Charging resumption method and device, apparatus, and storage medium

Abstract

The application relates to the charging technical field and discloses a breakpoint resuming charging method, device and equipment and a storage medium, the method comprising the following steps: generating charging snapshot data in a charging process; submitting the snapshot data to a secure enclave, so that the secure enclave generates a first signature value by using a target signature key, and stores the snapshot data and the first signature value in a nonvolatile storage medium; in the case that breakpoint resuming charging is detected, reading the snapshot data and the first signature value and submitting the snapshot data and the first signature value to the secure enclave, so that the secure enclave generates a second signature value, checks the first signature value and the second signature value, and returns a check result; and performing breakpoint resuming charging according to the check result. Since the snapshot data is signed by the secure enclave using the target signature key and the signature is verified when the breakpoint resuming charging is performed, an attacker cannot forge a legal signature in the case that the target signature key cannot be obtained, and thus the attacker cannot cheat free charging by physically tampering with the snapshot data.

Description

Technical Field

[0001] This application relates to the field of charging technology, and in particular to methods, apparatus, devices and storage media for resuming charging after interruption. Background Technology

[0002] In scenarios requiring interrupted charging capabilities, such as electric vehicle charging, energy storage charging and discharging, and battery swapping stations, existing interrupted charging solutions typically record real-time billing snapshot data (such as charged amount and amount charged) during the charging process. When power is restored after a power outage, the system reads the most recently stored snapshot data to restore the billing status. However, because this snapshot data is stored in plaintext in non-volatile storage media such as Flash memory and lacks effective cryptographic protection, attackers can easily tamper with critical data such as charged amount through physical means (such as a programmer directly reading and writing to the Flash chip), thereby fraudulently obtaining free charging and causing billing losses for operators. Summary of the Invention

[0003] The main purpose of this application is to provide a method, apparatus, device and storage medium for resuming charging after interruption, which aims to solve the technical problem that key data such as the amount of charge already charged is easily tampered with.

[0004] To achieve the above objectives, this application proposes a method for resuming charging after interruption, the method being applied to charging equipment equipped with a safety enclave, the method comprising: During the charging process, billing snapshot data of the device to be charged is generated according to preset trigger conditions. The billing snapshot data represents the current charging record of the device to be charged. The billing snapshot data is submitted to the secure enclave, so that the secure enclave uses the target signature key corresponding to this charging process to generate a first signature value corresponding to the billing snapshot data, and stores the billing snapshot data and the first signature value in a non-volatile storage medium; If a breakpoint is detected and charging resumes, the current billing snapshot data and the first signature value are read from the non-volatile storage medium and submitted to the secure enclave. The secure enclave then uses the target signature key to generate a second signature value corresponding to the current billing snapshot data and verifies the first signature value and the second signature value, returning the verification result. Based on the verification results, the device to be charged is recharged after interruption.

[0005] In one embodiment, the step of resuming charging of the device to be charged based on the verification result includes: If the verification result is successful, the system receives the usage authorization certificate returned by the secure enclave and resumes charging the device that needs to be charged. After the step of resuming charging of the device to be charged based on the verification result, the method further includes: After the interrupted charging is completed, an order signature request with an authorization certificate to be verified is submitted to the secure enclave, so that the secure enclave can verify the authorization certificate to be verified using the authorization certificate and return the certificate verification result; If the voucher verification result is a voucher verification failure, settlement of the current order corresponding to the order signature request shall be prohibited.

[0006] In one embodiment, the step of submitting the billing snapshot data to the secure enclave so that the secure enclave uses the target signature key corresponding to this charging process to generate a first signature value corresponding to the billing snapshot data includes: In the event of a secure enclave information acquisition request, the master key of the charging device, the unique identifier of the charging device, and the charging process identifier of the current charging process are transmitted to the secure enclave, so that the secure enclave generates the target signature key based on the master key, the unique identifier, the charging process identifier, a preset random number, and the sequence number, and generates the first signature value corresponding to the billing snapshot data based on the target signature key.

[0007] In one embodiment, the step of generating billing snapshot data of the device to be charged according to preset trigger conditions includes: Generate periodic billing snapshot data for the devices to be charged according to a preset cycle; Collect the incremental amount of charge of the device to be charged and the current charging status of the device to be charged, and generate event billing snapshot data of the device to be charged when the incremental amount of charge is greater than a preset charge threshold and / or the current charging status changes; Upon detecting that the current charging process has ended, a billing snapshot of the device to be charged is generated; In the event of a detected system outage or the current order amount exceeding a preset threshold, a safety billing snapshot of the device to be charged is generated. The periodic billing snapshot data, the event billing snapshot data, the settlement billing snapshot data, and the security billing snapshot data are sorted according to a preset priority order, and the billing snapshot data with the highest priority is selected from the sorting results as the billing snapshot data of the device to be charged.

[0008] In one embodiment, after the step of selecting the highest priority billing snapshot data from the sorting results as the billing snapshot data of the device to be charged, the method further includes: Determine the data type of the billing snapshot data; The billing snapshot data is verified according to the data type and the corresponding preset verification strategy to obtain the verification result. The preset verification strategies for different data types are different. If the verification result is successful, the device to be charged will be powered off and then recharged.

[0009] In one embodiment, the step of storing the billing snapshot data and the first signature value in a non-volatile storage medium includes: Assign monotonically increasing sequence numbers to the billing snapshot data; The serial number is stored in the non-volatile storage area of ​​the battery domain, the snapshot storage area of ​​the non-volatile storage medium, and the anchor table of the non-volatile storage medium, respectively. Before the step of resuming charging of the device to be charged based on the verification result, the method further includes: If the verification result is successful, the corresponding serial numbers are read from the non-volatile storage area of ​​the battery domain, the snapshot storage area, and the anchor table, and the largest serial number among the serial numbers is taken as the target serial number. The sequence number to be verified in the current billing snapshot data is compared with the target sequence number to obtain the comparison result, and the comparison result is used as the new verification result.

[0010] In one embodiment, the step of storing the billing snapshot data and the first signature value in a non-volatile storage medium includes: Create a data copy of the billing snapshot data and the first signature value; Write the billing snapshot data and the first signature value into the first sector of the non-volatile storage medium; After the write is completed, the first sector is verified to obtain the first write verification result, and if the first write verification result is successful, the system waits for a preset write time interval. After the preset write time interval ends, the data copy is written to the second sector in the non-volatile storage medium, and the write verification is performed on the second sector after the write is completed to obtain the second write verification result; If the second write verification result is successful, the billing snapshot data and the first signature value are stored in the non-volatile storage medium.

[0011] Furthermore, to achieve the above objectives, this application also proposes a device for resuming charging after interruption, the device comprising: The data generation module is used to generate billing snapshot data of the device to be charged according to preset trigger conditions during the charging process. The billing snapshot data represents the current charging record of the device to be charged. The data storage module is used to submit the billing snapshot data to the secure enclave, so that the secure enclave uses the target signature key corresponding to this charging process to generate a first signature value corresponding to the billing snapshot data, and stores the billing snapshot data and the first signature value in a non-volatile storage medium; The result acquisition module is used to read the current billing snapshot data and the first signature value from the non-volatile storage medium and submit them to the secure enclave when a breakpoint charging is detected, so that the secure enclave can use the target signature key to generate a second signature value corresponding to the current billing snapshot data and verify the first signature value and the second signature value, and return the verification result. The interrupted charging module is used to resume charging of the device to be charged based on the verification result.

[0012] In addition, to achieve the above objectives, this application also proposes a device for resuming charging after interruption, the device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the resuming charging method as described above.

[0013] In addition, to achieve the above objectives, this application also proposes a storage medium, which is a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, it implements the steps of the breakpoint resume charging method described above.

[0014] This application provides a method for resuming charging after interruption. The method is applied to a charging device with a secure enclave. The method includes: during the charging process, generating billing snapshot data of the device to be charged according to preset trigger conditions, wherein the billing snapshot data represents the current charging record of the device to be charged; submitting the billing snapshot data to the secure enclave, so that the secure enclave uses the target signature key corresponding to the current charging process to generate a first signature value corresponding to the billing snapshot data, and storing the billing snapshot data and the first signature value in a non-volatile storage medium; when resuming charging after interruption is detected, reading the current billing snapshot data and the first signature value from the non-volatile storage medium and submitting them to the secure enclave, so that the secure enclave uses the target signature key to generate a second signature value corresponding to the current billing snapshot data and verifies the first signature value and the second signature value, and returning a verification result; and resuming charging of the device to be charged based on the verification result.

[0015] The interrupted charging device of this application can use a secure enclave to sign the billing snapshot data generated during the charging process with the target signature key corresponding to the current charging process to generate a first signature value. The billing snapshot data and the first signature value are stored in a non-volatile storage medium. When interrupted charging is detected, a second signature value corresponding to the billing snapshot data is regenerated through the secure enclave, and the first and second signature values ​​are verified to determine the verification result. Based on the verification result, the interrupted charging of the device is resumed. Compared to existing interrupted charging schemes where snapshot data is stored in plaintext in non-volatile storage media such as Flash and lacks effective cryptographic protection, allowing attackers to easily tamper with key data such as the amount of charge received through physical means to fraudulently obtain free charging, this application, by using a secure enclave to sign the snapshot data with the target signature key and verifying the signature during interrupted charging, prevents attackers from forging a legitimate signature to pass verification without obtaining the target signature key. This avoids the problem of attackers fraudulently obtaining free charging by physically tampering with snapshot data. Attached Figure Description

[0016] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0017] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a schematic diagram of the breakpoint charging device structure in the hardware operating environment involved in the embodiments of this application; Figure 2 This is a flowchart illustrating the first embodiment of the resuming charging method according to this application; Figure 3 This is a flowchart illustrating the second embodiment of the resuming charging method according to this application; Figure 4 This is a flowchart illustrating the third embodiment of the resuming charging method according to this application; Figure 5 This is a flowchart illustrating the serial number rollback prevention verification process for this application. Figure 6 A flowchart illustrating the process of starting the recharge interruption verification for this application; Figure 7 This is a structural block diagram of the recharge device for interrupted charging in this application.

[0019] The purpose, features, and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0020] It should be understood that the specific embodiments described herein are merely illustrative of the technical solutions of this application and are not intended to limit this application.

[0021] Reference Figure 1 , Figure 1 This is a schematic diagram of the breakpoint charging device structure in the hardware operating environment involved in the embodiments of this application.

[0022] like Figure 1 As shown, the interrupted charging device may include: a processor 1001, such as a central processing unit (CPU), a communication bus 1002, a user interface 1003, a network interface 1004, and a memory 1005. The communication bus 1002 is used to establish communication between these components. The user interface 1003 may be connected to a display screen; optionally, the user interface 1003 may include a standard wired interface or a wireless interface. In this application, the wired interface of the user interface 1003 may be a USB interface. The network interface 1004 may optionally include a standard wired interface or a wireless interface (such as a Wireless-Fidelity (Wi-Fi) interface). The memory 1005 may be high-speed random access memory (RAM) or non-volatile memory (NVM), such as a disk storage device. Alternatively, the memory 1005 may be a storage device independent of the aforementioned processor 1001.

[0023] Those skilled in the art will understand that Figure 1 The structure shown does not constitute a limitation on the recharge device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0024] like Figure 1 As shown, the memory 1005, which is identified as a computer storage medium, may include an operating system, a network communication module, a user interface module, and a breakpoint resume charging program.

[0025] exist Figure 1 In the interrupted charging device shown, the network interface 1004 is mainly used to connect to the backend server and communicate with the backend server; the user interface 1003 is mainly used to connect to the user equipment; the interrupted charging device calls the interrupted charging program stored in the memory 1005 through the processor 1001 and executes the steps of the interrupted charging method provided in the embodiments of this application.

[0026] It should be noted that in scenarios requiring interrupted charging capabilities, such as electric vehicle charging, energy storage charging and discharging, and battery swapping stations, existing interrupted charging solutions typically record real-time billing snapshot data (such as the amount charged and the amount charged) during the charging process. When power is restored after a power outage, the system reads the most recently stored snapshot data to restore the billing status. However, because this snapshot data is stored in plaintext in non-volatile storage media such as Flash memory and lacks effective cryptographic protection, attackers can easily tamper with critical data such as the amount charged through physical means (such as a programmer directly reading and writing to the Flash chip), thereby fraudulently obtaining free charging and causing billing losses for operators.

[0027] Therefore, to address the aforementioned shortcomings, this embodiment provides a method, apparatus, device, and storage medium for resuming charging after a breakpoint. The method is applied to a charging device equipped with a secure enclave. The method includes: during the charging process, generating billing snapshot data of the device to be charged according to preset trigger conditions, the billing snapshot data representing the current charging record of the device; submitting the billing snapshot data to the secure enclave, so that the secure enclave uses a target signature key corresponding to the current charging process to generate a first signature value corresponding to the billing snapshot data, and storing the billing snapshot data and the first signature value in a non-volatile storage medium; upon detecting resuming charging after a breakpoint, reading the current billing snapshot data and the first signature value from the non-volatile storage medium and submitting them to the secure enclave, so that the secure enclave uses the target signature key to generate a second signature value corresponding to the current billing snapshot data and verifies the first signature value and the second signature value, returning a verification result; and performing resuming charging of the device to be charged based on the verification result.

[0028] This embodiment uses a secure enclave to sign the billing snapshot data generated during the charging process using the target signature key corresponding to the current charging process, generating a first signature value. The billing snapshot data and the first signature value are stored in a non-volatile storage medium. When a breakpoint charging is detected, a second signature value corresponding to the billing snapshot data is regenerated through the secure enclave, and the first and second signature values ​​are verified to determine the verification result. Based on the verification result, the device to be charged is charged again. Compared to existing breakpoint charging solutions where snapshot data is stored in plaintext in non-volatile storage media such as Flash and lacks effective cryptographic protection, allowing attackers to easily tamper with key data such as the amount of charge received to fraudulently obtain free charging, this application uses a secure enclave to sign the snapshot data using the target signature key and verifies the signature during breakpoint charging. This prevents attackers from forging a legitimate signature to pass verification without obtaining the target signature key, thus avoiding the problem of attackers fraudulently obtaining free charging by physically tampering with snapshot data.

[0029] For ease of understanding, the following is combined with Figures 2 to 7 The method for resuming charging after a breakpoint provided in the embodiments of this application will be described in detail.

[0030] Reference Figure 2 , Figure 2 This is a flowchart illustrating the first embodiment of the breakpoint resume charging method of this application. The first embodiment of the breakpoint resume charging method of this application is presented as follows: Figure 2 As shown, in this embodiment, the method is applied to a charging device equipped with a safety enclave, and the method includes: Step S10: During the charging process, a billing snapshot data of the device to be charged is generated according to a preset trigger condition. The billing snapshot data represents the current charging record of the device to be charged.

[0031] It should be noted that the aforementioned billing snapshot data can be a data set obtained by recording the charging status of the charging device at the current moment during the charging process. It includes at least the amount of charge, the amount of charge, and the snapshot generation timestamp, which are billing-related information and are used to provide historical billing basis when the billing status is restored after the charging is interrupted.

[0032] It should also be noted that the aforementioned preset trigger conditions can be various pre-defined conditions for generating snapshot data, such as the arrival of a timer period, the cumulative increase in charged amount reaching a threshold, a change in charging status, a change in rate, or the detection of a charging end event. The aforementioned charged record can be the cumulative amount of electricity charged to the device to be charged and the corresponding cost information from the start of this charging session to the current moment.

[0033] In its implementation, the charging device continuously monitors whether various preset trigger conditions are met when it detects that it is currently charging. When the charging device detects that any preset trigger condition is met, it immediately collects the current charging status information. The charging device reads the current charged amount from the energy metering chip, the current charged amount from the billing management module, the current status value from the charging state machine, and the current timestamp from the system clock. The charging device assembles the collected information according to a predetermined format to generate billing snapshot data. This billing snapshot data is used to characterize the charging record of the device to be charged from the start of the current charging session to the time the snapshot was generated.

[0034] Step S20: Submit the billing snapshot data to the secure enclave so that the secure enclave uses the target signature key corresponding to this charging process to generate the first signature value corresponding to the billing snapshot data, and stores the billing snapshot data and the first signature value in a non-volatile storage medium.

[0035] It should be noted that the aforementioned secure enclave can be a hardware security area in the charging device that is independent of the main control CPU. It has independent computing and storage resources, and can perform cryptographic operations within it without interference from the main control CPU. The keys and data within it are not visible to the main control CPU.

[0036] It is understood that the aforementioned target signature key may be a target signature key that is uniquely corresponding to this charging session, which is derived by the secure enclave at the start of this charging session based on parameters such as the device master key, the device unique identifier, the charging session identifier, and random numbers. This target signature key is used to cryptographically sign the snapshot data.

[0037] It should be understood that the aforementioned first signature value can be the signature result obtained by performing cryptographic operations on the billing snapshot data using the target signature key in the secure enclave, used to verify the integrity and authenticity of the snapshot data during subsequent recovery. The aforementioned non-volatile storage medium can be a storage device in the charging device that can retain data without loss after power failure, such as a Flash memory.

[0038] In its implementation, after generating billing snapshot data, the charging device submits the data to a secure enclave. Upon receiving the billing snapshot data, the secure enclave performs a cryptographic signature operation on the data using the target signature key corresponding to the current charging process, generating a first signature value corresponding to the billing snapshot data. Subsequently, the charging device associates and stores the billing snapshot data and the first signature value in a non-volatile storage medium, that is, it saves the billing snapshot data together with the first signature value used to verify its integrity.

[0039] Step S30: If a breakpoint charging is detected, the current billing snapshot data and the first signature value are read from the non-volatile storage medium and submitted to the secure enclave, so that the secure enclave uses the target signature key to generate a second signature value corresponding to the current billing snapshot data and verifies the first signature value and the second signature value, and returns the verification result.

[0040] It is understandable that the aforementioned current billing snapshot data may be the billing status data read by the charging device from the non-volatile storage medium when the interrupted charging resumes, which is stored in the same snapshot record as the first signature value. This billing status data is submitted to the security enclave as an object to be verified, and whether its content is consistent with the historical writing needs to be confirmed by the security enclave through signature verification.

[0041] It is also understood that the aforementioned second signature value can be the signature result obtained by the secure enclave using the target signature key to re-perform the cryptographic signature operation on the read billing snapshot data. The aforementioned verification result can be the comparison result returned by the secure enclave after comparing the first signature value with the second signature value, used to indicate whether the first signature value and the second signature value are consistent, thereby determining whether the snapshot data has been tampered with.

[0042] In its implementation, when the charging device detects a break in the charging process (i.e., detects an incomplete charging session that needs to be resumed), it reads the currently stored billing snapshot data and a first signature value stored in the same snapshot record as the billing snapshot data from a non-volatile storage medium. The charging device then submits the read billing snapshot data and the first signature value to a secure enclave. Upon receiving this data, the secure enclave uses the target signature key corresponding to the current charging process to perform a cryptographic signature operation on the billing snapshot data, generating a second signature value corresponding to the billing snapshot data. Next, the secure enclave compares and verifies the generated second signature value with the read first signature value to determine if they match, and returns the verification result.

[0043] Step S40: Perform interrupted charging on the device to be charged according to the verification result.

[0044] In its implementation, after receiving the verification result returned by the secure enclave, the charging device resumes charging from where it left off, based on the verification result. If the verification passes (i.e., the first signature value matches the second signature value), it indicates that the currently read billing snapshot data has not been tampered with since its initial writing. The charging device allows charging to resume and continues to accumulate subsequent charging amounts and fees, starting from the amount already charged recorded in the aforementioned billing snapshot data. If the verification fails (i.e., the first signature value does not match the second signature value), it indicates that the currently read billing snapshot data may have been tampered with. The charging device prohibits resuming charging from where it left off and either restarts billing from the beginning or terminates the charging process.

[0045] Reference Figure 3 , Figure 3 This is a flowchart illustrating the second embodiment of the breakpoint resume charging method of this application. Based on the first embodiment described above, the second embodiment of the breakpoint resume charging method of this application is proposed.

[0046] To prevent orders without proper safety enclave permits from being accepted by the operating platform, in this embodiment, the step of resuming charging of the device to be charged based on the verification result includes: Step S401: If the verification result is successful, receive the usage authorization certificate returned by the secure enclave and resume charging the device to be charged.

[0047] It should be noted that the aforementioned authorization credential can be generated and issued to the charging device by the secure enclave upon successful verification. This authorization credential serves to prove that the charging device has passed the snapshot integrity verification and is legally qualified to continue charging. In one implementation, the authorization credential includes the current session identifier, the current serial number, and the issuance timestamp, and is signed by the secure enclave using an internal key to prevent forgery. This authorization credential is time-sensitive and can only be used once.

[0048] In its implementation, if the verification result returned by the secure enclave is successful, the charging device receives a usage authorization certificate from the secure enclave. This usage authorization certificate proves that the current billing snapshot data has passed integrity verification, and that the charging device is legally qualified to perform interrupted charging continuation. After receiving the usage authorization certificate, the charging device continues to accumulate subsequent charging amounts and costs, starting from the amount charged recorded in the verified billing snapshot data.

[0049] After the step of resuming charging of the device to be charged based on the verification result, the method further includes: Step S50: After the interrupted charging is completed, submit an order signature request with the authorization certificate to be verified to the secure enclave, so that the secure enclave can verify the authorization certificate to be verified by using the authorization certificate and return the certificate verification result.

[0050] It should be understood that the aforementioned authorization certificate to be verified may be the authorization certificate attached to the charging device when submitting the order signature request to the security enclave after the interruption of the recharge. The authorization certificate to be verified is received and temporarily stored by the charging device from the security enclave when the recharge begins, and is used to prove to the security enclave in the settlement process that the charging device has passed the snapshot integrity verification and has the legal qualification to continue charging.

[0051] It should also be understood that the aforementioned order signature request may be a request sent by the charging device to the secure enclave after charging is completed, requesting a cryptographic signature for the current order. This order signature request includes the authorization credential to be verified and the order data. The aforementioned credential verification result may be the result returned by the secure enclave after verifying the authorization credential submitted by the charging device, indicating whether the authorization credential to be verified is valid.

[0052] In its implementation, after a breakpoint charging cycle ends, the charging device generates current order data upon detecting charging completion or the user ending charging. The charging device submits an order signature request to the security enclave, attaching a verification authorization credential to the request. Upon receiving the order signature request, the security enclave extracts the attached verification authorization credential and verifies it using the previously issued usage authorization credential, determining whether the verification authorization credential matches the issued usage authorization credential and is valid. The security enclave then returns the verification result.

[0053] Step S60: If the voucher verification result is that the voucher verification fails, settlement of the current order corresponding to the order signature request shall be prohibited.

[0054] It should be noted that the aforementioned current order can be a settlement order generated after the charging device has finished resuming charging, which includes the total charging amount and total amount of this charging session.

[0055] In its implementation, after receiving the verification result from the security enclave, the charging device evaluates that result. If the verification fails—meaning the security enclave determines that the authorization certificate to be verified is inconsistent with the issued usage authorization certificate, has expired, has been used, or the certificate to be verified does not exist—the charging device immediately prohibits the settlement of the current order. The charging device does not submit a settlement request for the order to the operating platform or refuses to execute the settlement process for the order, thereby preventing orders without valid enclave authorization from being submitted to the operating platform.

[0056] This embodiment issues an authorization credential to the charging device from the secure enclave upon successful verification. This ensures that the charging device can only resume charging from a standby point if it possesses this credential. After the resumed charging is completed, the charging device is required to submit an order signature request with the authorization credential to be verified to the secure enclave. The secure enclave then verifies the credential. If the credential verification fails, the current order settlement is prohibited. This cryptographically binds the result of the snapshot signature verification to the subsequent order settlement process, thereby achieving mandatory control over order signatures during the settlement process. Even if the business software forcibly skips to resume charging, it will be unable to obtain the secure enclave's signature for the order due to the lack of a valid credential, and thus cannot complete the settlement.

[0057] Furthermore, to ensure the security of the signature key and the trustworthiness of the signature value during the snapshot writing phase, in this embodiment, the step of submitting the billing snapshot data to the secure enclave so that the secure enclave uses the target signature key corresponding to this charging process to generate the first signature value corresponding to the billing snapshot data includes: Step S201: In the event of the secure enclave generating information acquisition request, the master key of the charging device, the unique identifier of the charging device, and the charging process identifier of the current charging process are transmitted to the secure enclave, so that the secure enclave generates the target signature key based on the master key, the unique identifier, the charging process identifier, the preset random number, and the sequence number, and generates the first signature value corresponding to the billing snapshot data based on the target signature key.

[0058] It should be noted that the aforementioned master key may be the root key burned into the one-time programmable memory area of ​​the charging device at the factory. Each charging device has a unique master key, and this master key can only be read by a secure enclave through a hardware secure channel. The main control CPU of the charging device has no right to access this master key. The aforementioned unique identifier may be a unique hardware identifier assigned to each charging device at the factory, used to distinguish different devices in cryptographic operations.

[0059] It should also be noted that the aforementioned charging process identifier can be a unique identifier for this charging session, generated by the charging device when the charging session starts, to distinguish different charging sessions. The aforementioned preset random number can be a random number pre-stored in the non-volatile memory area of ​​the battery domain, generated by a true random number generator, and regenerated after the main power supply of the charging device is turned off, to ensure that the key derivation result is different in each power-on cycle.

[0060] It is understood that the aforementioned target signature key can be a cryptographic key derived by the secure enclave based on the master key, unique identifier, charging process identifier, and preset random number, corresponding to the current charging process. This key is used to sign the billing snapshot data. The aforementioned first signature value can be the signature result obtained by the secure enclave using the target signature key to perform a cryptographic signature operation on the billing snapshot data.

[0061] In its implementation, after receiving the billing snapshot data, the aforementioned secure enclave generates an information retrieval request. In response to this request, the charging device provides its master key, unique identifier, and charging process identifier to the secure enclave via a secure hardware channel, enabling the secure enclave to access this information. The master key is provided without passing through the main control CPU, and the main control CPU cannot read its contents.

[0062] After obtaining the above information, the secure enclave generates a target signature key based on the master key, unique identifier, charging process identifier, and a preset random number. The master key serves as the root key, the unique identifier distinguishes different devices, the charging process identifier distinguishes different charging sessions, and the preset random number distinguishes different power-on cycles. Since different devices have different master keys, different charging sessions have different charging process identifiers, and different power-on cycles have different preset random numbers, the derived target signature key is uniquely bound to the device, charging session, and power-on cycle. After generating the target signature key, the secure enclave performs cryptographic signature operations on the billing snapshot data based on this target signature key to generate the first signature value corresponding to the billing snapshot data.

[0063] This embodiment generates a target signature key by a secure enclave based on a master key, a unique identifier, a charging process identifier, and a preset random number. This ensures that the target signature key is uniquely bound to the device, charging session, and power-on cycle. The keys derived from different devices, charging sessions, and power-on cycles are all different. Furthermore, by restricting the master key to be accessible only to the secure enclave through a secure hardware channel and preventing the main control CPU from accessing it, and by ensuring that the target signature key is only derived and used internally by the secure enclave, attackers cannot obtain the signature key even if they physically read the snapshot data and signature value from the non-volatile storage medium. This prevents attackers from forging legitimate signature values ​​and effectively prevents them from fraudulently obtaining free charging by tampering with snapshot data.

[0064] Furthermore, in order to differentiate the recording of billing nodes of different importance during the charging process, and enable the charging device to generate corresponding types of snapshot data according to the importance of the triggering conditions, in this embodiment, the step of generating billing snapshot data of the device to be charged according to preset triggering conditions includes: Step S101: Generate periodic billing snapshot data of the device to be charged according to a preset period.

[0065] It should be noted that the aforementioned preset period can be a pre-set fixed time interval used to periodically trigger the generation of snapshot data. The aforementioned periodic billing snapshot data can be billing snapshot data generated by the charging device based on the current charging status when the preset period arrives.

[0066] In its implementation, the charging device generates periodic billing snapshot data for the device to be charged according to a preset period. The charging device starts a timer that counts according to the preset period. Whenever the timer reaches the preset period, the charging device determines that the timing trigger condition has been met, and then collects the current charging status information to generate periodic billing snapshot data. The generation of the periodic billing snapshot data does not depend on changes in the charging status or other external events; it is driven solely by time.

[0067] Step S102: Collect the incremental amount of charge of the device to be charged and the current charging status of the device to be charged, and generate event billing snapshot data of the device to be charged if the incremental amount of charge is greater than a preset charge threshold and / or the current charging status changes.

[0068] It should be understood that the aforementioned power increment can be the cumulative amount of power supplied by the charging device to the device to be charged within the current time period. The aforementioned preset power threshold can be a pre-set cumulative power threshold used to trigger snapshot generation.

[0069] It should also be understood that the aforementioned current charging state can refer to the current operating state of the charging device, including but not limited to the start-up state, charging state, paused state, stopped state, and fault state. A change in the aforementioned current charging state can refer to the charging device switching from one charging state to another. The aforementioned event billing snapshot data can be billing snapshot data generated by the charging device based on the current charging state when a specific event is detected.

[0070] In its implementation, the aforementioned charging device continuously collects the incremental amount of electricity charged during the charging process and monitors the current charging status of the device to be charged. When the charging device determines that the incremental amount of electricity is greater than a preset threshold, it generates event billing snapshot data. Alternatively, the charging device generates event billing snapshot data when it detects a change in the current charging status. These two triggering conditions can exist independently, meaning that the charging device generates event billing snapshot data when either the incremental amount of electricity reaches the threshold or the charging status changes; or they can exist simultaneously, meaning that the charging device generates event billing snapshot data when both conditions are met.

[0071] Furthermore, the generation of the aforementioned event billing snapshot data can also include other triggering scenarios. For example, the charging device generates event billing snapshot data when it detects an order event. This order event can be a key node event related to the current order during the charging process, such as a user initiating a stop charging request through the application, or an update to order information. Another example is that the charging device generates event billing snapshot data when it detects a change in the current rate table. This rate table change can be a rate adjustment caused by the switching between peak and off-peak hours during the charging process, such as switching from a peak rate to a normal rate or an off-peak rate.

[0072] Step S103: If it is detected that the current charging process has ended, generate the billing snapshot data of the device to be charged.

[0073] It is understandable that the aforementioned "current charging process has ended" could refer to an event where the charging device detects that the current charging session has terminated due to the fulfillment of termination conditions. The aforementioned billing snapshot data could be billing snapshot data generated by the charging device based on the current charging status at the end of the charging process. This snapshot data is used to record the final billing status at the moment of charging completion, serving as the basis for subsequent order settlement.

[0074] In its implementation, the aforementioned charging device continuously monitors whether the current charging process has ended. When the charging device detects that the current charging process has ended, it collects the current charging status information and generates settlement and billing snapshot data. This settlement and billing snapshot data records the final billing status information, such as the amount charged and the amount charged, at the time of charging completion.

[0075] Step S104: If a fault shutdown is detected or the current cumulative order amount exceeds a preset amount threshold, generate security billing snapshot data for the device to be charged.

[0076] It should be noted that the aforementioned fault shutdown refers to an event where the charging equipment automatically terminates charging due to an abnormal situation (such as over-temperature protection, over-current protection, insulation detection abnormality, etc.). The aforementioned current order cumulative amount refers to the total charging cost accumulated from the start of this charging session to the current moment.

[0077] It should also be noted that the aforementioned preset amount threshold can be a pre-set threshold value used to trigger the generation of a security snapshot. The aforementioned security billing snapshot data can be billing snapshot data generated by the charging device based on the current charging status when high-risk scenarios such as detecting a fault shutdown or an order amount exceeding the preset threshold are detected.

[0078] In its implementation, the aforementioned charging equipment continuously monitors its operating status and the current cumulative order amount during the charging process. When the charging equipment detects a malfunction and shutdown, such as an over-temperature protection failure, over-current protection failure, or insulation detection anomaly causing automatic shutdown, the charging equipment collects the current charging status information and generates a safety billing snapshot. Alternatively, when the charging equipment detects that the current cumulative order amount exceeds a preset threshold, such as when the cumulative order amount reaches a preset threshold of 1000 yuan, the charging equipment also collects the current charging status information and generates a safety billing snapshot.

[0079] Step S105: Sort the periodic billing snapshot data, the event billing snapshot data, the settlement billing snapshot data and the security billing snapshot data according to a preset priority order, and select the billing snapshot data with the highest priority from the sorting results as the billing snapshot data of the device to be charged.

[0080] It is understood that the aforementioned preset priority order can be a pre-defined sorting rule used to determine the selection priority when multiple types of snapshot data exist simultaneously. The sorting can be an operation that arranges the various types of snapshot data generated during the current charging process according to the preset priority order. The highest priority can be the priority level that ranks first in the preset priority order, that is, the priority corresponding to the snapshot data that should most be recorded during the current charging process.

[0081] In its implementation, the charging device may generate multiple types of billing snapshot data simultaneously after generating periodic billing snapshot data, event billing snapshot data, settlement billing snapshot data, and security billing snapshot data. For example, at the end of charging, it may generate periodic billing snapshot data because the timing period has been reached, or it may generate settlement billing snapshot data because the charging end condition has been met simultaneously. The charging device sorts the four types of billing snapshot data according to a preset priority order, and selects the highest priority billing snapshot data as the billing snapshot data for the device to be charged, for subsequent storage and verification processes. The preset priority order from highest to lowest is: security billing snapshot data, settlement billing snapshot data, event billing snapshot data, and periodic billing snapshot data, that is, security billing snapshot data has the highest priority, followed by settlement billing snapshot data, then event billing snapshot data, and finally periodic billing snapshot data has the lowest priority.

[0082] To facilitate understanding, the following examples are provided for illustration, but they do not impose specific limitations on this embodiment. For instance, if a charging device simultaneously meets both the timing cycle arrival condition and the charging end condition at the current moment, it generates periodic billing snapshot data and settlement billing snapshot data. The charging device sorts these two types of snapshot data according to a preset priority order, with the settlement billing snapshot data having a higher priority than the periodic billing snapshot data. Therefore, the charging device selects the settlement billing snapshot data from the sorting results as the billing snapshot data for the current charging process, for storage and subsequent verification procedures. As another example, if a charging device generates periodic billing snapshot data, event billing snapshot data, and safety billing snapshot data simultaneously due to a malfunction and shutdown, the charging device selects the safety billing snapshot data as the billing snapshot data for the device to be charged, according to a preset priority order.

[0083] This embodiment generates corresponding types of billing snapshot data by pre-setting multiple trigger conditions, and selects the highest priority one from the multiple types of billing snapshot data as the billing snapshot data to be stored according to the preset priority order. This enables the charging device to automatically record the billing status at various nodes in the charging process, and when multiple trigger conditions are met at the same time, it can automatically select the most critical billing snapshot data for storage according to the priority rules, avoiding the problem of multiple billing snapshot data overlapping or conflicting at the same time.

[0084] Furthermore, to ensure that billing snapshot data of different importance corresponds to different signature verification strengths—that is, to enable strong protection in critical scenarios and reduce signature verification overhead in normal scenarios—and thereby optimize system resource utilization while ensuring the security of critical snapshot data, this embodiment, after the step of selecting the highest priority billing snapshot data from the sorting results as the billing snapshot data of the device to be charged, further includes: Step S106: Determine the data type of the billing snapshot data.

[0085] It should be understood that the aforementioned data types can be information used to identify the category to which the billing snapshot data belongs, and different data types correspond to different triggering conditions. The data types of the aforementioned billing snapshot data include periodic billing snapshot data, event billing snapshot data, settlement billing snapshot data, and security billing snapshot data. The aforementioned billing snapshot data may contain a type identifier field, which is used to record the data type corresponding to the snapshot data so that the type of the snapshot data can be identified during signature verification.

[0086] In its implementation, after reading the billing snapshot data from the non-volatile storage medium, the charging device determines the data type of the billing snapshot data. The charging device reads the type identifier field in the billing snapshot data and determines whether the billing snapshot data belongs to periodic billing snapshot data, event billing snapshot data, settlement billing snapshot data, or security billing snapshot data based on this type identifier field.

[0087] Step S107: Verify the billing snapshot data according to the data type and the corresponding preset verification strategy to obtain the verification result. The preset verification strategies for different data types are different.

[0088] It should be noted that the aforementioned preset signature verification strategies can be pre-defined sets of signature verification rules corresponding to different data types. For example, periodic billing snapshot data corresponds to a periodic snapshot signature verification strategy, event billing snapshot data corresponds to an event snapshot signature verification strategy, settlement billing snapshot data corresponds to a settlement snapshot signature verification strategy, and security billing snapshot data corresponds to a security snapshot signature verification strategy. The signature verification strength of the preset signature verification strategies corresponding to different data types varies. For example, the signature verification strength of the periodic snapshot strategy is lower than that of the event snapshot strategy, the signature verification strength of the event snapshot strategy is lower than that of the settlement snapshot strategy, and the signature verification strength of the settlement snapshot strategy is lower than that of the security snapshot strategy.

[0089] It should also be noted that the aforementioned signature verification result can be the verification result obtained after performing a preset signature verification strategy on the billing snapshot data, such as signature verification passed or signature verification failed, used to indicate whether the billing snapshot data has passed the signature verification. The aforementioned signature verification strength can be the combination and complexity of the verification operations performed during the signature verification process. For example, the signature verification strength of performing only Cyclic Redundancy Check (CRC) and sequence number verification is lower than the signature verification strength of performing Cyclic Redundancy Check, Hash-based Message Authentication Code (HMAC) signature verification, and sequence number verification.

[0090] In its implementation, after determining the data type of the billing snapshot data, the charging device determines a corresponding preset verification strategy based on that data type and verifies the billing snapshot data according to the preset verification strategy to obtain the verification result. The verification strength of the preset verification strategies varies depending on the data type; that is, the number and rigor of verification operations performed on different types of snapshot data differ. Specifically, the preset verification strategy corresponding to periodic billing snapshot data has the lowest verification strength, the preset verification strategy corresponding to event billing snapshot data has a higher verification strength than that corresponding to periodic billing snapshot data, the preset verification strategy corresponding to settlement billing snapshot data has a higher verification strength than that corresponding to event billing snapshot data, and the preset verification strategy corresponding to security billing snapshot data has a higher verification strength than that corresponding to settlement billing snapshot data.

[0091] The charging equipment performs corresponding verification operations on the billing snapshot data according to the predetermined preset verification strategy, and obtains the verification result based on the execution results of each verification operation. If all verification operations pass, the charging equipment obtains a verification result indicating that the verification has passed; if any verification operation fails, the charging equipment obtains a verification result indicating that the verification has failed.

[0092] Step S108: If the verification result is that the verification is successful, the device to be charged will be powered off and then recharged.

[0093] In its implementation, after obtaining the signature verification result, the charging device judges the result. When the charging device determines that the signature verification is successful, meaning that the current billing snapshot data has passed all verification operations of the corresponding preset signature verification strategy, the charging device immediately executes the interrupted charging resume operation for the device to be charged. During the interrupted charging resume process, the charging device uses the amount of charge recorded in the billing snapshot data that has passed the signature verification as the starting point and continues to accumulate the subsequent charging amount and cost, thereby resuming charging from the point of interruption without having to start billing from the beginning.

[0094] Reference Figure 4 , Figure 4 This is a flowchart illustrating the third embodiment of the breakpoint resume charging method of this application. Based on the above embodiments, the third embodiment of the breakpoint resume charging method of this application is proposed.

[0095] To further enhance the security of the recharge process beyond signature verification, in this embodiment, the step of storing the billing snapshot data and the first signature value into a non-volatile storage medium includes: Step S211: Assign a monotonically increasing sequence number to the billing snapshot data.

[0096] It is understandable that the aforementioned sequence number can be a unique number assigned by the charging device to each generated billing snapshot data, used to uniquely identify different snapshots within the same charging session. The monotonically increasing nature of the sequence number can mean that its value gradually increases with each snapshot data generation; for example, the sequence number is incremented by 1 each time a new snapshot is generated, ensuring that the sequence number corresponding to later-generated snapshot data is greater than that corresponding to earlier-generated snapshot data. This monotonically increasing characteristic of the sequence number allows for the differentiation of the order in which snapshot data is generated.

[0097] In its implementation, the charging device assigns a monotonically increasing sequence number to each billing snapshot data generated. Internally, the charging device maintains a global counter, initialized to 0 or a preset starting value. Whenever a new billing snapshot data is generated, the charging device reads the current counter value as the sequence number of the current snapshot data, and increments the counter by 1 after assignment, ensuring that the next generated snapshot data receives a larger sequence number. Through this method, the charging device ensures that billing snapshot data generated at different times within the same charging session have different sequence numbers, and that the sequence numbers reflect the order in which the snapshot data was generated.

[0098] Step S212: Store the serial number in the non-volatile storage area of ​​the battery domain, the snapshot storage area of ​​the non-volatile storage medium, and the anchor table of the non-volatile storage medium, respectively.

[0099] It should be noted that the aforementioned battery domain non-volatile storage area can be a non-volatile storage area powered by the battery domain, such as battery-backed static random access memory (BKPSRAM). This storage area is powered by the battery after the main power is cut off, and the data is not lost, but the data will be lost when the battery is removed.

[0100] It should also be noted that the snapshot storage area of ​​the aforementioned non-volatile storage medium can be a region within the non-volatile storage medium specifically used for storing billing snapshot data, such as the snapshot parameter area in a Flash memory. The anchor table of the aforementioned non-volatile storage medium can be an independent region within the non-volatile storage medium used for storing sequence number watermark copies and hash chain anchors. This region is physically isolated from the snapshot storage area, and the data within it is protected by a hash chain.

[0101] In its implementation, after generating new billing snapshot data and assigning it a serial number, the charging device stores the serial number in three physically independent storage areas. First, the charging device stores the serial number in the battery domain's non-volatile storage area. This area is powered by the battery, and the data is retained even after the main power supply is cut off, but is lost when the battery is removed. Second, the charging device stores the serial number in the snapshot storage area of ​​the non-volatile storage medium, specifically in the serial number field embedded within the currently generated billing snapshot data, and persists it along with the billing snapshot data. Finally, the charging device stores the serial number in the anchor table of the non-volatile storage medium. This anchor table is independent of the snapshot storage area and is specifically used to record serial number watermark copies. The data in the anchor table is protected by a hash chain; adjacent anchors are linked through hash operations, ensuring that the hash chain becomes discontinuous if any anchor is modified individually. By storing the serial number in the three physically independent areas mentioned above, even if an attacker clears the non-volatile storage area of ​​the battery domain or rewrites the serial number in the snapshot storage area by removing the battery, the charging device can still obtain the unaffected serial number level from the anchor table, thereby effectively detecting rollback attacks targeting the serial number.

[0102] Before the step of resuming charging of the device to be charged based on the verification result, the method further includes: Step S041: If the verification result is successful, read the corresponding serial numbers from the battery domain non-volatile storage area, the snapshot storage area, and the anchor table, and take the largest serial number among the serial numbers as the target serial number.

[0103] It is understandable that the target sequence number mentioned above can be the maximum value obtained by taking the sequence number read from the non-volatile storage area of ​​the battery domain, the snapshot storage area, and the anchor table, and is used to compare with the sequence number to be verified in the current billing snapshot data to detect whether there is a rollback attack.

[0104] In its implementation, if the verification result returned by the safe enclave is successful, the charging device reads the stored serial number from the non-volatile storage area of ​​the battery domain, the serial number embedded in the current billing snapshot data from the snapshot storage area of ​​the non-volatile storage medium, and the stored serial number from the anchor table of the non-volatile storage medium. After reading the corresponding serial numbers from the above three areas, the charging device compares these three serial numbers and selects the serial number with the largest value as the target serial number.

[0105] Step S042: Compare the sequence number to be verified in the current billing snapshot data with the target sequence number to obtain the comparison result, and use the comparison result as the new verification result.

[0106] It should be understood that the aforementioned serial number to be verified can be the serial number carried in the current billing snapshot data, that is, the number assigned when the snapshot data is generated, which is used to compare with the target serial number to determine whether the current snapshot is the latest version.

[0107] It is also important to understand that the comparison result mentioned above can be a comparison of the size relationship between the sequence number to be verified and the target sequence number, such as the sequence number to be verified being less than the target sequence number, or the sequence number to be verified being greater than or equal to the target sequence number. The new verification result mentioned above can be a comprehensive verification result obtained by adding the comparison result as supplementary verification information to the original signature verification result, and is used to indicate whether the current snapshot has passed the rollback detection.

[0108] In its implementation, the charging device reads the corresponding serial numbers from the battery domain non-volatile storage area, snapshot storage area, and anchor table, respectively, and selects the maximum value as the target serial number. Then, it compares the serial number to be verified in the current billing snapshot data with the target serial number to obtain the comparison result. If the serial number to be verified is less than the target serial number, it indicates that the serial number of the current billing snapshot data is lower than the highest watermark value stored in the three historical areas. The current billing snapshot data may be an old version of billing snapshot data that has been rolled back, and the charging device determines that there is a risk of a rollback attack. If the serial number to be verified is greater than or equal to the target serial number, it indicates that the serial number of the current billing snapshot data is not lower than the highest watermark value in the historical records. The current snapshot is the latest snapshot version, and there is no risk of a rollback attack.

[0109] The charging device uses the comparison result as the new verification result, that is, the combined result of signature verification and rollback detection is output as the new verification result to determine whether to perform the interrupted charging resume operation. If the comparison result indicates that the serial number to be verified is greater than or equal to the target serial number, the new verification result is that the verification is passed, and the charging device allows the interrupted charging resume operation; if the comparison result indicates that the serial number to be verified is less than the target serial number, the new verification result is that the verification is failed, and the charging device prohibits the interrupted charging resume operation.

[0110] Reference Figure 5 , Figure 5 This is a flowchart illustrating the serial number rollback prevention verification process of this application, as shown below. Figure 5 As shown, the serial number water level in this application adopts a three-redundant storage method (i.e. Figure 5 There are three redundancies in the seq_no watermark. Specifically, the first storage location of the sequence number watermark is the non-volatile memory area of ​​the battery domain (i.e., the fly area). Figure 5 Location 1 in the sequence number is the BKPSRAM fly area. This area is powered by VBAT and data is retained after the main power is cut off, but data will be lost if the battery is removed. The second storage location of the sequence number is the snapshot storage area of ​​non-volatile storage media (i.e., Figure 5 Location 2: Embedded in the current Flash snapshot. This serial number is stored within the billing snapshot data as part of the billing snapshot data and is protected by an HMAC signature. Attackers cannot forge the corresponding signature value after tampering with the snapshot data. The third storage location for the serial number is the anchor table of the non-volatile storage medium (i.e., Figure 5 Position 3 in the middle (Flash anchor table version), this area synchronously records the current sequence number water level each time the hash chain is anchored.

[0111] After reading the corresponding serial numbers from the three locations mentioned above, the charging device takes the maximum value among the three serial numbers as the valid baseline (i.e., Figure 5 The maximum value among the three points is taken as the valid baseline. The reason for taking the maximum value as the valid baseline is that the serial number is a monotonically increasing number. An attacker can only reduce the water level at a certain point (such as overwriting the current snapshot with an old snapshot) or clear it to zero (such as removing the battery to clear BKPSRAM), but cannot increase the water level. Therefore, the maximum value among the three points is closest to the current real serial number water level.

[0112] After determining a valid baseline, the charging device compares the sequence number to be verified in the current billing snapshot data with that valid baseline (i.e., Figure 5 The question mark in the image is "new snapshot seq_no>baseline?". If the sequence number to be verified is greater than or equal to the valid baseline, it means that the current snapshot is the latest version, the charging device determines that there is no rollback attack, and accepts the current snapshot (i.e., ...). Figure 5 The "Accept" option allows for resume charging from where it left off. If the sequence number to be verified is less than the valid baseline, it means that the sequence number of the current snapshot is lower than the highest watermark value stored in the three regions. The current snapshot may be an old version snapshot that has been rolled back. The charging device determines that a rollback attack has occurred and rejects the current snapshot (i.e., ...). Figure 5 The message "Rejected (suspected rollback)" indicates that the current interrupted charging session cannot be resumed.

[0113] This embodiment assigns monotonically increasing sequence numbers to billing snapshot data and stores these sequence numbers in three physically independent areas: the battery domain non-volatile storage area, the snapshot storage area of ​​the non-volatile storage medium, and the anchor table of the non-volatile storage medium. During the breakpoint charging recovery phase, the sequence numbers are read from these three areas respectively, and the maximum value is taken as the target sequence number. This target sequence number is compared with the sequence number to be verified in the current billing snapshot data to detect whether a rollback has occurred. This ensures that if an attacker attempts to perform a rollback attack by removing the battery to clear the battery domain non-volatile storage area, rewriting the sequence number in the snapshot storage area, or modifying the water level copy in the anchor table, the attacker must simultaneously tamper with the sequence numbers in all three areas and maintain the continuity of the hash chain to bypass the detection, since the three areas are physically isolated and the anchor table is protected by a hash chain. This effectively prevents attackers from resetting the billing state by rolling back old snapshots, further enhancing the security of the breakpoint charging process.

[0114] To improve the reliability of data storage during the billing snapshot data storage process, in this embodiment, the step of storing the billing snapshot data and the first signature value into a non-volatile storage medium includes: Step S221: Create a data copy of the billing snapshot data and the first signature value.

[0115] Step S222: Write the billing snapshot data and the first signature value into the first sector of the non-volatile storage medium.

[0116] It should be noted that the aforementioned data copy can be a copy of the data created in memory by the charging device before writing the billing snapshot data and the first signature value to the non-volatile storage medium, and is completely identical to the original data content. The aforementioned first sector can be a physical storage unit in the non-volatile storage medium used to store data, such as a physical sector in a Flash memory, which has a specific starting address and storage space size.

[0117] In its implementation, after obtaining the billing snapshot data and the first signature value, the charging device creates a data copy of the billing snapshot data and the first signature value in memory. The content of this data copy is exactly the same as the original data.

[0118] After creating a data copy, the charging device writes the billing snapshot data and the first signature value to the first sector of the non-volatile storage medium. The first sector is the primary copy write location determined by the charging device based on the current storage pointer. During the write process, the charging device moves the billing snapshot data and the first signature value from memory to the physical storage address of the first sector.

[0119] In another specific implementation, before writing the billing snapshot data and the first signature value to the first sector, the charging device can first read the currently stored old snapshot record in the first sector and submit the old snapshot record to the security enclave for integrity verification. The charging device will only execute the step of writing the new billing snapshot data and the first signature value to the first sector if the integrity verification of the old snapshot record passes, to ensure that the old snapshot has not been tampered with before being overwritten. If the integrity verification of the old snapshot record fails, that is, the old snapshot has been tampered with, the charging device will trigger an alarm and suspend the overwrite operation, retaining evidence of tampering for subsequent auditing.

[0120] Step S223: After the write is completed, perform write verification on the first sector to obtain the first write verification result, and wait for the preset write time interval if the first write verification result indicates that the write was successful.

[0121] It should be noted that the above-mentioned write verification can be a series of verification operations performed on a specified sector after data is written to a non-volatile storage medium, in order to confirm whether the written data is correctly and completely stored in the target sector.

[0122] It should also be noted that the aforementioned first write verification result can be the verification result obtained after performing a write verification on the first sector, and this result includes two states: write success or write failure. The aforementioned preset write time interval can be a pre-set waiting time length, such as 5 seconds, used to introduce a time delay after the primary replica write is completed and before the secondary replica write begins.

[0123] In its implementation, after writing the billing snapshot data and the first signature value to the first sector, the charging device performs a write verification on the first sector. The charging device can read back the written data from the first sector and compare the read-back data with the original data to verify whether the data was written correctly. After completing the write verification, the charging device obtains the first write verification result. If the first write verification result indicates successful writing, confirming that the billing snapshot data and the first signature value have been correctly written to the first sector, the charging device then begins waiting for a preset write time interval. During this preset write time interval, the charging device does not perform the write operation on the secondary copy but remains in a waiting state. The purpose of this waiting operation is to create a time difference between the write time of the primary copy (first sector) and the write time of the subsequent secondary copy (second sector), thereby avoiding two writes being too close in time and preventing a single power outage from simultaneously damaging both copies. If a power outage occurs during the waiting period, since the primary copy has been successfully saved, the charging device can read the data from the primary copy after power is restored.

[0124] Step S224: After the preset write time interval ends, the data copy is written to the second sector in the non-volatile storage medium, and the write verification is performed on the second sector after the write is completed to obtain the second write verification result.

[0125] It should be understood that the aforementioned second sector may be another physical storage unit in a non-volatile storage medium that is different from the first sector, such as another physical sector in a Flash memory. The second sector is located at a different physical address from the first sector, and the two sectors are separated by at least one sector.

[0126] In its implementation, after a preset write interval, the charging device writes a copy of the data stored in memory to a second sector in a non-volatile storage medium. The second sector and the first sector are located at different physical addresses, and are separated by at least one sector, ensuring that the two copies are physically isolated. After the write operation is complete, the charging device performs a write verification on the second sector to obtain a second write verification result.

[0127] Step S225: If the second write verification result is successful, complete the storage of the billing snapshot data and the first signature value into the non-volatile storage medium.

[0128] In its specific implementation, after obtaining the second write verification result, the charging device judges the second write verification result. When the charging device determines that the second write verification result is successful, it confirms that the billing snapshot data and the first signature value have been correctly and completely written to the second sector. The charging device then completes the entire process of storing the billing snapshot data and the first signature value to the non-volatile storage medium.

[0129] At this point, the first and second sectors of the non-volatile storage medium each hold a complete and identical snapshot record. Even if one sector suffers physical damage or data loss, the charging device can still read the snapshot data and the corresponding first signature value from the other sector, ensuring reliable storage of the billing snapshot data. If the second write verification result is a write verification failure, indicating an error in writing data to the second sector, the charging device can perform exception handling, such as retrying to write to the second sector or reporting storage exception information.

[0130] In addition, after completing the snapshot data writing, the charging device updates the storage pointer, causing it to point to the next available sector. During multiple snapshot storage operations, the storage pointer moves sequentially, cyclically using multiple sectors to achieve wear leveling and prevent the same sector from being prematurely damaged due to frequent erasing and writing.

[0131] This embodiment creates data copies of the billing snapshot data and the first signature value, writes the original data to the first sector in a non-volatile storage medium, and waits for a preset write time interval after the write verification of the first sector is passed before writing the data copy to a second sector that is physically isolated from the first sector. This isolates the primary copy and the secondary copy in terms of storage location and creates a write time difference between the primary copy and the secondary copy. This avoids the risk of the primary copy and the secondary copy being damaged simultaneously when power is lost during a single write operation, effectively preventing the permanent loss of snapshot data due to a single point of storage failure and improving the reliability of billing snapshot data storage.

[0132] Reference Figure 6 , Figure 6 This is a flowchart illustrating the process of starting the resume charging verification in this application, as shown below. Figure 6 As shown, after the system is powered on, the charging device first reads the snapshot data stored in the primary copy of the non-volatile storage medium and the corresponding HMAC signature value (i.e., ... Figure 6 The "Read Flash Primary Copy Snapshot + HMAC" function in the charging device determines whether the primary copy is complete and readable (i.e., ...). Figure 6 The primary copy is fully readable. If the primary copy is fully readable, the charging device directly uses the billing snapshot data and HMAC signature value from the primary copy for subsequent signature verification. If the primary copy is incomplete or unreadable, the charging device reads the billing snapshot data and corresponding HMAC signature value stored in the secondary copy (i.e., ...). Figure 6 The "Read Flash Sub-copy Snapshot + HMAC" function uses the data in the sub-copy for subsequent signature verification processes.

[0133] After successfully reading the billing snapshot data and the corresponding HMAC signature value, the charging device checks whether the snapshot exists and whether its format is valid (i.e., Figure 6 (The snapshot must exist and be in a valid format). If the snapshot does not exist or is invalid, the charging device will indicate that there is no need for further charging and will start normally, and then proceed with the normal startup process.

[0134] If a snapshot exists and is in a valid format, the charging device initiates a signature verification request to the secure enclave (i.e., Figure 6 The "Enclave API Request Signature Verification" in the context of the secure enclave performs consistency verification on the snapshot data and the corresponding HMAC signature value (i.e., Figure 6 The system will display "HMAC verification passed" (or "HMAC signature consistent"). If the HMAC verification is inconsistent, it will be judged as "no," and the signature verification will fail. The charging device will be marked as unable to continue charging, and the audit record will be tampered with (i.e.,...). Figure 6 The system flags "unrenewable charging audit log tampering" and triggers a security policy alert, then waits for the user to reconnect the charging device before resuming billing from the beginning (i.e., ...). Figure 6 The system displays "User plugs in the gun and bills from the beginning" (meaning the user is charged from the beginning), and the charging equipment starts normally after the user confirms.

[0135] If the HMAC verification is consistent and the signature verification passes, the charging device reads the serial number water level values ​​from three locations (i.e., Figure 6 The text mentions "reading three seq_no water levels" and verifying whether the sequence number in the current snapshot is not less than the maximum value among the three water levels, and whether the snapshot timestamp is within the preset time window (i.e., ...). Figure 6 The requirement is that "seq_no is not less than the maximum water level and the timestamp is within the window". If the sequence number is less than the maximum water level or the timestamp exceeds the preset time window, the verification fails, the charging device is marked as unavailable for further charging, and the audit log is abnormal (i.e., ...). Figure 6 The system flags the charging device as "unable to continue charging (audit record abnormality)" and triggers a rollback notification. It then waits for the user to plug in the charging gun before resuming billing. After user confirmation, the charging device starts normally. If the serial number is not less than the maximum water level and the timestamp is within the preset time window, the verification passes, the charging device is marked as capable of continuing charging, and waits for the user to plug in the charging gun (i.e., ...). Figure 6 The "marked as ready for continued charging, waiting for user to plug in the charging gun" indicates this. Once the user plugs in the charging gun, the charging device performs a step-by-step charging process (i.e., ...). Figure 6 The "user plugs in the charging gun and continues charging" option allows charging to resume from the point of interruption.

[0136] Furthermore, this application also proposes a storage medium, which is a computer-readable storage medium, storing a computer program on the storage medium. When the computer program is executed by a processor, it implements the steps of the breakpoint resume charging method described above.

[0137] In addition, refer to Figure 7 , Figure 7 This is a structural block diagram of the recharge device for interrupted charging in this application. Figure 7 As shown in the embodiments of this application, a breakpoint charging resume device is also proposed, which includes: The data storage module 701 is used to submit the billing snapshot data to the secure enclave, so that the secure enclave uses the target signature key corresponding to this charging process to generate a first signature value corresponding to the billing snapshot data, and stores the billing snapshot data and the first signature value in a non-volatile storage medium; The result acquisition module 702 is used to read the current billing snapshot data and the first signature value from the non-volatile storage medium and submit them to the secure enclave when a breakpoint charging is detected, so that the secure enclave uses the target signature key to generate a second signature value corresponding to the current billing snapshot data and verifies the first signature value and the second signature value, and returns the verification result. The interrupted charging module 703 is used to perform interrupted charging of the device to be charged according to the verification result.

[0138] Other embodiments or specific implementations of the interrupted charging device described in this application can be found in the above-described method embodiments, and will not be repeated here.

[0139] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0140] The sequence numbers of the embodiments in this application are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0141] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as a read-only memory image (ROM) / random access memory (RAM), magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0142] The above are merely preferred embodiments of this application and do not limit the patent scope of this application. Any equivalent structural or procedural transformations made using the content of this application's specification and drawings, or direct or indirect applications in other related technical fields, are similarly included within the patent protection scope of this application.

Claims

1. A method for resuming charging after a breakpoint, characterized in that, The method is applied to charging equipment equipped with a safe enclave, and the method includes: During the charging process, billing snapshot data of the device to be charged is generated according to preset trigger conditions. The billing snapshot data represents the current charging record of the device to be charged. The billing snapshot data is submitted to the secure enclave, so that the secure enclave uses the target signature key corresponding to this charging process to generate a first signature value corresponding to the billing snapshot data, and stores the billing snapshot data and the first signature value in a non-volatile storage medium; If a breakpoint is detected and charging resumes, the current billing snapshot data and the first signature value are read from the non-volatile storage medium and submitted to the secure enclave. The secure enclave then uses the target signature key to generate a second signature value corresponding to the current billing snapshot data and verifies the first signature value and the second signature value, returning the verification result. Based on the verification results, the device to be charged is recharged after interruption.

2. The method as described in claim 1, characterized in that, The step of resuming charging of the device to be charged based on the verification result includes: If the verification result is successful, the system receives the usage authorization certificate returned by the secure enclave and resumes charging the device that needs to be charged. After the step of resuming charging of the device to be charged based on the verification result, the method further includes: After the interrupted charging is completed, an order signature request with an authorization certificate to be verified is submitted to the secure enclave, so that the secure enclave can verify the authorization certificate to be verified using the authorization certificate and return the certificate verification result; If the voucher verification result is a voucher verification failure, settlement of the current order corresponding to the order signature request shall be prohibited.

3. The method as described in claim 1, characterized in that, The step of submitting the billing snapshot data to the secure enclave, so that the secure enclave uses the target signature key corresponding to this charging process to generate the first signature value corresponding to the billing snapshot data, includes: In the event of a secure enclave information acquisition request, the master key of the charging device, the unique identifier of the charging device, and the charging process identifier of the current charging process are transmitted to the secure enclave, so that the secure enclave generates the target signature key based on the master key, the unique identifier, the charging process identifier, a preset random number, and the sequence number, and generates the first signature value corresponding to the billing snapshot data based on the target signature key.

4. The method as described in claim 1, characterized in that, The step of generating billing snapshot data of the device to be charged according to preset trigger conditions includes: Generate periodic billing snapshot data for the devices to be charged according to a preset cycle; Collect the incremental amount of charge of the device to be charged and the current charging status of the device to be charged, and generate event billing snapshot data of the device to be charged when the incremental amount of charge is greater than a preset charge threshold and / or the current charging status changes; Upon detecting that the current charging process has ended, a billing snapshot of the device to be charged is generated; In the event of a detected system outage or the current order amount exceeding a preset threshold, a safety billing snapshot of the device to be charged is generated. The periodic billing snapshot data, the event billing snapshot data, the settlement billing snapshot data, and the security billing snapshot data are sorted according to a preset priority order, and the billing snapshot data with the highest priority is selected from the sorting results as the billing snapshot data of the device to be charged.

5. The method as described in claim 4, characterized in that, After the step of selecting the highest priority billing snapshot data from the sorting results as the billing snapshot data of the device to be charged, the method further includes: Determine the data type of the billing snapshot data; The billing snapshot data is verified according to the data type and the corresponding preset verification strategy to obtain the verification result. The preset verification strategies for different data types are different. If the verification result is successful, the device to be charged will be powered off and then recharged.

6. The method as described in claim 1, characterized in that, The step of storing the billing snapshot data and the first signature value into a non-volatile storage medium includes: Assign monotonically increasing sequence numbers to the billing snapshot data; The serial number is stored in the non-volatile storage area of ​​the battery domain, the snapshot storage area of ​​the non-volatile storage medium, and the anchor table of the non-volatile storage medium, respectively. Before the step of resuming charging of the device to be charged based on the verification result, the method further includes: If the verification result is successful, the corresponding serial numbers are read from the non-volatile storage area of ​​the battery domain, the snapshot storage area, and the anchor table, and the largest serial number among the serial numbers is taken as the target serial number. The sequence number to be verified in the current billing snapshot data is compared with the target sequence number to obtain the comparison result, and the comparison result is used as the new verification result.

7. The method as described in claim 1, characterized in that, The step of storing the billing snapshot data and the first signature value into a non-volatile storage medium includes: Create a data copy of the billing snapshot data and the first signature value; Write the billing snapshot data and the first signature value into the first sector of the non-volatile storage medium; After the write is completed, the first sector is verified to obtain the first write verification result, and if the first write verification result is that the write was successful, the system waits for a preset write time interval. After the preset write time interval ends, the data copy is written to the second sector in the non-volatile storage medium, and the write verification is performed on the second sector after the write is completed to obtain the second write verification result; If the second write verification result is successful, the billing snapshot data and the first signature value are stored in the non-volatile storage medium.

8. A device for resuming charging after interruption, characterized in that, The device includes: The data generation module is used to generate billing snapshot data of the device to be charged according to preset trigger conditions during the charging process. The billing snapshot data represents the current charging record of the device to be charged. The data storage module is used to submit the billing snapshot data to the secure enclave, so that the secure enclave uses the target signature key corresponding to this charging process to generate a first signature value corresponding to the billing snapshot data, and stores the billing snapshot data and the first signature value in a non-volatile storage medium; The result acquisition module is used to read the current billing snapshot data and the first signature value from the non-volatile storage medium and submit them to the secure enclave when a breakpoint charging is detected, so that the secure enclave can use the target signature key to generate a second signature value corresponding to the current billing snapshot data and verify the first signature value and the second signature value, and return the verification result. The interrupted charging module is used to resume charging of the device to be charged based on the verification result.

9. A device for resuming charging after interruption, characterized in that, The device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, the computer program being configured to implement the steps of the interrupted charging method as described in any one of claims 1 to 7.

10. A storage medium, characterized in that, The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, it implements the steps of the breakpoint resume charging method as described in any one of claims 1 to 7.

Images