A remote prepayment electricity selling system and method

Abstract

The application relates to a remote prepayment electricity selling system, which comprises a data server, a concentrator, a front-end server and a smart meter, the data server is connected with a client through a network, the front-end server is connected with the data server and the concentrator, the concentrator is in communication connection with the smart meter, a key management module and a recharge transaction module are built in the data server, the key management module can generate a root key, a meter master key and a session key, and the root key is stored offline and cannot be exported in plaintext. In the application, a three-layer dynamic key system of the root key, the meter master key and the session key is constructed, the root key is stored offline and isolated, and the meter master key does not participate in network transmission, so that the risk of core key leakage is eliminated from the root source; the session key is valid for single transaction, and is one-time one-key, even if a single message is intercepted, the core key cannot be cracked or used for other transactions.

Description

Technical Field

[0001] This invention relates to the field of electricity information collection and prepaid metering technology, specifically a remote prepaid electricity sales system and method. Background Technology

[0002] Prepaid electricity sales are one of the core business models of electricity marketing in China. The "pay first, use later" mechanism effectively reduces the risk of electricity bill collection. Early prepaid systems relied on IC cards as the recharge medium. Users had to go to offline business halls to purchase electricity and write the card, and then insert the IC card into the meter to complete the balance writing. This resulted in problems such as few payment outlets, long waiting times, and cumbersome operation procedures, which increased the time cost for users and also increased the operation and maintenance management pressure on power supply companies.

[0003] To overcome the physical limitations of IC card-based electricity sales, the industry has gradually developed remote prepaid electricity sales technology. A typical solution is the invention patent with authorization announcement number CN104134286B, which discloses a remote prepaid electricity sales system and method. Users can submit recharge information online through a client, which is then encrypted by the server and sent to the electricity meter via a front-end processor and concentrator. After the electricity meter verifies the key match, the electricity sale is completed and the result is returned. It also includes handheld device anomaly handling and balance reminder functions. This solution enables remote online recharge, breaking through the spatial limitations of the IC card medium.

[0004] With the continuous deepening of smart grid construction and the constant upgrading of network security attack methods, the aforementioned existing technologies still have the following shortcomings in practical large-scale applications: 1. Weak key security system and insufficient protection level. Existing technologies use "meter address + fixed encryption factor" to generate static keys. The key remains unchanged throughout the entire life cycle of the meter, and all recharge transactions reuse the same key. On the one hand, if the encryption factor database on the server side is leaked, it will cause all meter keys in the corresponding area to become invalid in batches, triggering systemic financial risks; on the other hand, the key directly participates in message transmission, and there is a possibility that it can be intercepted and cracked by the network. Once the key is cracked, it can permanently control a single meter. 2. The system architecture has many single points of failure and obvious reliability shortcomings. Existing technology employs a serial, single-link architecture of "data server - front-end machine - concentrator - meter." Both the front-end machine and concentrator are deployed at single points; the failure of a single device can cause all meters within its jurisdiction to be unable to recharge, resulting in an exponentially expanding impact. Furthermore, the concentrator and meters rely solely on a single power line carrier or wireless channel for communication, leading to decreased recharge success rates in scenarios such as grid harmonic interference and building signal obstruction. 3. Recharge transactions lack transaction control, resulting in high data consistency risks. As electricity sales channels expand from a single client to multiple parallel channels such as online mini-programs, offline self-service terminals, and maintenance handheld devices, existing technology lacks a complete transaction atomicity control mechanism. This easily leads to financial losses such as "funds deducted but meter balance not credited" or "meter balance written but server not recorded." The lack of idempotency verification during concurrent multi-channel recharges makes network retransmissions and simultaneous recharges from multiple terminals prone to duplicate recharges and balance calculation errors. When handheld devices synchronize after offline operation, data conflicts with server-side records are easily generated, making it difficult to trace and correct balance discrepancies. Summary of the Invention

[0005] (a) Technical problems to be solved

[0006] This invention provides a remote prepaid electricity sales system and method, which solves the problems mentioned in the background art.

[0007] (II) Technical Solution

[0008] To achieve the above objectives, the present invention provides the following technical solution: a remote prepaid electricity sales system, comprising a data server, a concentrator, a front-end server, and a smart meter. The data server connects to clients via a network, the front-end server connects the data server and the concentrator, and the concentrator communicates with the smart meter. The data server has a built-in key management module and a recharge transaction module. The key management module can generate a root key, a meter master key, and a session key. The root key is stored offline and not exported in plaintext. The meter master key is encrypted and derived from the root key using the meter address as a dispersion factor, burned into the smart meter during the meter production stage, and does not participate in network transmission. The session key is dynamically derived from the meter master key combined with a random number and a timestamp, and is valid for a single transaction. The second-highest level of encryption is used; the recharge transaction module can perform two phases: pre-submission and confirmation; the concentrator is the main data acquisition node for the distribution area, and the distribution area also deploys an edge gateway as a backup data acquisition node. The two cover the smart meters in the same distribution area, forming a primary and backup redundant data acquisition structure; the front-end server is a distributed access cluster composed of multiple access gateways through load balancing. The front-end server has a built-in link status monitoring module, which is used to statistically analyze link quality indicators and predict faults. The link status monitoring module can realize automatic switching of three-level redundant paths: main link, backup link, and fallback link; the smart meter has a built-in secure storage module that divides the pre-stored balance area into a pre-stored balance area and a formal balance area. The pre-stored balance area is used to temporarily store the recharge amount in the pre-submission phase, and after confirmation, it is transferred to the formal balance area.

[0009] Preferably, the working mechanism of the root key, meter master key, and session key in the key management module is set as follows: the root key is a 128-bit true random number with an update cycle of 12 months; the meter master key is generated using the SM1 block cipher algorithm, and is derived from the root key by encryption using the meter address as a scattering factor, ensuring uniqueness per meter; the session key is generated using the SM1 block cipher algorithm, and is derived from the meter master key by encryption using a random number and a timestamp as derivation factors; the recharge message adopts a plaintext header, ciphertext body, and MAC check structure, with the random number and timestamp carried in plaintext in the message header, and the session key is not directly transmitted but is independently calculated and generated by the sender and receiver based on the locally stored master key.

[0010] In a further preferred embodiment, during the pre-submission phase, the recharge transaction module freezes the corresponding recharge funds in the user account, issues a pre-recharge instruction, and after the smart meter verifies the recharge, writes the recharge amount into the pre-deposited balance area and returns a pre-success response; during the confirmation and effectiveness phase, the recharge transaction module issues a confirmation instruction, the smart meter transfers the pre-deposited balance into the formal balance area, returns a confirmation success response, and the recharge transaction module completes the formal crediting of funds; any timeout retry failure at any stage triggers a rollback operation, unfreezing the frozen funds or clearing the corresponding pre-deposited balance; after the smart meter reconnects offline, it automatically performs reconciliation and correction, synchronizing the transaction status of both ends.

[0011] In a further preferred embodiment, the secure storage module is equipped with a three-copy storage structure. The three-copy storage structure divides the smart meter into three independent storage blocks with different address intervals. Each storage block stores balance data, key data, electricity price parameters, and a serial number queue. Each storage block also has an independent HMAC-SM3 integrity check value. When writing critical data, it is written to all three storage blocks simultaneously, and the corresponding check value is calculated for each block. When reading critical data, the integrity of each storage block is checked separately, and a two-out-of-three majority vote is performed on the valid storage blocks to output the final valid data.

[0012] In a further preferred embodiment, the smart meter is also equipped with an open cover detection module and a metering cross-verification unit. When the open cover detection module is triggered, it performs relay power-off, data backup, and enters a security lock state. The metering cross-verification unit identifies tampering behavior by comparing the electricity fee calculated from the metering pulse with the actual deducted amount.

[0013] In a further preferred embodiment, the automatic switching mechanism for the three-level redundant paths (main link, backup link, and fallback link) in the link status monitoring module is as follows: the main link is a data server connected to the smart meter via a distributed access cluster and a concentrator, and the main link is the default service channel; the backup link is a data server directly connected to the smart meter via a distributed access cluster, and the service channel automatically switches to the backup link when the concentrator is offline or the quality of the main link is lower than a preset threshold; the fallback link is a handheld maintenance terminal connected locally to the smart meter, and recharging is completed on-site via the handheld maintenance terminal when the main link or backup link fails.

[0014] This invention also provides the following technical solution: a remote prepaid electricity sales method, comprising the following steps:

[0015] S1. A three-layer dynamic key system of root key, meter master key and session key is pre-built. The root key is stored offline in the hardware encryption machine. The meter master key is derived and burned to the local of the smart meter. The session key is dynamically generated during a single transaction.

[0016] S2. After a user initiates a recharge request, the pre-submission stage is executed first, freezing the corresponding funds and issuing a pre-recharge instruction. The smart meter temporarily stores the recharge amount in the pre-deposit balance area. After the pre-submission is successful, the confirmation and effectiveness stage is executed, issuing a confirmation instruction. The smart meter transfers the pre-deposit balance to the formal balance, completing the formal crediting of funds. If any stage fails, a rollback operation is automatically executed.

[0017] S3. Real-time monitoring of link quality through distributed access clusters; automatic switch to backup link when primary link fails; triggering backup link maintenance when primary or backup link fails.

[0018] S4. Smart meters use three copies of non-continuous storage for critical data, combined with integrity verification and majority voting mechanisms to prevent data tampering, and combine cover opening detection and meter cross-verification to protect against physical attacks.

[0019] Prior to this, the generation and use of the three-layer dynamic key in step S1 specifically includes the following steps:

[0020] S11. An offline 128-bit true random number is generated as the root key and stored in the secure partition of the hardware encryption machine. The update cycle is 12 months.

[0021] S12. Using the meter address as the dispersion factor, the root key is used to encrypt and derive a unique master key for each meter through the SM1 block cipher algorithm. The master key is burned into the smart meter's secure storage area during the production stage, hardware read protection is enabled, and the master key does not participate in network transmission.

[0022] S13. During each recharge transaction, a random number and timestamp are generated as derivation factors. The session key is derived by encrypting the meter master key. The session key is only valid for this transaction. The random number and timestamp are carried in plaintext in the message header. The sender and receiver calculate the session key independently. The session key itself is not directly transmitted in the network.

[0023] In a further preferred embodiment, the two-stage recharge transaction in step S2 specifically includes the following steps:

[0024] S21, Pre-submission stage: The recharge transaction module receives the user's recharge request, generates a globally unique serial number, freezes the corresponding funds in the user's account, generates a pre-recharge ciphertext and sends it to the smart meter; after the smart meter decrypts and verifies the data, it writes the recharge amount into the pre-stored balance area, records the serial number, and returns a pre-success response.

[0025] S22. Confirmation of effectiveness stage: After receiving the pre-success response, the recharge transaction module issues a confirmation of effectiveness instruction; after receiving the instruction, the smart meter transfers the corresponding pre-deposited balance to the formal balance area and returns a confirmation of success; the recharge transaction module completes the formal crediting of funds and updates the transaction status to completed.

[0026] S23. If no response is received after any timeout, the exponential backoff strategy will be used to retry. If the retry fails, a rollback will be triggered to unfreeze the frozen funds or clear the corresponding pre-deposited balance of the smart meter.

[0027] S24. After the smart meter reconnects offline, it actively reports the status of unfinished transactions locally. The recharge transaction module reissues confirmation or rollback instructions to complete the synchronization of status between the two ends.

[0028] In a further preferred embodiment, step S3 specifically includes the following steps:

[0029] S31. The distributed access cluster uses a 10-minute sliding window and a 1-minute step size to statistically analyze the communication success rate, average latency, and packet loss rate of each link in real time.

[0030] S32. When three consecutive sliding window indicators are lower than the preset threshold, a link failure is predicted, and the service is switched to the backup link in advance.

[0031] S33. When the main link fails, it automatically switches to the backup link and sends a recharge command through the smart meter's wireless module.

[0032] S34. If the backup link still fails to recharge, it is determined that the entire link has failed. An operation and maintenance work order is automatically generated and dispatched to the handheld operation and maintenance terminal, and the operation and maintenance personnel perform the backup link recharge on-site through the operation and maintenance terminal.

[0033] (III) Beneficial Effects

[0034] Compared with the prior art, the present invention provides a remote prepaid electricity sales system and method, which has the following beneficial effects:

[0035] In this invention, a three-layer dynamic key system is constructed, consisting of a root key, a meter master key, and a session key. The root key is stored offline in isolation, and the meter master key is not involved in network transmission, thus eliminating the risk of core key leakage at the source. The session key is valid for each transaction and is one-time password, so even if a single message is intercepted, the core key cannot be cracked or used for other transactions.

[0036] In this invention, a two-stage transaction mechanism of pre-submission and confirmation is adopted, which, together with the design of the pre-stored balance area on the smart meter, solves the problem of two-way financial loss: deduction not received and receipt of payment not deducted.

[0037] In this invention, a distributed access cluster is used to replace the single-point front-end machine, eliminating single-point failures at the access layer. Furthermore, the concentrator on the station side and the edge gateway form a primary and backup redundant acquisition structure. With the automatic switching of the three-level path of the main link, backup link, and fallback link, and the early switching of faults through sliding window link quality prediction, the success rate of remote recharge can be improved. Attached Figure Description

[0038] Figure 1 This is a schematic diagram of the overall structure of the remote prepaid electricity sales system according to the implementation plan;

[0039] Figure 2 This is a schematic diagram illustrating the structure and derivation relationships of the three-layer dynamic key system according to the implementation plan;

[0040] Figure 3 A sequence diagram of the two-stage recharge transaction according to the implementation plan;

[0041] Figure 4The flowchart shows the automatic switching logic for the three-level redundant links according to the implementation plan.

[0042] Figure 5 This is a schematic diagram of the three-copy structure of the smart meter's secure storage module according to the implementation plan;

[0043] Figure 6 This is a flowchart outlining the overall steps of the prepaid electricity sales method according to the implementation plan. Detailed Implementation

[0044] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] Please see Figure 1-5 This embodiment provides a remote prepaid electricity sales system, comprising six types of hardware entities: a data server, a front-end server, a concentrator, an edge gateway, smart meters, and a handheld maintenance terminal. The data server connects to the client via a network, the front-end server connects the data server to the concentrator, and the concentrator communicates with the smart meters.

[0046] The data server is deployed in the power company's main computer room, serving as the core business and control node of the system. It integrates a key management module and a recharge transaction module, while also supporting business functions such as user management, electricity price management, electricity data collection, and balance reminders. The key management module interfaces with the hardware encryption machine, responsible for the entire lifecycle management of key generation, derivation, updating, and revocation. All key operations are performed internally within the hardware encryption machine, ensuring that plaintext keys do not leak outside the encryption machine's security boundaries. The recharge transaction module, as the core scheduling unit for recharge operations, manages global recharge serial numbers, maintains the transaction state machine, executes two-phase commit logic, and handles consistency assurance logic such as timeout retries, automatic rollback, and offline reconciliation.

[0047] The key management module can generate root keys, meter master keys, and session keys. The root key is the highest-level key in the system. It is generated by security administrators in an offline security environment using a hardware true random number generator to produce a 128-bit true random number. After generation, it is directly written to the secure storage partition of the hardware encryption machine, with the highest access privileges. Only the key management module can call the encryption machine interface to perform key derivation operations; it cannot be exported in plaintext. The root key is updated every 12 months. Before its expiration, a new root key is generated and a full terminal key update is performed. The old root key is retained for a 30-day transition period before being completely destroyed. The meter master key is a unique core key for each meter, derived from the root key using the SM1 block cipher algorithm. The derivation factor is a 6-byte meter address. The specific derivation logic is as follows: the meter address is concatenated with 2 bytes of padding data to form an 8-byte input, which is then encrypted using the SM1 algorithm with the root key as the encryption key, outputting a 16-byte (128-bit) meter master key. The meter master key is written into the secure storage area of ​​the smart meter during the meter production stage via an encrypted programming station. The entire programming process is completed in an encrypted environment, and the plaintext key never passes through the production terminal. The meter's MCU hardware Flash read protection is enabled, prohibiting the reading of the master key through an external debugging interface. Furthermore, the master key never participates in any network transmission; it is only used for locally derived session keys. The session key is a temporary working key for a single transaction, dynamically generated for each recharge transaction, valid for a single transaction and requiring a unique key for each transaction. The session key is derived from the meter master key using the SM1 block cipher algorithm, with the derivation factors being a 4-byte true random number and a 4-byte Unix timestamp. The specific derivation logic is as follows: the random number, timestamp, and 4-byte padding data are concatenated into a 12-byte input, which is then encrypted using the SM1 algorithm with the meter master key as the key, outputting a 128-bit session key. The session key itself is never directly transmitted over the network. Only the random number and timestamp are placed in plaintext in the header of the recharge message. Upon receiving the message, the smart meter extracts the random number and timestamp and independently calculates a completely identical session key using the locally stored master key. This ensures that the key is not transmitted but can be calculated by both parties, fundamentally preventing the risk of the session key being intercepted by the network. The recharge downlink message adopts a three-layer structure of plaintext header + ciphertext body + MAC checksum. The specific fields are as follows: The plaintext header area contains public fields such as frame header, frame length, meter address, command code, random number, timestamp, and challenge code, transmitted in plaintext for routing and key derivation. The ciphertext body area contains core business data such as the recharge amount, global serial number, and electricity price parameters, generated by encryption using the SM1 algorithm from the session key, ensuring the confidentiality of business data. The MAC checksum area calculates the HMAC-SM3 message authentication code based on the session key, using the lower 32 bits as the checksum, to verify message integrity and prevent message tampering.The server-side message generation process is as follows: Assemble the plaintext header field and business plaintext data; call the hardware encryption machine, passing in the meter address, random number, and timestamp; the encryption machine internally derives the meter master key and session key sequentially; encrypt the business plaintext using the session key to obtain the ciphertext body; calculate the MAC checksum of the plaintext header and ciphertext body using the session key; assemble the complete message and send it out. The smart meter-side message parsing process is as follows: Receive the message, verify the frame header, frame trailer, and sum; discard messages with incorrect formats; extract the random number and timestamp from the plaintext header, call the local SM1 algorithm function, and calculate the session key using the local meter master key; decrypt the ciphertext body using the session key to obtain the business plaintext; calculate the MAC value of the plaintext header and ciphertext body using the session key, compare it with the MAC checksum in the message; if they do not match, the message is considered tampered with, discarded, and a verification failure is returned; after successful verification, execute the corresponding business logic.

[0048] The recharge transaction module can execute a two-stage recharge process: pre-commit and confirmation. In the pre-commit stage, the user submits a recharge request through the client, carrying their account number and recharge amount. The data server completes user authentication and account balance verification. The recharge transaction module generates a globally unique recharge serial number, marks the transaction status as pending submission, and freezes the corresponding recharge amount in the user's payment account. The recharge transaction module calls the key management module to generate pre-recharge ciphertext, which is then distributed to the target smart meter through the distributed access cluster and concentrator. After the smart meter completes message decryption, integrity verification, and legality verification, it queries its local serial number queue to confirm that the serial number has not been processed. The smart meter writes the recharge amount into the pre-stored balance area and adds the serial number to its local circular queue, returning a pre-recharge success response to the server. Upon receiving the pre-success response, the server updates the transaction status to pre-success. During the confirmation and activation phase, the recharge transaction module generates a confirmation and activation instruction, carrying the corresponding transaction number, and sends it to the smart meter after encryption. Upon receiving the confirmation instruction, the smart meter verifies that the pre-deposited balance corresponding to the transaction number exists and is valid, transfers the corresponding amount from the pre-deposited balance area to the formal balance area, and clears the pre-deposited record. The smart meter returns a successful confirmation response to the server. After receiving the response, the recharge transaction module updates the transaction status to "completed," officially credits the frozen recharge funds, and completes the deduction. The server pushes a recharge success notification to the user's client and simultaneously updates the user's balance display. For timeout and failure scenarios at each stage of the transaction, the following backoff retry and automatic rollback logic is designed: If the pre-commit phase times out, a 30-second timer is started after the pre-recharge instruction is issued. If no response is received within the timeout period, a retry is triggered, for a total of 3 retries with intervals of 10 seconds, 30 seconds, and 60 seconds respectively. After all 3 retries fail, the pre-commit is deemed to have failed, and a rollback operation is performed: the frozen funds in the user's account are unfrozen, the transaction status is updated to "failed," and a recharge failure notification is returned to the user. If the confirmation phase times out, a 30-second timer is started after the confirmation command is issued. If no response is received within the timeout period, the process is retried three times. If it still fails, a rollback command is sent to the smart meter. Upon receiving the command, the meter clears the pre-stored balance for the corresponding transaction number. If the meter is offline, the rollback command is stored in a persistent cache and sent preferentially when the meter comes back online. For local timeout protection, after the smart meter writes the pre-stored balance, a 60-second local timer is started simultaneously. If no confirmation or rollback command is received within the timeout period, the pre-stored balance is automatically cleared to prevent long-term occupation of the pre-stored amount. The abnormal event is also recorded for subsequent reconciliation.To address the semi-connected transaction state caused by long-term offline status of smart meters, an automatic reconciliation and correction process is designed as follows: After the smart meter reconnects to the server, it proactively reports the transaction numbers and statuses of all incomplete pre-stored transactions locally; the recharge transaction module queries the transaction status of the corresponding transaction number on the server side. If the server side status is pre-successful, a confirmation instruction is automatically reissued to complete the formal crediting of the balance and deduction of funds; if the server side status is rolled back or failed, a rollback instruction is automatically reissued to clear the corresponding pre-stored balance on the meter side; if there is no corresponding transaction record on the server side, it is marked as an abnormal transaction and transferred to the manual reconciliation and verification process.

[0049] The front-end server adopts a distributed access cluster architecture, consisting of three or more access gateway nodes connected to a load balancer. It provides a unified access service address, and all concentrators, edge gateways, and directly connected smart meters access the cluster via persistent TCP connections. Load sharing is implemented among cluster nodes; in the event of a single node failure, the terminal connections it carries are automatically migrated to other healthy nodes, ensuring seamless service interruption and completely eliminating the risk of single-point front-end server downtime. The front-end server is equipped with a link status monitoring module with a built-in link quality time-series database. It collects communication data from each terminal in real time, calculates communication success rate, average latency, and packet loss rate using a sliding window algorithm, and performs fault prediction and link switching scheduling. The front-end server supports parsing multiple power communication protocols such as DL / T645 and DL / T698, and persistently caches issued commands, supporting automatic retries upon timeout to improve command delivery rate. The front-end server is a distributed access cluster composed of multiple access gateways connected via load balancing. It has a built-in link status monitoring module, which tracks link quality metrics and predicts faults. This module also enables automatic switching between three levels of redundancy: primary link, backup link, and fallback link. The automatic switching mechanism for these three levels is as follows: the primary link connects the data server to the smart meter via the distributed access cluster and concentrator, serving as the default service channel; the backup link connects the data server directly to the smart meter via the distributed access cluster, automatically switching to the backup link when the concentrator goes offline or the primary link quality falls below a preset threshold; the fallback link is a local communication connection between a handheld maintenance terminal and the smart meter, allowing on-site recharging via the handheld maintenance terminal when the primary or backup link fails.

[0050] The link status monitoring module of the front-end server employs a sliding window statistical algorithm to achieve early fault prediction and seamless switching. The sliding window parameters are set to a window size of 10 minutes and a sliding step of 1 minute, calculating the link quality indicators within the current window every minute. If, within three consecutive sliding windows, the communication success rate is below 80%, the average latency is above 5 seconds, or the packet loss rate is above 30%, the link is considered to have a fault risk, triggering an early switchover. When a fault is predicted in the concentrator's main link, the recharge service for that area is automatically rescheduled to a backup link. Commands are issued via the edge gateway or the direct meter connection module to avoid service interruption caused by switching after a fault occurs.

[0051] A concentrator and an edge gateway are configured at the edge acquisition layer. The distribution area adopts a primary / backup redundant acquisition structure using concentrators and edge gateways, covering all smart meters within the same distribution area. The concentrator serves as the primary acquisition node for the distribution area, employing ARM-based embedded hardware. It connects to up to 1024 smart meters within the distribution area via power line carrier or RS485 bus, responsible for command forwarding and electricity consumption data acquisition, and normally handles all distribution area services. The edge gateway serves as the backup acquisition node for the distribution area, deployed within the distribution box. It has a built-in low-power wireless or NB-IoT downlink interface and a 4G uplink interface, and normally operates in standby listening mode. When the concentrator goes offline or the primary link quality is substandard, it automatically takes over the communication services of the distribution area meters, achieving redundant backup at the acquisition layer. If the concentrator sends a command but does not receive a response within a timeout period, it retryes three times locally, using different frequencies and time slots. If this still fails, it attempts to forward the command through an adjacent acquisition device within the distribution area, retrying twice. If forwarding is successful, the service continues; if forwarding fails, a first-level fault is reported, triggering a backup link switchover. When the front-end server detects that the concentrator is offline or receives a Level 1 fault report, it automatically switches the recharge task for the corresponding area to the backup link and issues the recharge command through the smart meter's wireless direct connection module. The backup link retryes three times; if successful, the recharge is completed, and it automatically switches back to the main link after the concentrator recovers. If it still fails, it is determined to be a Level 2 fault, triggering the fallback link. If both the main link and the backup link fail to recharge, it is determined to be a full link failure. The operation and maintenance management module automatically generates an operation and maintenance work order, including the meter address, fault type, user information, and recharge data, and dispatches it to the operation and maintenance personnel in the corresponding area. The operation and maintenance personnel arrive at the site with a handheld operation and maintenance terminal, connect to the meter locally via infrared or Bluetooth, and perform the fallback recharge. After the recharge is completed, the handheld terminal connects to the network to synchronize the work record, and the work order is closed.

[0052] The smart meter serves as the terminal execution unit for electricity sales operations. It employs an 8-bit low-power MCU as its main controller and integrates a metering module, a secure storage module, a dual communication module, a cover-opening detection module, a relay control module, and a display module. The smart meter uses three copies of critical data such as balance, key, and electricity price for non-contiguous storage. During writing, it synchronously calculates integrity check values, and during reading, it performs integrity checks and a two-out-of-three majority vote. Combined with cover-opening detection triggering security locking and metering pulse cross-checking to identify tampering, it achieves multi-dimensional terminal anti-tampering protection.

[0053] The secure storage module is the core improvement unit. It divides the Flash memory into a pre-stored balance area and a formal balance area, and employs a three-copy storage structure to ensure data security. The dual communication module includes a main communication interface (power line carrier or RS485, connecting to the concentrator) and a backup wireless interface (NB-IoT or low-power wireless, connecting to the edge gateway or directly to the master station), supporting independent operation of both links. The smart meter's internal Flash memory is divided into three independent storage blocks with non-contiguous physical addresses, with an address interval of at least 1KB between blocks to prevent batch tampering of contiguous storage. Each storage block has a capacity of 256 bytes and internally stores core data such as balance data (including pre-stored and formal balances), the meter's master key, electricity price parameters, and serial number queues. Each storage block is appended with an independent 32-bit HMAC-SM3 integrity check value for data integrity verification. During the writing process, the smart meter's secure storage module calculates the HMAC-SM3 checksum of the core data to be written, and uses the lower 32 bits as the checksum of the copy. It then sequentially erases the corresponding sectors of the three storage blocks and writes the core data and corresponding checksum to the three independent storage blocks. The module reads back the data from the three storage blocks and verifies each one to confirm correct writing. If a single block write fails, it retryes twice; if it still fails, the block is marked as corrupted, and an alarm is reported to the server. During the reading process, the smart meter's secure storage module reads the complete data from the three storage blocks. It independently calculates the HMAC checksum for each storage block, compares it with the checksum stored within the block, and marks the valid storage blocks that pass the verification. If the number of valid storage blocks is ≥2, a 2 / 3 majority vote is performed on the data of the valid blocks, and the final valid data is output. If the number of valid storage blocks is ≤1, the data is deemed severely corrupted, default parameters are restored from the EEPROM backup area, a data tampering alarm is reported, and the module enters a secure lockout state.

[0054] The smart meter is equipped with a physical spring-loaded cover-opening detection switch. One end of the switch is connected to GND, and the other end is connected to the MCU's external interrupt pin. When normally closed, the pin is low. When the meter casing is opened, the spring pops up, and the pin goes high, triggering the highest-priority external interrupt. The interrupt service routine performs the following operations: immediately outputs a relay disconnect pulse to cut off the user's power supply circuit; writes core data such as the current balance, key version, and serial number to the EEPROM backup area, overwriting the original backup; sets the cover-opening alarm flag and records the cover-opening timestamp; enters a security lock state, prohibiting all recharge, deduction, and parameter modification operations, and displays the alarm code on the screen; and proactively reports the cover-opening alarm event to the server upon the next communication establishment. Unlocking requires authorized maintenance personnel using a handheld maintenance terminal to send an unlock command after authentication. Normal operation can only be restored after the command is verified.

[0055] The smart meter also incorporates a built-in metering cross-checking unit to prevent balance tampering at the source. Its metering module outputs one metering pulse for every 0.01 kWh of electricity consumed. The MCU accumulates the pulse count via a timer and can convert the pulse count into actual electricity consumption in real time, multiplying it by the current electricity price to calculate the amount due. After each deduction, the actual deducted amount is compared with the amount due calculated from the pulse count, with a deviation threshold of 0.5%. If the deviation exceeds this threshold for 10 consecutive deductions, it is determined that the balance data or metering parameters are abnormal, triggering a tampering alarm, entering a security lock state, and reporting to the server. This mechanism strongly binds the balance data to the metering pulses, making it impossible to match the metering pulse count even if the balance value in the storage chip is tampered with, fundamentally preventing electricity theft through data manipulation.

[0056] The handheld maintenance terminal is a field operation device for maintenance personnel. It is equipped with infrared and Bluetooth local communication interfaces, built-in identity authentication certificate, and supports offline local recharge, parameter setting, fault diagnosis, and unlocking operations. After connecting to the network, it automatically synchronizes operation records with the data server to realize the bottom-line recharge and maintenance closed loop.

[0057] See Figure 6 This embodiment also provides a remote prepaid electricity sales method, the execution steps of which are as follows:

[0058] Step S1: Pre-build a three-layer dynamic key system consisting of a root key, a meter master key, and a session key. The root key is stored offline in a hardware encryption machine. The meter master key is derived and burned into the local smart meter. The session key is dynamically generated during a single transaction.

[0059] S11. Generate a 128-bit true random number offline as the root key, store it in the secure partition of the hardware encryption machine, and set the update cycle to 12 months.

[0060] S12. Using the meter address of each meter as the dispersion factor, the root key is used to encrypt and derive a unique master key for each meter through the SM1 block cipher algorithm. This master key is burned into the smart meter's secure storage area during the meter production stage, and hardware read protection is enabled. The master key does not participate in network transmission at all.

[0061] S13. When each recharge transaction is initiated, a 4-byte random number and a 4-byte timestamp are generated as a derivation factor. The session key is derived by encrypting the meter master key. The session key is only valid for this transaction. The random number and timestamp are carried in plaintext in the message header. The sender and receiver calculate the session key independently. The session key itself is not directly transmitted in the network.

[0062] Step S2: After the user initiates a recharge request, the pre-submission stage is executed first, freezing the corresponding funds and issuing a pre-recharge instruction. The smart meter temporarily stores the recharge amount in the pre-deposit balance area. After the pre-submission is successful, the confirmation and effectiveness stage is executed, issuing a confirmation instruction. The smart meter transfers the pre-deposit balance to the formal balance, completing the formal crediting of funds. If any stage fails, a rollback operation is automatically executed.

[0063] S21. Pre-submission stage: The recharge transaction module receives the user's recharge request, generates a globally unique serial number, freezes the corresponding funds in the user's account, generates a pre-recharge ciphertext and sends it to the smart meter; after the smart meter decrypts and verifies the data, it writes the recharge amount into the pre-stored balance area, records the serial number, and returns a pre-success response.

[0064] S22. Confirmation of Validity Phase: After receiving the pre-success response, the recharge transaction module issues a confirmation of validity instruction; after receiving the instruction, the smart meter transfers the corresponding pre-deposited balance to the formal balance area and returns a confirmation of success; the recharge transaction module completes the formal crediting of funds and updates the transaction status to completed.

[0065] S23. Timeout Rollback: If no response is received after any timeout, the exponential backoff strategy will be used to retry. If the retry fails, a rollback will be triggered to unfreeze the frozen funds or clear the corresponding pre-stored balance of the smart meter.

[0066] S24. Offline reconciliation: After the smart meter reconnects offline, it actively reports the status of unfinished transactions locally. The recharge transaction module reissues confirmation or rollback instructions to complete the synchronization of the status at both ends.

[0067] Step S3: Monitor link quality in real time through the distributed access cluster. When the main link fails, automatically switch to the backup link. When the main link or backup link fails, trigger backup link maintenance.

[0068] S31. The distributed access cluster uses a 10-minute sliding window and a 1-minute step size to statistically analyze the communication success rate, average latency, and packet loss rate of each link in real time.

[0069] S32. When three consecutive sliding window indicators are lower than the preset threshold, a link failure is predicted, and the service is switched to the backup link in advance.

[0070] S33. When the main link fails, it automatically switches to the backup link and sends a recharge command through the smart meter's wireless module.

[0071] S34. If the backup link still fails to recharge, it is determined that the entire link has failed. An operation and maintenance work order is automatically generated and dispatched to the handheld operation and maintenance terminal, and the operation and maintenance personnel perform the backup link recharge on-site through the operation and maintenance terminal.

[0072] Step S4: The smart meter uses three copies of non-continuous storage for key data, and combines integrity verification and majority voting mechanism to prevent data tampering, and combines cover opening detection and meter cross-verification to achieve physical attack protection.

[0073] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. The terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, unless otherwise explicitly specified and limited, the terms "installed," "connected," and "linked" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances. Moreover, the terms “comprising,” “including,” or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus.

[0074] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A remote prepaid electricity sales system, comprising a data server, a concentrator, a front-end server, and smart meters, wherein the data server connects to clients via a network, the front-end server connects the data server and the concentrator, and the concentrator is communicatively connected to the smart meters, characterized in that: The data server has a built-in key management module and a recharge transaction module. The key management module can generate a root key, a meter master key, and a session key. The root key is stored offline and not exported in plaintext. The meter master key is derived from the root key by encryption using the meter address as the dispersion factor. It is burned into the smart meter during the meter production stage and does not participate in network transmission. The session key is dynamically derived from the meter master key combined with a random number and a timestamp. It is valid for a single transaction and has a unique key for each transaction. The recharge transaction module can perform two stages: pre-submission and confirmation. The concentrator is the main data acquisition node for the distribution area, and the distribution area also deploys an edge gateway as a backup data acquisition node. The two cover the smart meters in the same distribution area, forming a primary and backup redundant data acquisition structure. The front-end server is a distributed access cluster composed of multiple access gateways through load balancing. The front-end server has a built-in link status monitoring module, which is used to count link quality indicators and predict faults. The link status monitoring module can realize automatic switching of three-level redundant paths: main link, backup link, and fallback link. The smart meter has a built-in secure storage module that divides the pre-stored balance area into a pre-stored balance area and a formal balance area. The pre-stored balance area is used to temporarily store the recharge amount during the pre-submission stage, and the amount is transferred to the formal balance area after confirmation.

2. The remote prepaid electricity sales system according to claim 1, characterized in that, The working mechanism of the root key, meter master key and session key in the key management module is set as follows: the root key is a 128-bit true random number with an update cycle of 12 months; the meter master key is generated by the SM1 block cipher algorithm and is derived from the root key by encryption using the meter address as the dispersion factor, and is unique to each meter. The session key is generated using the SM1 block cipher algorithm and is derived from the meter master key by encryption using a random number and a timestamp as derivation factors. The recharge message uses a plaintext header, ciphertext body, and MAC check structure. The random number and timestamp are carried in plaintext in the message header. The session key is not transmitted directly but is independently calculated and generated by the sender and receiver based on the master key stored locally.

3. The remote prepaid electricity sales system according to claim 1, characterized in that, During the pre-submission phase, the recharge transaction module freezes the recharge funds corresponding to the user's account, issues a pre-recharge instruction, and after the smart meter verifies the data, writes the recharge amount into the pre-stored balance area and returns a pre-success response. During the confirmation and activation phase, the recharge transaction module issues a confirmation instruction, the smart meter transfers the pre-deposited balance to the formal balance area, and returns a confirmation success response, thus completing the formal crediting of funds by the recharge transaction module; any timeout retry failure at any stage will trigger a rollback operation, unfreezing the frozen funds or clearing the corresponding pre-deposited balance; after the smart meter reconnects offline, it will automatically perform reconciliation and correction, synchronizing the transaction status of both ends.

4. A remote prepaid electricity sales system according to claim 1, characterized in that, The secure storage module is equipped with a three-replica storage structure. The three-replica storage structure divides the smart meter into three independent storage blocks with different address intervals. Each storage block stores balance data, key data, electricity price parameters, and a serial number queue. Each storage block also has an independent HMAC-SM3 integrity check value. When writing critical data, it is written to all three storage blocks simultaneously, and the corresponding check value is calculated for each block. When reading critical data, the integrity of each storage block is checked, and a two-out-of-three majority vote is performed on the valid storage blocks to output the final valid data.

5. A remote prepaid electricity sales system according to claim 4, characterized in that, The smart meter is also equipped with an open cover detection module and a metering cross-verification unit. When the open cover detection module is triggered, it performs relay power-off, data backup and enters a security lock state. The metering cross-verification unit identifies tampering behavior by comparing the electricity fee calculated by metering pulses with the actual deducted amount.

6. A remote prepaid electricity sales system according to claim 1, characterized in that, The automatic switching mechanism for the three-level redundant paths (main link, backup link, and fallback link) in the link status monitoring module is as follows: The main link is the connection between the data server and the smart meter via a distributed access cluster and a concentrator, and the main link is the default service channel; the backup link is the direct connection between the data server and the smart meter via a distributed access cluster, and the service channel automatically switches to the backup link when the concentrator is offline or the quality of the main link is lower than a preset threshold; the fallback link is the local communication connection between the handheld maintenance terminal and the smart meter, and the recharge can be completed on-site via the handheld maintenance terminal when the main link or backup link fails.

7. A remote prepaid electricity sales method according to any one of claims 1-6, characterized in that, Includes the following steps: S1. A three-layer dynamic key system of root key, meter master key and session key is pre-built. The root key is stored offline in the hardware encryption machine. The meter master key is derived and burned to the local of the smart meter. The session key is dynamically generated during a single transaction. S2. After a user initiates a recharge request, the pre-submission stage is executed first, freezing the corresponding funds and issuing a pre-recharge instruction. The smart meter temporarily stores the recharge amount in the pre-deposit balance area. After the pre-submission is successful, the confirmation and effectiveness stage is executed, issuing a confirmation instruction. The smart meter transfers the pre-deposit balance to the formal balance, completing the formal crediting of funds. If any stage fails, a rollback operation is automatically executed. S3. Real-time monitoring of link quality through distributed access clusters; automatic switch to backup link when primary link fails; triggering backup link maintenance when primary or backup link fails. S4. Smart meters use three copies of non-continuous storage for critical data, combined with integrity verification and majority voting mechanisms to prevent data tampering, and combine cover opening detection and meter cross-verification to protect against physical attacks.

8. A remote prepaid electricity sales method according to claim 7, characterized in that, The generation and use of the three-layer dynamic key in step S1 specifically includes the following steps: S11. An offline 128-bit true random number is generated as the root key and stored in the secure partition of the hardware encryption machine. The update cycle is 12 months. S12. Using the meter address as the dispersion factor, the root key is used to encrypt and derive a unique master key for each meter through the SM1 block cipher algorithm. The master key is burned into the smart meter's secure storage area during the production stage, hardware read protection is enabled, and the master key does not participate in network transmission. S13. During each recharge transaction, a random number and timestamp are generated as derivation factors. The session key is derived by encrypting the meter master key. The session key is only valid for this transaction. The random number and timestamp are carried in plaintext in the message header. The sender and receiver calculate the session key independently. The session key itself is not directly transmitted in the network.

9. A remote prepaid electricity sales method according to claim 7, characterized in that, The two-stage recharge transaction in step S2 specifically includes the following steps: S21, Pre-submission stage: The recharge transaction module receives the user's recharge request, generates a globally unique serial number, freezes the corresponding funds in the user's account, generates a pre-recharge ciphertext and sends it to the smart meter; after the smart meter decrypts and verifies the data, it writes the recharge amount into the pre-stored balance area, records the serial number, and returns a pre-success response. S22. Confirmation of effectiveness stage: After receiving the pre-success response, the recharge transaction module issues a confirmation of effectiveness instruction; after receiving the instruction, the smart meter transfers the corresponding pre-deposited balance to the formal balance area and returns a confirmation of success; the recharge transaction module completes the formal crediting of funds and updates the transaction status to completed. S23. If no response is received after any timeout, the exponential backoff strategy will be used to retry. If the retry fails, a rollback will be triggered to unfreeze the frozen funds or clear the corresponding pre-deposited balance of the smart meter. S24. After the smart meter reconnects offline, it actively reports the status of unfinished transactions locally. The recharge transaction module reissues confirmation or rollback instructions to complete the synchronization of status between the two ends.

10. A remote prepaid electricity sales method according to claim 7, characterized in that, Step S3 specifically includes the following steps: S31. The distributed access cluster uses a 10-minute sliding window and a 1-minute step size to statistically analyze the communication success rate, average latency, and packet loss rate of each link in real time. S32. When three consecutive sliding window indicators are lower than the preset threshold, a link failure is predicted, and the service is switched to the backup link in advance. S33. When the main link fails, it automatically switches to the backup link and sends a recharge command through the smart meter's wireless module. S34. If the backup link still fails to recharge, it is determined that the entire link has failed. An operation and maintenance work order is automatically generated and dispatched to the handheld operation and maintenance terminal, and the operation and maintenance personnel perform the backup link recharge on-site through the operation and maintenance terminal.

Images