1.

[0078] Among them, the platform identity identifier refers to the unique identifier of the target power grid platform in the system, which can distinguish different platform entities, for example... .

[0079] Among them, the platform's temporary public key refers to the public key generated by the target power grid platform based on its temporary private key, which can be publicly used in authentication, for example... .

[0080] Among them, the platform's temporary private key refers to the temporary secret random number generated by the target power grid platform for this authentication, which can generate a temporary public key and a shared intermediate quantity, for example... .

[0081] Among them, the security private key refers to the master private key encapsulated in the charging pile security module, which can generate pile-side authentication proof.

[0082] Among them, the charging pile's temporary private key refers to the temporary secret random number generated for this authentication of the target charging pile, which can generate a temporary public key and a shared intermediate quantity, for example... .

[0083] Among them, the charging pile-side authentication certificate refers to the ability of the charging pile to prove its legitimate authentication capability to the power grid platform based on the signature value generated by the charging pile using a secure private key and a temporary private key. For example, .

[0084] The second shared intermediate value on the charging pile side refers to the shared value calculated by the charging pile based on its own temporary private key and the platform's temporary public key, which can be used to derive session keys, for example... .

[0085] The second feedback information refers to the authentication response message returned by the charging pile to the target power grid platform, which includes the pile-side authentication certificate and the charging pile's temporary public key, such as message N2.

[0086] Among them, the platform public key Y refers to the public key published by the vehicle charging network platform, which can verify data signed by the platform's private key.

[0087] Among them, the session key refers to the encryption key derived by the power grid platform based on the shared intermediate quantity of the second pile side. It is equal to the pile-grid session key calculated by the charging pile and can protect communication.

[0088] Among them, the platform-side confirmation message refers to the confirmation message returned by the target power grid platform after verifying the identity of the pile side. It contains security parameters generated based on the session key and can complete two-way authentication, such as message N3.

[0089] Among them, the charging pile temporary public key refers to the public key generated by the charging pile based on the temporary private key, which can be used publicly in authentication.

[0090] Among them, the charging pile-grid session key refers to the encryption key generated after successful second-level two-way authentication, which can protect the communication between the charging pile and the power grid platform, for example... .

[0091] In this embodiment, the charging pile receives an authentication request from the power grid platform, which includes the platform's identity identifier and a temporary public key. The charging pile generates a pile-side authentication certificate using its secure private key and temporary private key, and calculates a shared intermediate quantity based on its own temporary private key and the platform's temporary public key. The charging pile returns the certificate and temporary public key to the power grid platform. After verifying the pile-side certificate with its platform public key, the power grid platform derives a session key based on the shared intermediate quantity and returns a confirmation message. The charging pile derives the same session key based on the shared intermediate quantity and verifies the platform's confirmation message. Upon successful verification, two-way authentication is completed.

[0092] This method achieves two-way authentication and session key negotiation between charging piles and the power grid platform, resulting in the following significant benefits: First, the authentication proof of the charging pile utilizes a master private key encapsulated in a security module. This master private key is securely written by the vehicle-charging-network platform during registration and cannot be obtained externally. Therefore, only legitimate charging piles can generate valid proofs. The power grid platform can verify the identity of the charging pile through platform public key verification, effectively preventing unauthorized charging piles from accessing the power grid. Second, the shared intermediate quantity is calculated based on the temporary private keys of both parties and the other party's temporary public key, without the need to transmit key materials. Attackers cannot deduce the shared secret from publicly available information. Simultaneously, each authentication uses a new temporary private key, ensuring forward security of the session key; that is, even if the private key is leaked long-term, past session keys remain secure. Third, the power grid platform binds the session key to the authentication process through confirmation messages. The charging pile verifies the confirmation message to ensure that the other party has indeed derived the same session key, thus completing two-way confirmation and avoiding man-in-the-middle attacks. Fourth, after the authentication process is completed, a secure encrypted channel is established between the charging pile and the power grid platform. Subsequently, the power grid platform can issue load control commands and demand response strategies to the charging pile, and the charging pile can securely report status data and billing information. These interactions are all protected by session keys, preventing eavesdropping and tampering. Fifth, the entire authentication process is independent of vehicle-charging pile authentication, which conforms to the hierarchical design concept. Depending on business needs, it is possible to choose to perform only vehicle-charging pile authentication or simultaneously perform charging pile-grid authentication, flexibly adapting to different security level scenarios.

[0093] As an optional embodiment, generating a charging pile-side authentication certificate based on the security private key and the charging pile temporary private key includes: verifying whether the vehicle-side timestamp generated by the target vehicle is satisfied with a first valid time window when the vehicle-charging pile authentication request information also includes a vehicle-side timestamp generated by the target vehicle; generating a first charging pile-side timestamp when the first valid time window is satisfied; and generating a charging pile-side authentication certificate based on the security private key, the charging pile temporary private key, and the first charging pile-side timestamp.

[0094] Among them, the vehicle-side timestamp refers to the time recorded when the target vehicle sends the authentication request, which can be used to prevent replay attacks, such as t1.

[0095] The first effective time window refers to the upper limit of the time difference allowed by the system, which can verify the freshness of the message, such as ΔT.

[0096] The first charging pile-side timestamp refers to the time recorded when the charging pile generates the certification certificate, which can be bound to the certificate, for example, t2.

[0097] In this embodiment, if the vehicle-to-charging-pile authentication request information also includes a vehicle-side timestamp, the charging pile first verifies whether the timestamp is within the valid window; if it passes, the charging pile generates its own pile-side timestamp and generates a pile-side authentication certificate based on the security private key, the charging pile temporary private key, and the pile-side timestamp.

[0098] This approach adds timestamp verification and binding to the original authentication, bringing additional security benefits: First, by verifying the vehicle-side timestamp, the charging pile can determine whether the authentication request was recently sent. If the timestamp exceeds the allowed window, the request is directly rejected, effectively preventing attackers from intercepting old requests for replay attacks. Second, the charging pile not only verifies the timestamp but also incorporates its own generated timestamp into the calculation of the authentication proof, ensuring that each proof is associated with the specific time of the current authentication session. Even if an attacker intercepts an authentication proof, it cannot be reused at other times because the new timestamp will cause the verification to fail. Furthermore, the combination of timestamps from both parties makes the authentication process non-repudiable in the time dimension, facilitating post-event auditing. This embodiment significantly enhances the replay resistance and timeliness of the vehicle-to-charging pile authentication protocol, making it particularly suitable for scenarios with frequent authentication and high-speed movement in vehicle-to-grid interactions, effectively ensuring the freshness of authentication messages.

[0099] As an optional embodiment, a charging pile-side authentication certificate is generated based on the secure private key and the charging pile's temporary private key. This includes: if the charging pile authentication request information also includes a platform-side timestamp and authentication verification value generated by the target power grid platform, verifying whether the platform-side timestamp meets the validity of the second valid time window. The authentication verification value is determined based on the platform identity identifier, the platform's temporary public key, the platform registration timestamp, the platform-side timestamp, and the authentication index, and the authentication index is obtained based on the secure private key. If the second valid time window is met, the authentication verification value is verified based on the secure private key to complete the verification of the target power grid platform's identity. If the verification passes, a second charging pile-side timestamp is generated. A charging pile-side authentication certificate is generated based on the secure private key, the charging pile's temporary private key, and the second charging pile-side timestamp.

[0100] Among them, the platform-side timestamp refers to the time recorded by the target power grid platform when sending the authentication request, which can be used to prevent replay attacks, such as t4.

[0101] The second effective time window refers to the upper limit of the time difference allowed by the system, which can verify the freshness of the message.

[0102] The authentication verification value refers to the hash value calculated by the target power grid platform based on the platform's identity identifier, platform temporary public key, platform registration timestamp, platform-side timestamp, and authentication index. This hash value can be used to verify the legitimacy of the power grid platform's identity. For example... .

[0103] Among them, the platform registration timestamp refers to the time stamp obtained by the power grid platform during registration, which can be bound to the registration status, for example... .

[0104] The authentication index refers to the index value calculated by the vehicle-charging-network platform based on information such as the security private key and platform identity. It can be used to generate authentication verification values, for example... .

[0105] The second charging pile-side timestamp refers to the time recorded when the charging pile generates the certification certificate, which can be bound to the certificate, such as t5.

[0106] In this embodiment, if the charging pile authentication request information also includes a platform-side timestamp and an authentication verification value, the charging pile first verifies whether the platform-side timestamp is within the valid window. After passing the verification, the charging pile recalculates the authentication index using its own secure private key, and then verifies whether the authentication verification value is correct (i.e., verifies the identity of the power grid platform). After the verification is passed, the charging pile generates its own charging pile-side timestamp and generates a charging pile-side authentication certificate based on the secure private key, the charging pile temporary private key, and the charging pile-side timestamp.

[0107] This method achieves strong verification and timeliness protection of the power grid platform's identity, bringing several beneficial effects: First, the authentication verification value is generated based on the authentication index derived from the secure private key. Charging piles can recalculate the authentication index and verify the value using the same secure private key in their own security module, thus confirming whether the power grid platform holds the correct secure private key information—that is, the power grid platform must be a legitimate entity registered with the vehicle-charging-grid platform. This shared secret-based verification method avoids the complex calculations of asymmetric cryptography, resulting in higher efficiency. Second, the introduction of platform-side timestamps ensures the freshness of authentication requests, preventing attackers from intercepting and replaying old authentication request messages. Once a charging pile detects that the timestamp exceeds the valid window, it immediately terminates authentication, saving subsequent computational resources. Third, the charging pile also binds its own generated pile-side timestamp to its authentication proof, which the power grid platform can subsequently verify, forming a two-way freshness guarantee. Fourth, this embodiment organically combines identity verification (authentication verification value) with timeliness protection (timestamp), solving both the "who is the other party?" and "is the message up-to-date?" problems, significantly enhancing the security of the charging pile-grid authentication protocol. Fifth, through this embodiment, the charging pile can verify the identity of the power grid platform without directly interacting with the vehicle-charging-grid platform (because the security private key has been pre-set during registration), reducing communication rounds and latency, and improving authentication efficiency.

[0108] As an optional embodiment, before obtaining the charging pile parameters of the target charging pile, the method further includes: sending charging pile registration request information to the vehicle-charging-pile network platform, so that the vehicle-charging-pile network platform generates a registration timestamp and authentication index based on the real identity identifier, and encapsulates the security private key into the security module of the target charging pile, wherein the charging pile registration request information includes the real identity identifier of the target charging pile; and receiving registration confirmation information sent by the vehicle-charging-pile network platform, wherein the registration confirmation information includes the authentication index and the registration timestamp.

[0109] Among them, the charging pile registration request information refers to the registration message sent by the target charging pile to the vehicle-charging-network platform, which contains real identity information and can initiate the registration process.

[0110] Among them, the real identity identifier refers to the real identity information of the charging pile, which can be used for real-name registration and subsequent identity tracing.

[0111] The registration timestamp refers to the time stamp generated by the vehicle-charging-pile network platform when a charging pile registers, which records the registration time and validity period. For example... .

[0112] The authentication index refers to the index value calculated by the vehicle-charging network platform based on the real identity identifier, security private key, and registration timestamp. This index value can be used for identity verification in subsequent authentication processes. .

[0113] The registration confirmation information refers to the registration result returned to the charging pile by the vehicle-charging-pile network platform. It includes the authentication index and registration timestamp, which can be used as a registration certificate for the charging pile.

[0114] In this embodiment, before obtaining the charging pile parameters, the charging pile first sends a registration request containing a real identity identifier to the vehicle-charging-pile network platform; the vehicle-charging-pile network platform generates a registration timestamp and authentication index based on the real identity, and encapsulates the system security private key into the charging pile's security module; finally, the charging pile receives the returned registration confirmation information.

[0115] Through this method, charging piles complete real-name registration, obtaining legitimate pile-side registration credentials and secure private keys. The benefits are as follows: First, real-name registration ensures the traceability of each charging pile's identity. In the event of abnormal behavior or a safety incident, the platform can trace the responsible entity based on the registration information. Second, the secure private key is encapsulated in the charging pile's security module, preventing direct external reading or export. Even if the charging pile is physically attacked or compromised by malware, attackers cannot obtain the private key, thus ensuring the unforgeability of the pile-side authentication proof in subsequent authentication processes. Third, the registration timestamp and authentication index serve as registration credentials, used in subsequent vehicle-to-pile and pile-to-network authentication to calculate authentication proofs or verification values, binding each authentication to registration information and preventing unregistered or deregistered charging piles from participating in the system. Fourth, this registration process is independent of the authentication process; charging piles only need to register once for long-term use, reducing authentication latency and computational overhead. Fifth, through this embodiment, the vehicle-pile-network platform maintains a list of charging pile registration statuses, enabling dynamic management of charging pile legitimacy and providing the system with flexible identity lifecycle management capabilities.

[0116] As an optional embodiment, before obtaining the charging pile parameters of the target charging pile, the method further includes: obtaining a vehicle registration completion notification sent by the vehicle-charging-pile network platform, wherein the vehicle registration completion notification indicates that the vehicle-charging-pile network platform has generated an anonymous identity identifier and a registration auxiliary value for the target vehicle based on the real identity identifier of the target vehicle, and recorded the mapping relationship between the real identity identifier and the anonymous identity identifier.

[0117] The vehicle registration completion notification refers to a notification message sent by the vehicle-charging-pile network platform to the charging pile (or other entity), indicating that the vehicle has been registered and that the vehicle's identity has been verified by the platform.

[0118] Among them, the real identity identifier refers to the vehicle's real identity information, which can be used for post-event traceability, for example... .

[0119] Among them, the anonymous identity identifier refers to the anonymous identity temporarily assigned to the target vehicle by the vehicle-charging-network platform, which can protect vehicle privacy, for example... .

[0120] The mapping relationship refers to the corresponding record between real identity identifiers and anonymous identity identifiers, which can meet the dual requirements of anonymity and traceability.

[0121] In this embodiment, before obtaining the charging pile parameters, the charging pile obtains a vehicle registration completion notification sent by the vehicle-charging-network platform. This notification indicates that the platform has generated an anonymous identity identifier and registration auxiliary value for the vehicle based on its real identity, and recorded the mapping relationship between the real identity and the anonymous identity.

[0122] This method allows charging stations to know the legal registration status of vehicles in advance, providing a trust basis for subsequent vehicle-to-charging station authentication. Specific benefits include: First, vehicles use anonymous identifiers for vehicle-to-charging station authentication, preventing their real identities from being exposed in vehicle-to-charging station communication, effectively protecting vehicle owner privacy and preventing location tracking and identity-linking attacks. Second, the vehicle-charging station platform maintains the mapping relationship between real identities and anonymous identifiers. In the event of an accident or when evidence needs to be collected, the platform can trace back to the real vehicle based on the anonymous identifier, meeting the needs of supervision and legal liability determination, achieving the goal of "anonymity without exemption from liability." Third, the existence of registration auxiliary values ​​allows the secret value bound during vehicle registration to be recovered during vehicle-to-charging station authentication, thus strongly associating each authentication with the initial registration and preventing unregistered vehicles from forging legal identities. Fourth, after receiving this notification, charging stations can cache the vehicle's anonymous identifier and auxiliary value (or related status) locally, quickly performing preliminary screening when a vehicle initiates authentication, improving authentication efficiency. Fifth, this notification mechanism achieves status synchronization between the platform and charging stations, enabling charging stations to dynamically obtain the latest registered vehicle information, which is beneficial for system expansion and large-scale deployment. In summary, this embodiment cleverly balances the dual needs of privacy protection and security supervision, and is a key support for vehicle-side identity management in a hierarchical authentication system.

[0123] Based on the above embodiments and optional embodiments, an optional implementation method is provided, which is described in detail below.

[0124] This invention proposes a vehicle-to-grid (ECGIP) hierarchical authentication method for vehicle-to-grid (V2G) interaction. Addressing the multi-level business interaction links comprised of the vehicle side, the charging pile side, and the power grid platform side, it introduces an independent and trusted integrated vehicle-to-grid platform as a unified management entity. Through system parameter initialization, multi-entity registration and verification, and vehicle-to-grid and charging pile-to-grid authentication steps, it progressively completes the identity verification and session key establishment between different business entities, thereby improving access security, authentication orderliness, and business collaboration reliability during V2G interaction. An optional implementation of this invention introduces an independent and trusted integrated vehicle-to-grid platform (ECGIP) to construct a mechanism of registration verification followed by hierarchical authentication. This enables the vehicle side, charging pile side, and power grid platform side to progressively complete identity verification and secure session establishment according to the actual business interaction path, improving the security and business adaptability of the V2G interaction system in open network environments. Figure 2 This is a schematic diagram of a vehicle-charging station-network hierarchical authentication method for vehicle-network interaction provided by an optional embodiment of the present invention. Figure 3 This is a schematic diagram of the vehicle-pile-network hierarchical system provided by an optional embodiment of the present invention, such as... Figure 2-3 As shown, it will be introduced below:

[0125] (1) This invention sets the vehicle-to-grid interaction system as a structure of "three-level business entities + independent trusted platform". Specifically, the vehicle side, the charging pile side, and the power grid platform side undertake different levels of business functions. The vehicle-charging pile-grid integrated platform provides unified trusted management and verification support for the three levels from outside the system, enabling the entities at each level to establish verifiable and manageable trust relationships in an open network environment. During system operation, the registration and verification between the entities at each level and the vehicle-charging pile-grid integrated platform must be completed first. The vehicle side obtains the basic credentials for legal access to the system by submitting registration information. After completing the platform registration, the charging pile side is qualified to participate in subsequent interactions as an intermediate authentication and business forwarding node. The power grid platform side also needs to be registered and confirmed by the integrated platform to ensure its legitimate identity in global scheduling and business management.

[0126] (2) After registration verification is completed, further hierarchical authentication is performed between the vehicle side, the charging pile side, and the power grid platform side. That is, based on the interaction relationship between different levels of subjects in the business link, the legitimacy of the identity is confirmed and a secure session is established. Among them, "vehicle-charging pile authentication" is performed between the vehicle side and the charging pile side. Its purpose is to verify the authenticity of the vehicle access request and the legitimacy of the charging pile service node, so as to ensure that the vehicle can establish a trusted communication relationship with the nearest charging pile side. After that, "charging pile-network authentication" is performed between the charging pile side and the power grid platform side to realize identity confirmation, message verification, and business collaboration support between the two parties. Through this authentication method that proceeds step by step according to the subject level, the system authentication process can better fit the actual communication path and business organizational structure.

[0127] The following is a detailed introduction:

[0128] S1, System parameter initialization phase:

[0129] This application targets vehicle-to-grid (V2G) scenarios and constructs a hierarchical collaborative system consisting of the vehicle side, the charging pile side, the power grid platform side, and the EV-Charger-Grid Integrated Platform (ECGIP). The vehicle side, the charging pile side, and the power grid platform side constitute three levels in the business interaction link, corresponding to different functional roles such as terminal access, edge support, and platform control, respectively. The ECGIP, independent of the aforementioned three business entities, serves as a globally trusted management entity, providing unified registration, verification, and management support for system operation.

[0130] The vehicle side primarily consists of electric vehicles, plug-in hybrid electric vehicles, and other new energy terminals capable of accessing vehicle-to-grid (V2G) interactive services, serving as the service initiator and data source within the system. The charging pile side mainly comprises charging piles, station-level gateways, edge communication gateways, and other edge devices deployed on the access side, acting as a crucial intermediate layer connecting the vehicle side and the power grid platform. The charging pile side possesses certain edge computing and caching capabilities, enabling preliminary processing and verification of locally collected session information and status data. The power grid side primarily refers to the upper-level platform entity responsible for scheduling analysis, resource aggregation, and business decision-making. It gathers operational information from multiple charging pile nodes and, combined with service requirements, conducts comprehensive analysis and strategy generation for the charging and discharging behavior of the vehicle group. ECGIP, as the only trusted management entity in the system, is responsible for basic support functions such as global identity management, registration initialization, and parameter distribution. While it does not directly participate in every real-time business interaction, it establishes initial trust relationships for all participants in the system. Therefore, the vehicle side, charging pile side, and power grid platform side all need to complete registration and verification with the integrated vehicle-charging-grid platform to obtain the legal identity identifiers and relevant authentication information required for subsequent system interactions.

[0131] In this application, the vehicle-side, pile-side, and power grid platform-side are all considered "honest and curious" entities, while ECGIP is a fully trusted entity. "Honest and curious" means that these entities, during protocol execution, can complete registration, authentication, and information exchange according to the established process, without actively disrupting the protocol's operation. However, they may attempt to further infer the privacy information and content of other entities based on the legitimate messages, parameters, or intermediate results they encounter. In contrast, ECGIP is considered the root trusted entity in the system, reliably completing identity registration and parameter distribution for various entities, without disclosing its known mapping relationships and management information, and without deviating from protocol requirements to engage in malicious operations.

[0132] Before proceeding with the registration and verification process, ECGIP needs to initialize system parameters. This initialization is to build the cryptographic foundation for subsequent registration, verification, and tiered authentication, and to establish an identity management structure corresponding to different levels of business entities. The specific process is as follows:

[0133] 1) ECGIP selects a sufficiently large prime number. and in a finite field Generate a safe elliptic curve :

[0134]

[0135] in x: The x-coordinate of a point on the elliptic curve, a variable. y: The y-coordinate of a point on the elliptic curve, a variable. u: A coefficient (constant) in the equation of the elliptic curve. v: Another coefficient (constant) in the equation of the elliptic curve.

[0136] And satisfy

[0137]

[0138] Subsequently, in the curve group Select a base point A prime number of order large can be generated from this base point. Cyclic addition group .

[0139] 2) To support registration mapping and subsequent identity index calculation, ECGIP pre-configures three secure hash functions:

[0140]

[0141] in, Used for mapping identity-related parameters. Used for authentication verification calculations. Used for binding session keys or verification parameters, so that they can be called separately in the subsequent registration and authentication phases.

[0142] 3) Initialize the three types of private lists in ECGIP , and These correspond to registration management information on the vehicle side, the pile side, and the power grid platform side, respectively. Among them:

[0143]

[0144] Used to record vehicle side entities true identity Temporary identifiers or pseudonyms Registration timestamp and current status In this invention, it is recorded This indicates that the entity is in a legally active state. This indicates that the entity has been revoked or frozen. It should be noted that the letter with the corresponding entity in the lower right corner represents the data of the corresponding entity, which will not be elaborated here.

[0145]

[0146] Used to record pile side entities Identity identifier Authentication Index Registration timestamp and status information ;

[0147]

[0148] Used to record the physical entity on the power grid platform. Identity identifier Authentication Index Registration timestamp and status information All three lists are maintained independently by ECGIP and are not disclosed to the vehicle side, pile side, or grid platform side. Its main function is to maintain the mapping between the vehicle's real identity and temporary identification, in order to meet the needs of both anonymous vehicle participation and post-event traceability. and It is used to maintain the legal registration status of the pile side and the power grid platform side, supporting the subsequent vehicle-pile authentication and pile-grid authentication steps.

[0149] 4) ECGIP provides unified and verifiable public parameters for all legitimate participating entities within the system, while retaining exclusive root key information to support subsequent registration verification and authentication interactions between entities at all levels. (From a limited domain) A master private key is randomly selected from the data. and based on the base point Calculate the corresponding platform public key .in, It is kept privately by ECGIP and used as the system root key. It is disclosed to other entities within the system as one of the publicly available verification parameters.

[0150] 5) ECGIP Publishing System Common Parameter Set :

[0151]

[0152] in This is the valid time window allowed by the system, used for timeliness verification in subsequent authentication stages. It is a prime number. All vehicle-side entities in the system. Pile side entity and grid platform side entity Before participating in the registration verification, you must obtain this set of public parameters. ECGIP preserves a private set of state that is only visible locally. This ensures that the vehicle side, the pile side, and the power grid platform side can execute subsequent protocol processes based on consistent common parameters.

[0153] S2, Registration Verification Phase:

[0154] ECGIP Release Afterwards, the vehicle side entity Pile side entity and the physical entity of the power grid platform All vehicles must submit a registration application to ECGIP to obtain the legal identity parameters and registration credentials required for subsequent tiered certification. Upon completion of registration, the vehicle will receive a temporary identification tag. Certification indexes were obtained for both the pile side and the power grid platform side. and Meanwhile, ECGIP will be held separately in and The corresponding registration record is written into the database. The specific process is as follows:

[0155] a) Vehicle registration:

[0156] 1) Vehicle side entity Select a random number , Identify the integer multiplication group modulo q, and calculate and temporary signs and will register the message Send to ECGIP.

[0157] 2) ECGIP received After sending the registration message, randomly select ,calculate , and verification quantity and for the entity Generate registration timestamp Set its state to Then, the corresponding registration record is written to the private list. ,Right now:

[0158]

[0159] Finally, ECGIP will Return to entity .

[0160] 3) Entity After receiving the registration result from ECGIP, save it locally. This serves as the basis for subsequent vehicle-charging station certification. ECGIP will be deleted upon expiration. The expired registration item corresponding to the vehicle-side entity is removed, and the auxiliary verification information associated with that registration item is invalidated. If the vehicle-side entity... If continued participation in system interaction is required, a new registration request must be submitted to ECGIP. Upon receiving the new registration request, ECGIP will refresh the existing registration status and re-register. Thus, the vehicle-side entity within the system... As a temporary identifier used externally, ECGIP participates in subsequent interactions, and through... Maintaining the mapping relationship between the vehicle's real identity and the temporary identifier ensures both anonymity and traceability.

[0161] b) Pile side registration:

[0162] Pile side entity As an intermediate node connecting the vehicle side and the power grid platform side, it does not involve the same level of anonymization requirements as the vehicle side. Therefore, its registration process adopts a real-name registration method, and the specific process is as follows:

[0163] 1) Pile side structure Submit its true identity to ECGIP To initiate a registration request.

[0164] 2) ECGIP receives the pile side entity After receiving the registration request, generate a registration timestamp for it. Calculate the corresponding authentication index and set its state to Then the pile side registration record is written to the private list. :

[0165]

[0166] 3) After registration is complete, ECGIP will securely write the system master private key. Encapsulated into the pile side entity This is stored in the protected security module for subsequent authentication operations. Calculations are only allowed within the pile-side safety module; its specific values ​​cannot be directly read or exported from outside.

[0167] 4) ECGIP can confirm the registration information on the pile side. Return to pile side entity This will serve as the registration basis for their subsequent participation in vehicle-pile certification and pile-network certification.

[0168] After the above steps, the entity Complete real-name registration and obtain a legally certified status under the management of ECGIP. Among these, It is mainly used to maintain the identity index, registration time, and status information of pile-side entities, while in the security module This is then used to support subsequent authentication calculations.

[0169] c) Registration on the power grid platform:

[0170] Entity of power grid platform As the upper-level business management and control node in the system, it mainly undertakes functions such as information aggregation, analysis, and interaction requests from multiple pile-side nodes. Because it has a clear platform identity within the system and does not involve the same level of anonymization requirements as the vehicle-side nodes, its registration process also adopts a real-name registration method, i.e., entity registration. Submit its true identity to ECGIP And complete the registration. When When registration information needs to be updated, ECGIP can regenerate a new registration timestamp. ,calculate And for the private list The corresponding registration items are updated synchronously to ensure the validity of their subsequent authentication status.

[0171] S3, Certification Phase:

[0172] After completing the registration of each entity, the entity , as well as Each entity holds local authentication information corresponding to its identity. To meet the secure access requirements between different levels of business entities in the vehicle-to-grid interaction system, a hierarchical authentication mechanism is designed, including vehicle-to-grid authentication and grid-to-network authentication. Both authentication processes use timestamps and random numbers as security measures, and a session key is negotiated and generated after successful authentication for the confidential transmission and integrity protection of subsequent business data. If the timestamp received by either party does not meet the valid time window... If the current certification process fails, the current certification process will be terminated immediately.

[0173] a) Vehicle-to-Charging Station Certification:

[0174] The goal of vehicle-to-charging station authentication is to avoid revealing the true identity of the vehicle. Under the premise of realizing the vehicle side entity With pile side body Two-way identity verification between entities, and negotiation to generate session keys. Utilizing the local information it saves during the registration phase Towards the pile side entity Initiate an authentication request and negotiate the generation of a session key with the successful authentication.

[0175] 1) Vehicle side initiates authentication request: Entity Based on locally saved random numbers Recalculate And record the current timestamp Subsequently, towards the pile side entity. Send authentication request message:

[0176]

[0177] 2) Pile-side return authentication information: entity Received message After that, verify ,in express The local time at the time the message was received. If the timeliness check passes, then... Random selection And record the current timestamp ,calculate Meanwhile, to demonstrate to the vehicle side that the pile side possesses the legitimate authentication capability encapsulated and written by ECGIP, Based on the master private key Generate authentication certificate:

[0178]

[0179]

[0180] Subsequently, Towards Return message

[0181] 3) Verify the vehicle-side pile and return the response: entity Received message Next, verify whether the timestamp meets the valid window requirement; if it does, then use the ECGIP public key. Verify the pile side evidence:

[0182]

[0183] If the above formula is true, then it means It possesses legitimate authentication capabilities, and its identity is accepted by the vehicle manufacturer. Subsequently... Calculate shared intermediate quantities And restored by the registered auxiliary value. Subsequently, the vehicle-side authentication response is calculated. .at last, Towards Send response message .

[0184] 4) Verify the legality of the vehicle side at the pile side: pile side entity Received message Then, first verify If successful, then based on the received... calculate And restore Then verify If this formula holds true, it indicates that the vehicle side entity... Holding and Corresponding legitimate local private This completes the vehicle-side identity authentication.

[0185] 5) Session Key Negotiation: After both parties complete the above verification, the vehicle side and the pile side respectively calculate the session key. ,because Therefore, both parties can obtain a consistent session key. It will be used for the encryption and verification of subsequent information exchanged between the vehicle side and the pile side.

[0186] b) Pile-Network Authentication:

[0187] After completing vehicle-pile certification, the pile-side entity It also needs to be connected with the power grid platform side entity Establish a trusted connection to support subsequent interactive requests and status feedback. Since both the pile side and the grid platform side adopt real-name registration, the focus of pile-grid authentication is to verify the legitimacy of the registered identities of both parties and to further negotiate and generate a session key between the pile side and the grid platform side.

[0188] 1) Power grid platform side Initiating an authentication request: Entity Random selection Record the current timestamp and calculate Subsequently, Utilizing the authentication index obtained during its registration phase Calculate authentication verification and towards the pile side entity Send authentication request message .

[0189] 2) Verify the power grid platform side at the pile side and return the response: entity Received message Then, first verify If successful, the master private key in the protected security module will be invoked. Recalculate based on the identity of the power grid platform. And verify If the above formula is true, then it means... It is a legally registered power grid platform entity.

[0190] Subsequently, the pile side body Random selection Record the current timestamp ,calculate and intermediate quantities Simultaneously, the pile side generates its own certification:

[0191]

[0192]

[0193] And further calculate the authentication verification value:

[0194]

[0195] at last, Towards Send response message

[0196] 3) Verify and confirm the pile side on the power grid platform side: physical entity Received message Next, the validity of the timestamp is verified; if it passes, the ECGIP public key is used. Verification of the pile side evidence: If the above formula holds true, it indicates that the pile side structure is solid. It possesses legitimate authentication capabilities. Subsequently... calculate And verify:

[0197]

[0198] If the verification passes, the power grid platform accepts the identity of the pile side and further calculates the session key:

[0199]

[0200] Then, record the current timestamp. To notify that pile side certification has been completed, Generate confirmation value And send a confirmation message

[0201] 4) Confirmation completed on the pile side and session key established: Entity Received message Afterwards, verification If it passes, then calculate:

[0202]

[0203] And further verification:

[0204]

[0205] If the above formula holds true, it indicates that the power grid platform has successfully completed the verification of the pile side, and both parties have finally established a consistent session key. .because Therefore, the pile side and the power grid platform side can obtain the same session key, which is used for the secure transmission of subsequent interaction requests, control information and status data between the pile side and the power grid platform side.

[0206] The above optional implementation methods can achieve at least the following beneficial effects:

[0207] (1) A vehicle-pile-network hierarchical authentication method for vehicle-network interaction is proposed. An authentication system consisting of vehicle side, pile side, power grid platform side and independent and trusted vehicle-pile-network integrated platform (ECGIP) is constructed. It can better fit the actual communication link from terminal access, edge support to platform control in vehicle-network interaction business, and make the system authentication process more consistent with the business organization structure, with strong scenario adaptability.

[0208] (2) The implementation approach of registration verification followed by hierarchical authentication is adopted. The system parameter initialization, identity registration and trusted support are completed by ECGIP. Then, identity confirmation and security session establishment are completed step by step according to the actual interaction relationship between the vehicle side and the pile side, and between the pile side and the power grid platform side. This avoids the complexity caused by direct and disordered authentication by multiple subjects and helps to improve the clarity and feasibility of the authentication process.

[0209] (3) Differentiated authentication mechanisms are designed to meet the identity requirements of different business entities. Vehicles participate in subsequent interactions through temporary identifiers, achieving legitimate access without exposing their real identities, thus balancing anonymity and traceability. The pile side and the power grid platform side adopt real-name registration, which helps to ensure the clarity of the identities of intermediate support nodes and upper-level management nodes. At the same time, the authentication process combines random numbers, timestamps, and session key negotiation mechanisms to further improve the security and reliability of subsequent business data transmission.

[0210] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0211] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods of the various embodiments of the present invention.

[0212] Example 2

[0213] According to embodiments of the present invention, an apparatus for implementing the above-described vehicle-charging station network authentication and control method is also provided. Figure 4 This is a structural block diagram of the vehicle-charging station network authentication and control device according to an embodiment of the present invention, such as... Figure 4 As shown, the device includes: an acquisition module 402, an execution module 404, a generation module 406, and a sending module 408. The device will be described in detail below.

[0214] The acquisition module 402 is used to acquire the charging pile parameters of the target charging pile and the system public parameters published by the vehicle-charging pile network platform. The charging pile parameters include the charging pile registration certificate and the security private key encapsulated in the security module. The system public parameters include the platform public key. The execution module 404, connected to the acquisition module 402, is used to perform first-level two-way authentication between the target charging pile and the target vehicle based on the charging pile parameters and the system public parameters, generating a vehicle-charging pile session key. It also performs second-level two-way authentication between the target charging pile and the target power grid platform based on the charging pile parameters and the system public parameters, generating a charging pile-network session key. The generation module 406, connected to the execution module 404, is used to generate hierarchical control instructions based on the target session key after both the first-level and second-level two-way authentications are completed. The target session key includes at least one of the following: a vehicle-charging pile session key and a charging pile-network session key. The sending module 408, connected to the generation module 406, is used to send hierarchical control instructions to the corresponding target terminal so that the target terminal performs the corresponding control. The target terminal includes at least one of the following: a target power grid platform and a target vehicle.

[0215] It should be noted that the above-mentioned acquisition module 402, execution module 404, generation module 406 and sending module 408 correspond to steps S102 to S108 in the authentication and control method of the vehicle-charging network. The multiple modules and the corresponding steps implement the same instances and application scenarios, but are not limited to the content disclosed in the above embodiment 1.

[0216] Example 3

[0217] According to another aspect of the present invention, an electronic device is also provided, comprising: a processor; and a memory for storing processor-executable instructions, wherein the processor is configured to execute instructions to implement the vehicle-charging network authentication and control method of any of the above embodiments.

[0218] Example 4

[0219] According to another aspect of the present invention, a computer-readable storage medium is also provided, which, when the instructions in the computer-readable storage medium are executed by a processor of an electronic device, enables the electronic device to perform the vehicle-charging network authentication and control method described above.

[0220] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0221] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0222] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units can be a logical functional division, and in actual implementation, there may be other division methods. For instance, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling, direct coupling, or communication connection may be through some interfaces; the indirect coupling or communication connection between units or modules may be electrical or other forms.

[0223] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0224] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0225] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0226] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for authentication and control of a vehicle-charging station network, characterized in that, include: Obtain the charging pile parameters of the target charging pile, as well as the system public parameters published by the vehicle-charging-pile network platform. The charging pile parameters include the pile registration certificate and the security private key encapsulated in the security module, and the system public parameters include the platform public key. Based on the charging pile parameters and the system common parameters, the target charging pile and the target vehicle perform a first-level two-way authentication to generate a vehicle-charging pile session key. Based on the charging pile parameters and the system common parameters, the target charging pile and the target power grid platform perform a second-level two-way authentication to generate a charging pile-grid session key. After both the first-level two-way authentication and the second-level two-way authentication are completed, a hierarchical control command is generated based on the target session key, wherein the target session key includes at least one of the following: the vehicle-to-charging station session key, and the charging station-network session key; A hierarchical control command is sent to the corresponding target terminal so that the target terminal performs the corresponding control. The target terminal includes at least one of the following: a target power grid platform and a target vehicle.

2. The method according to claim 1, characterized in that, Based on the charging pile parameters and the system common parameters, the target charging pile and the target vehicle perform a first-level two-way authentication, generating a vehicle-charging pile session key, including: Obtain the vehicle-charging station authentication request information sent by the target vehicle, wherein the vehicle-charging station authentication request information includes an anonymous identity identifier temporarily assigned to the target vehicle by the vehicle-charging station network platform, a temporary public key for the vehicle, and a registration auxiliary value. The temporary public key for the vehicle is determined based on the temporary private key generated by the target vehicle, and the registration auxiliary value represents the legitimate registration identity of the target vehicle. Based on the aforementioned secure private key and the charging pile's temporary private key, a charging pile-side authentication certificate is generated; A first feedback message is sent to the target vehicle so that the target vehicle verifies the charging pile authentication certificate based on the platform public key published by the vehicle-charging pile network platform. If the verification is successful, the identity of the target charging pile is confirmed to be legitimate. Based on the anonymous identity identifier, the vehicle temporary public key, the vehicle-side secret value, and the vehicle-side shared intermediate value, a vehicle-side authentication response is generated. The first feedback message includes the charging pile authentication certificate and the charging pile temporary public key. The vehicle-side shared intermediate value is determined based on the vehicle temporary private key and the charging pile temporary public key. The vehicle-side secret value is determined based on the registration auxiliary value and the anonymous identity identifier. Receive the vehicle-side authentication response sent by the target vehicle, determine the first charging pile-side shared intermediate quantity based on the charging pile temporary private key and the vehicle temporary public key, and determine the charging pile-side secret value based on the registration auxiliary value and the anonymous identity identifier; Based on the anonymous identity identifier, the vehicle temporary public key, the registration auxiliary value, the first pile-side shared intermediate value, and the pile-side secret value, the vehicle-side authentication response is verified. If the verification passes, the identity of the target vehicle is confirmed to be legitimate, and the first level of two-way authentication is completed. The vehicle-pile session key is determined based on the first shared intermediate quantity on the pile side.

3. The method according to claim 1, characterized in that, Based on the charging pile parameters and the system common parameters, a second-level two-way authentication is performed between the target charging pile and the target power grid platform to generate a charging pile-grid session key, including: Obtain the pile network authentication request information sent by the target power grid platform, wherein the pile network authentication request information includes the platform identity identifier of the target power grid platform and the platform temporary public key, and the platform temporary public key is determined based on the platform temporary private key generated by the target power grid platform; Based on the aforementioned secure private key and the charging pile's temporary private key, a charging pile-side authentication certificate is generated; Based on the charging pile's temporary private key and the platform's temporary public key, determine the second charging pile-side shared intermediate quantity; Send a second feedback message to the target power grid platform so that the target power grid platform can verify the pile-side authentication certificate based on the platform public key issued by the vehicle-charging-network platform. If the verification is successful, the identity of the target charging pile is confirmed to be legitimate. Based on the second pile-side shared intermediate quantity, a session key is determined. Based on the session key, a platform-side confirmation message is generated. The second feedback message includes the pile-side authentication certificate and the charging pile temporary public key. Receive the platform-side confirmation message returned by the target power grid platform, and determine the pile-grid session key based on the second pile-side shared intermediate quantity; The platform-side confirmation message is verified based on the pile-network session key. If the verification passes, the identity of the target power grid platform is confirmed to be legitimate, and the second-level two-way authentication is completed.

4. The method according to claim 2, characterized in that, Based on the secure private key and the charging pile's temporary private key, a charging pile-side authentication certificate is generated, including: If the vehicle-to-charging station authentication request information also includes a vehicle-side timestamp generated by the target vehicle, verify whether the vehicle-side timestamp satisfies the first valid time window. If the first valid time window is met, a first pile-side timestamp is generated; Based on the secure private key, the temporary private key of the charging pile, and the first pile-side timestamp, the pile-side authentication certificate is generated.

5. The method according to claim 3, characterized in that, Based on the secure private key and the charging pile's temporary private key, a charging pile-side authentication certificate is generated, including: If the network authentication request information also includes the platform-side timestamp and authentication verification value generated by the target power grid platform, verify whether the platform-side timestamp meets the validity of the second valid time window. The authentication verification value is determined based on the platform identity identifier, the platform temporary public key, the platform registration timestamp, the platform-side timestamp, and the authentication index. The authentication index is obtained based on the security private key. If the second valid time window is met, the authentication verification value is verified based on the secure private key to complete the verification of the identity of the target power grid platform; If the verification passes, a second pile-side timestamp is generated; Based on the secure private key, the charging pile temporary private key, and the second pile-side timestamp, the pile-side authentication certificate is generated.

6. The method according to claim 1, characterized in that, Before obtaining the charging station parameters of the target charging station, the following steps are also included: Sending a charging pile registration request to the vehicle-charging-pile network platform, so that the vehicle-charging-pile network platform generates a registration timestamp and authentication index based on the real identity identifier, and encapsulates the security private key into the security module of the target charging pile, wherein the charging pile registration request information includes the real identity identifier of the target charging pile; The system receives registration confirmation information sent by the vehicle-charging network platform, wherein the registration confirmation information includes the authentication index and the registration timestamp.

7. The method according to any one of claims 1 to 6, characterized in that, Before obtaining the charging station parameters of the target charging station, the following steps are also included: Obtain the vehicle registration completion notification sent by the vehicle-charging network platform, wherein the vehicle registration completion notification indicates that the vehicle-charging network platform has generated an anonymous identity identifier and registration auxiliary value for the target vehicle based on the real identity identifier of the target vehicle, and recorded the mapping relationship between the real identity identifier and the anonymous identity identifier.

8. A vehicle-charging station network authentication and control device, characterized in that, include: The acquisition module is used to acquire the charging pile parameters of the target charging pile and the system public parameters published by the vehicle-charging-pile network platform. The charging pile parameters include the pile registration certificate and the security private key encapsulated in the security module. The system public parameters include the platform public key. The execution module is used to perform first-level two-way authentication between the target charging pile and the target vehicle based on the charging pile parameters and the system common parameters, generate a vehicle-charging pile session key, and perform second-level two-way authentication between the target charging pile and the target power grid platform based on the charging pile parameters and the system common parameters, generate a charging pile-grid session key. The generation module is used to generate hierarchical control instructions based on the target session key after the first-level two-way authentication and the second-level two-way authentication are completed. The target session key includes at least one of the following: the vehicle-pile session key and the pile-network session key. The sending module is used to send hierarchical control commands to the corresponding target terminals so that the target terminals can perform the corresponding control. The target terminals include at least one of the following: a target power grid platform and a target vehicle.

9. An electronic device, characterized in that, include: processor; Memory used to store the processor's executable instructions; The processor is configured to execute the instructions to implement the vehicle-charging-pile network authentication and control method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, When the instructions in the computer-readable storage medium are executed by the processor of the electronic device, the electronic device is able to perform the vehicle-charging network authentication and control method as described in any one of claims 1 to 7.

Images