Safety starting method of power supply device, power supply device and power supply system

Abstract

The application discloses a safe starting method of a power supply device, the power supply device and a power supply system, and belongs to the technical field of equipment safety. The power supply device has a hardware security module and a trusted cryptographic module. The method comprises the following steps: acquiring current operation parameters of the power supply device; in the case that the hardware security module and the trusted cryptographic module establish a communication connection, the hardware security module generates a key of the power supply device based on the current operation parameters and a current register value of the trusted cryptographic module; wherein the trusted cryptographic module is used for updating the current register value based on the integrity measurement value of each component in the trust chain; and the power supply device is safely started based on the key of the power supply device. The method can optimize the key generation process of the power supply device and reduce the security risk of the safe starting process.

Description

Technical Field

[0001] This application belongs to the field of equipment safety technology, and in particular relates to a safe start-up method for power supply equipment, power supply equipment, and power supply system. Background Technology

[0002] Photovoltaic power generation, energy storage regulation, and electric vehicle charging functions are integrated into photovoltaic (PV) power generation, energy storage regulation, and electric vehicle charging systems, which are widely used in the new energy field as key infrastructure. These power supply devices operate in unattended environments with strong network connectivity and high electrical coupling. Existing key generation and secure startup schemes pose significant security risks when applied to these devices. Summary of the Invention

[0003] This application aims to address at least one of the technical problems existing in the prior art. To this end, this application proposes a secure startup method, power supply equipment, and power supply system for power supply equipment, optimizing the key generation process of the power supply equipment and reducing the security risks of the secure startup process.

[0004] In a first aspect, this application provides a secure startup method for a power supply device, the power supply device having a hardware security module and a trusted cryptographic module, the method comprising: Obtain the current operating parameters of the power supply equipment; When the hardware security module and the trusted cryptographic module establish a communication connection, the hardware security module generates a key for the power supply device based on the current operating parameters and the current register value of the trusted cryptographic module; wherein, the trusted cryptographic module is used to update the current register value based on the integrity metric values ​​of each level of components in the trust chain; The power supply device is securely started based on its key.

[0005] According to the secure startup method for power supply equipment of this application, a hardware security module and a trusted cryptographic module are deployed in the power supply equipment as dual roots of trust. The current operating parameters of the power supply equipment are used as key derivation factors. The hardware security module dynamically derives the key of the power supply equipment based on the current operating parameters and the current register value of the trusted cryptographic module. The key can more realistically reflect the physical characteristics of the power supply equipment itself. The dual roots of trust work together to effectively reduce the security risks caused by the failure of a single root of trust, optimize the key generation process of the power supply equipment, and reduce the security risks of the secure startup process.

[0006] According to one embodiment of this application, the method further includes: Obtain the current operating mode of the power supply equipment; Based on the current operating mode of the power supply equipment, the validity period corresponding to the key of the power supply equipment is determined.

[0007] According to one embodiment of this application, the device operation mode includes off-grid mode, grid-connected mode, and fault mode; the key validity period corresponding to the fault mode is shorter than the key validity period corresponding to the grid-connected mode, and the key validity period corresponding to the grid-connected mode is shorter than the key validity period corresponding to the off-grid mode.

[0008] According to one embodiment of this application, securely starting the power supply device based on the key of the power supply device includes: Based on the key of the power supply equipment, the power supply equipment is triggered to run the business application; The components of the trust chain include a startup program, a bootloader, an operating system, and the business application.

[0009] According to one embodiment of this application, the hardware security module generates a key for the power supply device based on the current operating parameters and the current register value of the trusted cryptographic module, including: The hardware security module and the trusted cryptographic module perform bidirectional verification; If the two-way verification between the hardware security module and the trusted cryptographic module is successful, the boot program measures the bootloader to obtain a first measurement value, and extends the first measurement value to the current register value. Based on the current register value, the hardware security module generates a first device key. The bootloader measures the operating system to obtain a second measurement value, and extends the second measurement value to the current register value. The hardware security module generates a second device key based on the current register value and the first device key. The operating system measures the business application to obtain a third measurement value, and extends the third measurement value to the current register value. The hardware security module generates a third device key based on the current register value and the second device key. The third device key is used to run the business application.

[0010] According to one embodiment of this application, the hardware security module includes a blockchain node, which is used to write the key operation log of the power supply device into the blockchain.

[0011] According to one embodiment of this application, the key operation log includes at least one of the following: key operation type, device status information of the power supply device, register value data of the trusted cryptographic module, and signature information of the hardware security module.

[0012] According to one embodiment of this application, the method further includes: The hardware security module performs security verification based on the operating mode switching signal of the power supply equipment; The hardware security module generates a mode switching token upon successful security verification. The trusted cryptographic module verifies the mode switching token; If the mode switching token is successfully verified, the device operating mode of the power supply equipment is switched in response to the operating mode switching signal.

[0013] Secondly, this application provides a power supply device, comprising: Hardware security module and trusted cryptographic module; A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the safe startup method for the power supply device as described in the first aspect above.

[0014] Thirdly, this application provides a power supply system, including: At least one power supply device as described in the second aspect above.

[0015] Fourthly, this application provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the safe startup method for the power supply equipment as described in the first aspect above.

[0016] Fifthly, this application provides a computer program product, including a computer program that, when executed by a processor, implements the safe startup method for power supply equipment as described in the first aspect above.

[0017] Additional aspects and advantages of this application will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of this application. Attached Figure Description

[0018] The above and / or additional aspects and advantages of this application will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which: Figure 1 This is one of the flowcharts illustrating the safe startup method for power supply equipment provided in the embodiments of this application; Figure 2 This is a schematic diagram of the system architecture of the power supply equipment provided in the embodiments of this application; Figure 3 This is a second schematic flowchart of the safe startup method for power supply equipment provided in the embodiments of this application; Figure 4 This is the third flowchart illustrating the safe startup method for power supply equipment provided in this application embodiment; Figure 5 This is the fourth flowchart illustrating the safe startup method for power supply equipment provided in the embodiments of this application; Figure 6 This is the fifth flowchart illustrating the safe startup method for power supply equipment provided in this application embodiment. Detailed Implementation

[0019] The technical solutions of the embodiments of this application will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application are within the scope of protection of this application.

[0020] The terms "first," "second," etc., used in the specification and claims of this application are used to distinguish similar objects and not to describe a specific order or sequence. It should be understood that such use of data can be interchanged where appropriate so that embodiments of this application can be implemented in orders other than those illustrated or described herein, and the objects distinguished by "first," "second," etc., are generally of the same class and the number of objects is not limited; for example, a first object can be one or more. Furthermore, in the specification and claims, "and / or" indicates at least one of the connected objects, and the character " / " generally indicates that the preceding and following objects are in an "or" relationship.

[0021] The following description, in conjunction with the accompanying drawings, details the safe startup method, power supply equipment, power supply system, and readable storage medium provided in this application through specific embodiments and application scenarios.

[0022] The power supply equipment can be photovoltaic power generation equipment, energy storage regulation equipment, charging equipment, photovoltaic-energy storage equipment, or photovoltaic-energy storage-charging equipment. For example, the photovoltaic power generation equipment can be a photovoltaic inverter, the energy storage regulation equipment can be an energy storage converter, the charging equipment can be a car charging pile, and the photovoltaic-energy storage equipment can be an integrated photovoltaic-energy storage unit.

[0023] The safe startup method for power supply equipment provided in this application embodiment can be executed by the power supply equipment or a functional module or functional entity in the power supply equipment that can implement the safe startup method for the power supply equipment.

[0024] In this embodiment of the application, the power supply device has a hardware security module (HSM) and a trusted cryptography module (TCM).

[0025] The hardware security module is used to securely generate, store, and manage digital keys, and has anti-tampering and anti-side-channel attack capabilities. The hardware security module can also support Chinese national cryptographic algorithms. For example, the Chinese national cryptographic algorithms supported by the hardware security module may include at least one of the SM2, SM3, and SM4 algorithms.

[0026] The trusted cryptography module uses the SM series algorithm and has integrity measurement capabilities. It can be used to perform integrity measurement and trust chain transmission.

[0027] In this embodiment, the hardware security module and the trusted cryptographic module serve as carriers of the device's root of trust, enabling key management and secure startup processes for the power supply equipment in dynamic and ever-changing application scenarios.

[0028] like Figure 1 As shown, the safe start-up method for the power supply equipment includes steps 110, 120 and 130.

[0029] Step 110: Obtain the current operating parameters of the power supply equipment.

[0030] In this step, at least one operating parameter of the power supply equipment is collected in real time.

[0031] For example, the current operating parameters of the power supply equipment can be one parameter or a combination of multiple parameters, including but not limited to photovoltaic output power Ppv, energy storage state of charge SOC, grid frequency Fgrid, equipment temperature Tdev, DC bus voltage Vdc, battery current Ibat, and other operating parameters used to characterize the operating status of the equipment.

[0032] Step 120: With the hardware security module and the trusted cryptographic module establishing a communication connection, the hardware security module generates a key for the power supply device based on the current operating parameters and the current register value of the trusted cryptographic module.

[0033] In this embodiment, the current operating parameters of the power supply equipment are used as key derivation factors, and the key is deeply bound to the physical state of the power supply equipment, rather than relying solely on template generation, so that the key can more realistically reflect the physical characteristics of the power supply equipment itself.

[0034] In practice, the current operating parameters collected in real time can be formatted and normalized to facilitate the subsequent generation of keys.

[0035] For example, if the collected current operating parameters are analog quantities, convert them to digital quantities (State_Vector): State_Vector=[Ppv×10, SOC×10, Fgrid×100, Tdev×10, Vdc×10, Ibat×10].

[0036] Normalize the converted digital value: SVnorm = Hash(State_Vector||Timestamp), where Timestamp represents the timestamp.

[0037] In this embodiment, the hardware security module and the trusted cryptographic module establish a communication connection, which means that the hardware security module and the trusted cryptographic module establish a secure communication channel through key negotiation to realize bidirectional information transmission. This allows the hardware security module to generate a key for the power supply device based on the current operating parameters and the current register value of the trusted cryptographic module.

[0038] The trusted cryptography module is used to update the current register value based on the integrity metric of each level of the components in the trust chain.

[0039] It is understandable that a chain of trust refers to a mechanism that transmits trust relationships step by step. The trusted cryptographic module has a platform configuration register (PCR), which can be used to store integrity metrics and has tamper-proof characteristics.

[0040] In this embodiment, a hardware security module and a trusted cryptographic module are deployed simultaneously in the power supply equipment as dual roots of trust. The hardware security module is responsible for secure key storage and high-speed computation, while the trusted cryptographic module is responsible for integrity measurement and trust chain transmission. The hardware security module and the trusted cryptographic module complement each other and work together to generate the key for the power supply equipment.

[0041] In practice, the hardware security module can derive the dynamic key of the power supply device in real time based on the root key generated by itself upon power-on, combined with the state vector after normalization of the current operating parameters, the current register value of the trusted cryptographic module, and the random number.

[0042] For example, the hardware security module uses a key derivation function (KDF) based on the SM3 algorithm, namely the SM3-KDF algorithm, and the key of the power supply device is: Kdyn=SM3_KDF(Kroot, SVnorm||PCRcurrent||Nonce).

[0043] Where Kroot is the root key of the hardware security module, SVnorm is the normalized state vector, PCRcurrent is the current register value of the trusted cryptographic module, and Nonce is a random number, which can be a 32-byte random number generated by the hardware security module to achieve unpredictable keys.

[0044] In some embodiments, after the hardware security module and the trusted cryptographic module complete initialization, they establish a communication connection through key negotiation, and the two roots of trust are collaboratively bound.

[0045] After the hardware security module is powered on, it executes a self-test program to verify hardware integrity, generates a device root key pair (PKHSM, SKHSM), locks the private key in the secure storage area of ​​the hardware security module, and configures the national cryptographic algorithm engine, including but not limited to at least one of the national cryptographic SM2 algorithm, national cryptographic SM3 algorithm and national cryptographic SM4 algorithm.

[0046] After the trusted cryptography module is powered on, it performs trusted measurement root (CRTM) initialization, clears the platform configuration register, prepares to receive measurement values, generates an endorsement key (EK) and a storage master key (SMK), configures the platform configuration register policy, and binds the public key of the hardware security module.

[0047] The hardware security module and the trusted cryptographic module establish a secure channel through SM2 key negotiation, generate a shared key Kcoop, and exchange identity certificates. The identity certificate of the hardware security module is CertHSM=SignCA(PKHSM), and the identity certificate of the trusted cryptographic module is CertTCM=SignCA(PKTCM). PKTCM is the device root key of the trusted cryptographic module.

[0048] In practice, the collaborative relationship between the hardware security module and the trusted cryptographic module can be configured. The hardware security module is the primary root of trust, and the trusted cryptographic module is the backup root of trust. When the hardware security module fails, it automatically switches to the trusted cryptographic module. Preset key operations require verification by both the hardware security module and the trusted cryptographic module.

[0049] It should be noted that, unlike the related technologies that split the key into two parts for storage and dynamically update it in segments, in this embodiment, the key of the power supply device is derived based on state awareness and stored completely in the hardware security module. It does not require frequent communication synchronization and can support offline autonomy.

[0050] Step 130: Securely start the power supply device based on the power supply device's key.

[0051] In this step, the hardware security module dynamically derives the power supply device's key based on the power supply device's current operating parameters and the trusted cryptographic module's current register value. Based on the power supply device's key, it verifies integrity level by level during device startup, ensuring that only verified or authorized tasks can be executed, thus achieving secure startup of the power supply device.

[0052] According to the secure startup method for power supply equipment provided in the embodiments of this application, a hardware security module and a trusted cryptographic module are deployed in the power supply equipment as dual roots of trust. The current operating parameters of the power supply equipment are used as key derivation factors. The hardware security module dynamically derives the key of the power supply equipment based on the current operating parameters and the current register value of the trusted cryptographic module. The key can more realistically reflect the physical characteristics of the power supply equipment itself. The dual roots of trust work together to effectively reduce the security risks caused by the failure of a single root of trust, optimize the key generation process of the power supply equipment, and reduce the security risks of the secure startup process.

[0053] In some embodiments, the safe startup method for power supply equipment may further include: Obtain the current operating mode of the power supply equipment; Based on the current operating mode of the power supply equipment, determine the validity period of the key corresponding to the power supply equipment.

[0054] In this embodiment, the key validity period is adaptively and dynamically adjusted according to the current operating mode of the power supply equipment, and the key is automatically hot-renewed upon expiration to ensure the service continuity of the power supply equipment.

[0055] In practice, the operating mode of the equipment can be switched and the validity period of the key can be dynamically adjusted according to the real-time status of the power grid connected to the power supply equipment and the equipment itself.

[0056] In some embodiments, the device operating modes include off-grid mode, grid-connected mode, and fault mode.

[0057] Among them, grid-connected mode refers to the operating mode when the grid voltage and frequency are within the preset normal range and the communication link of the power supply equipment is unobstructed; off-grid mode refers to the operating mode when the grid voltage or frequency is abnormal or the communication link is interrupted; fault mode refers to the operating mode when the power supply equipment itself is abnormal, including but not limited to abnormal states such as temperature exceeding the limit, insulation fault or overcurrent protection triggering.

[0058] In this embodiment, the key validity period corresponding to the fault mode is shorter than that corresponding to the grid-connected mode, and the key validity period corresponding to the grid-connected mode is shorter than that corresponding to the off-grid mode.

[0059] For example, the key validity period for fault mode is 5 minutes, the key validity period for grid-connected mode is 15 minutes, and the key validity period for off-grid mode is 1 hour.

[0060] Understandably, shortening the key validity period in fault mode allows for rapid response to abnormal device conditions; the key validity period in grid-connected mode is moderate, with automatic key renewal upon expiration; and extending the key validity period in off-grid mode effectively reduces computational overhead.

[0061] In this embodiment, corresponding key validity periods are set for the off-grid mode, grid-connected mode and fault mode of the power supply equipment, so as to dynamically respond to the operating conditions such as equipment power fluctuation and grid state switching, and adapt to the needs of different power supply scenarios.

[0062] In some embodiments, securely starting the power supply device based on the power supply device's key may include: Based on the key of the power supply equipment, the power supply equipment is triggered to run business applications.

[0063] The components of the trust chain include the bootloader, operating system, and business applications.

[0064] In this embodiment, for the secure startup scenario of running business applications, a five-level trust chain (OS) is constructed, consisting of a hardware root of trust (i.e., the collaboration of a hardware security module and a trusted cryptographic module), a bootloader, an operating system, and the business application. Each level's key is dynamically derived and embedded with the metric value of the previous level, forming a chain authentication to achieve end-to-end trusted transmission of secure startup and key management.

[0065] In some embodiments, the hardware security module generates a key for the power supply device based on current operating parameters and the current register value of the trusted cryptographic module, including: The hardware security module and the trusted cryptographic module perform two-way verification; If the two-way verification between the hardware security module and the trusted cryptographic module is successful, the program measurement bootloader is started to obtain the first measurement value and expand the first measurement value to the current register value. Based on the current register value, the hardware security module generates the first device key. The bootloader measures the operating system, obtains a second measurement value, and extends the second measurement value to the current register value. The hardware security module generates a second device key based on the current register value and the first device key. The operating system measures the business application to obtain a third measurement value, and extends the third measurement value to the current register value. The hardware security module generates a third device key based on the current register value and the second device key. The third device key is used to run the business application.

[0066] In this embodiment, based on the chain of trust, the hierarchical authentication mechanism incorporates the metric value of the previous level as a component during the dynamic derivation process of each key. The first device key is derived from the current register value extended by the first metric value, the second device key is derived from the current register value extended by the second metric value, and the third device key is derived from the current register value extended by the third metric value. The final third device key is used to run business applications.

[0067] like Figure 3 As shown, this example illustrates the complete trust transfer process from hardware power-on to the operation of business applications.

[0068] Level 0: Hardware root of trust verification.

[0069] When the power supply device is powered on, the hardware security module and the trusted cryptographic module start simultaneously. The hardware security module reads the firmware hash of the trusted cryptographic module, compares it with the expected value, and verifies the integrity of the trusted cryptographic module. The trusted cryptographic module obtains the status of the hardware security module through a secure channel, verifies the signature, and verifies the integrity of the hardware security module. After the two-way verification of the hardware security module and the trusted cryptographic module is successful, it enters Level 1.

[0070] Level 1: BootROM verification.

[0071] BootROM is typically embedded inside the chip and cannot be tampered with.

[0072] The BootROM measures the Bootloader and calculates the Bootloader image hash (BL), which is the first metric value.

[0073] Extend the first metric Hash (BL) to the current register value PCR0 of the trusted cryptographic module: PCR0new=SM3(PCR0old||Hash(BL)).

[0074] The first device key, namely the Level 1 key K1, is derived using the hardware security module, where K1 = f(Kroot, PCR0).

[0075] For example, K1 = SM3_KDF(Kroot, PCR0new||"LEVEL1").

[0076] Use K1 to verify the Bootloader digital signature. Once the verification is successful, proceed to Level 2.

[0077] Level 2: Bootloader verification.

[0078] The bootloader measures the OS and calculates the OS image hash (OS), which is the second metric.

[0079] Extend the second metric Hash(OS) to the current register value PCR1 of the trusted cryptographic module: PCR1new=SM3(PCR1old||Hash(OS)).

[0080] The second device key, namely the Level 2 key K2, is derived using the hardware security module, where K2 = f(K1, PCR1).

[0081] For example, K2 = SM3_KDF(K1, PCR1new||"LEVEL2").

[0082] Use K2 to decrypt the OS kernel encryption key, load the OS, and enter Level 3.

[0083] Level 3: OS verification.

[0084] OS measures business applications and calculates the application image hash (App), which is the third metric.

[0085] Extend the third metric Hash (App) to the current register value PCR2 of the trusted cryptographic module: PCR2new=SM3(PCR2old||Hash(App)).

[0086] The third device key, namely the Level 3 key K3, is derived using the hardware security module, where K3 = f(K2, PCR2).

[0087] For example, K3 = SM3_KDF(K2, PCR2new||"LEVEL3").

[0088] Use K3 to verify the application signature, start the business application, and enter Level 4.

[0089] Level 4: Business Application Operations Business applications use K3-derived business keys.

[0090] For example, the photovoltaic control key Kpv = SM3_KDF(K3, "PV_CONTROL"||Pp); Energy storage control key: Kess=SM3_KDF(K3, "ESS_CONTROL"||SOC); Charging control key: Kev=SM3_KDF(K3, "EV_CONTROL"||Ibat).

[0091] In practice, business applications use K3 to derive business keys, execute business logic using these keys, and destroy the keys immediately after use.

[0092] In some embodiments, the hardware security module includes a blockchain node, which is used to write the key operation log of the power supply device to the blockchain.

[0093] In this embodiment, a blockchain node is embedded in the hardware security module to perform hash storage of key key operations of the power supply equipment, thereby achieving tamper-proof recording and rapid traceability of evidence.

[0094] In practice, the blockchain nodes of the hardware security module can be light blockchain nodes, which can reduce the requirements for storage space, network bandwidth and computing power, and are suitable for resource-constrained operating environments where power supply equipment is located.

[0095] It should be noted that after the hardware security module is powered on, it can also generate blockchain key pairs (PKBC, SKBC) for evidence signing. The blockchain node writes the key operation log of the power supply equipment into the blockchain, which facilitates the subsequent verification of the authenticity and integrity of the evidence through the signature of the hardware security module, and realizes evidence traceability.

[0096] In this embodiment, the blockchain node within the hardware security module can periodically (e.g., every 10 minutes) construct a Merkle tree from the key operation log and write the root hash of the tree to the blockchain. This process is irreversible and tamper-proof.

[0097] In some embodiments, the key operation log includes at least one of the following: key operation type, device status information of the power supply device, register value data of the trusted cryptographic module, and signature information of the hardware security module.

[0098] Key operation types include, but are not limited to, key generation, key usage, and key update.

[0099] In this embodiment, the power supply device can generate a corresponding key operation log each time it performs a key operation. The key operation log includes information such as key operation type, device status information, register value data, and signature information.

[0100] For example, the format of the key operation log Logi is as follows: Logi={Type, KeyHash, Timestamp, State_Vector, PCR, SigHSM} Wherein, Type represents the key operation type, KeyHash represents the key hash, Timestamp represents the timestamp, State_Vector represents the device status information of the power supply device, PCR represents the register value data of the trusted cryptographic module, and SigHSM represents the signature information of the hardware security module.

[0101] The blockchain node constructs a Merkle tree every 10 minutes, containing all logs during that period. The root hash of the Merkle tree is: MerkleRoot = SM3(Log0||Log1||...||Logn-1). The root hash is written to the tamper-proof storage area of ​​the hardware security module and synchronized to the cloud-based evidence storage platform.

[0102] In the event of a security incident, relevant evidence can be quickly retrieved from the blockchain. The authenticity and integrity of the evidence can be verified through Merkel proof and the signature of the hardware security module, thus enabling traceability.

[0103] In actual implementation, when abnormal states such as a sudden increase in key usage frequency, unauthorized devices attempting authentication, or state vector anomalies are detected, evidence solidification is triggered. Abnormal logs, device status, key usage records, and Merkel proofs are collected to generate an evidence package Evidence signed by the hardware security module. The hash of the evidence package is written to the blockchain to generate a transaction hash TxHash.

[0104] TxHash allows you to query evidence records on the blockchain, verify Merkel proofs, confirm that logs are included in specific blocks, verify hardware security module signatures, confirm that evidence has not been tampered with, verify PCR values, and confirm the authenticity of device status.

[0105] In some embodiments, the safe startup method for power supply equipment further includes: The hardware security module performs security verification based on the power supply equipment's operating mode switching signal; The hardware security module generates a mode switching token after the security verification is passed; The trusted cryptography module verifies the mode switching token; If the mode switching token is successfully verified, the device operation mode of the power supply equipment will be switched in response to the operation mode switching signal.

[0106] In this embodiment, when the power supply equipment switches modes, such as from off-grid mode to grid-connected mode, it needs to pass dual verification by the hardware security module and the trusted cryptographic module before the equipment operation mode can be switched, thus ensuring the security of the equipment operation mode switching process.

[0107] Upon detecting a mode switching signal from the power supply equipment, the hardware security module performs security verification. After successful verification, a mode switching token is generated: Token=SignSKHSM(Modetarget||Timestamp||PCRcurrent). Here, Modetarget represents the target operating mode after the switch, which can be obtained by parsing the mode switching signal; PCRcurrent represents the current register value of the trusted cryptographic module.

[0108] The integrity and timeliness of the mode switching token are verified by the trusted cryptographic module. After the mode switching token is verified, the operating mode switching signal is responded to, and the operating mode of the power supply equipment is switched from the current operating mode to the target operating mode.

[0109] In practice, the operation mode switching process record can be uploaded to the blockchain for evidence storage through the blockchain node of the hardware security module, reducing the security risks caused by unauthorized illegal switching operations.

[0110] The following is based on Figure 2 The system architecture of the power supply equipment will be described in detail using an example. It is understandable that... Figure 2 The modules and their interrelationships shown are merely illustrative examples, and the scope of protection of this application is not limited thereto.

[0111] like Figure 2 As shown, the dual-trust root collaboration layer of the power supply equipment is deployed with a hardware security module and a trusted cryptographic module. The hardware security module is responsible for the secure storage and operation of keys, and has embedded blockchain nodes and a national cryptographic algorithm engine. The trusted cryptographic module has a platform configuration register and is responsible for integrity measurement and trust chain transmission.

[0112] Real-time acquisition of operating parameters of power supply equipment, such as photovoltaic power, energy storage SOC, grid frequency, and equipment temperature, and synchronous acquisition of the current equipment operation mode of the power supply equipment.

[0113] The hardware security module uses the current operating parameters of the power supply equipment as a key derivation factor, and combines them with the current register value of the trusted cryptographic module to realize state-aware key derivation and dynamically derive the key for the power supply equipment.

[0114] A five-level secure boot trust chain is constructed, consisting of hardware root of trust → BootROM → Bootloader → OS → business applications. Each level's key is dynamically derived and embedded with the metric value of the previous level, forming a chain authentication to achieve end-to-end trusted transmission of secure boot and key management.

[0115] Blockchain nodes log key operations and upload these logs to the blockchain network via Merkle tree roots, thus achieving immutable recording and rapid traceability of evidence.

[0116] Design a multi-mode key adaptive engine that supports grid-connected mode, off-grid mode, and fault mode.

[0117] In grid-connected mode, the power supply equipment establishes a communication connection with the cloud server, such as a Transport Layer Security (TLS) connection. The cloud server includes a Key Management System (KMS), with a key validity period of 15 minutes. It adopts short-cycle, high-frequency synchronization, reports the device status and key usage logs in real time, and receives key policies and update instructions issued by the cloud.

[0118] In off-network mode, the key is valid for 1 hour, a long-cycle key is used, a local key pool is enabled, 100 sets of off-network autonomous keys are pre-set, and they are used in a first-in-first-out (FIFO) queue. The offline device records all key operations and synchronizes them in batches after the network is restored.

[0119] In fault mode, the key is valid for 5 minutes, using an ultra-short cycle key with rapid rotation, locking all control outputs, enabling the emergency key, prohibiting remote control, allowing only local maintenance interfaces, immediately solidifying fault scene evidence, and uploading it to the blockchain.

[0120] The following are some specific implementation examples.

[0121] Example 1: Dynamic Key Generation and Secure Startup of Photovoltaic Inverters.

[0122] In this embodiment, the power supply equipment is a 10kW residential photovoltaic inverter, and it is necessary to prevent firmware tampering that could lead to illegal grid connection or theft of power generation data.

[0123] The hardware security module is equipped with national cryptographic algorithm engines of SM2, SM3 and SM4, and has 128KB of secure storage space; the trusted cryptographic module is equipped with 24 PCRs.

[0124] like Figure 4 As shown, for a photovoltaic inverter, the real-time acquired operating state vector SV (i.e., current operating parameters) is as follows: SV=[Ppv=8.5kW, Vdc=360V, Fgrid=50.02Hz, Tdev=45℃].

[0125] After normalization, the state vector SVnorm=SM3("8500∣360∣5002∣450" is obtained.

[0126] Derived control key Kinv = SM3_KDF(Kroot, SVnorm||PCR2||"INVERTER_CONTROL").

[0127] The control key Kinv is valid for 15 minutes in grid-connected mode and for 1 hour in off-grid mode.

[0128] Establish a secure boot trust chain; BootROM measures Bootloader, PCR0 extension; Bootloader measures inverter control firmware, PCR1 extension.

[0129] The control firmware uses Kinv to decrypt grid connection parameters, verify the signature of dispatch instructions, and verify the grid certificate before grid connection.

[0130] In practice, each grid connection, off-grid switch or abnormal event triggers evidence solidification and is uploaded to the blockchain through blockchain nodes. The evidence includes, but is not limited to, state vectors, PCR values, key usage records, and hardware security module signatures.

[0131] Example 2: Multi-mode key management of power conversion system (PCS).

[0132] In this embodiment, the power supply equipment is a 100kW, 215kWh energy storage converter that supports grid-connected charging and discharging, off-grid backup power, and black start functions.

[0133] The hardware security module is equipped with a high-speed SM4 encryption algorithm, exceeding 1000Mbps, and has 256KB of secure storage space; the trusted cryptography module supports active measurement, meaning it can operate in TPCM mode and control the reset signal of the central processing unit (CPU).

[0134] The real-time collected operating parameters include, but are not limited to, battery SOC, SOH, battery temperature, PCS power, grid status, and load demand.

[0135] like Figure 5 As shown, during the operation of the PCS system, the grid status is monitored in real time to determine whether the PCS is operating in grid-connected mode, off-grid mode, or fault mode, and a dynamically derived key is executed according to the selected mode.

[0136] In grid-connected mode, the key is valid for 15 minutes. For example, the running state vector SV, which is the key derivation factor, is [SOC=65%, Ppcs=50kW, Fgrid=50.00Hz]. In grid-connected mode, the key status and SOC data are synchronized to the cloud KMS in real time.

[0137] In off-network mode, the key is valid for 1 hour. For example, the running state vector SV, which is the key derivation factor, is [SOC=65%, Pload=30kW, Vac=380V]. In off-network mode, the preset local key pool is used autonomously to perform offline operation for 72 hours.

[0138] In fault mode, the key is valid for 5 minutes. An emergency key is configured to lock the output. For example, the running state vector SV=[SOC=80%, BlackStart=1, CriticalLoad=20kW] is used as a key derivation factor, where BlackStart represents black start and CriticalLoad represents critical load.

[0139] The fault mode is pre-configured with 20 sets of long-term keys to support the establishment of micronets.

[0140] For example, when a voltage drop in the grid is detected and the frequency is lost, the PCS prepares to perform an automatic mode switch. The hardware security module generates a mode switch token, and the trusted cryptographic module verifies the PCR status. After the hardware security module and the trusted cryptographic module pass the dual verification, the switch from grid connection to off-grid is completed, and the key is updated seamlessly.

[0141] In this embodiment, evidence of mode switching is solidified, and information such as switching time, reason, and state before and after is recorded and written into the blockchain by blockchain nodes for evidence storage.

[0142] The PCS's secure boot process is optimized, with TPCM actively controlling it. After power-on, TPCM resets the CPU signal and measures the BootROM. The hardware security module verifies the Battery Management System (BMS) certificate, and the trusted cryptographic module verifies the PCS control firmware, thus constructing a three-level trust chain from BMS to PCS to Energy Management System (EMS).

[0143] Example 3: Dynamic Key and Secure Billing for Charging Piles

[0144] In this embodiment, the power supply equipment is a 120kW DC fast charging pile, which needs to ensure the security of charging transactions, user privacy, and the non-repudiation of payment vouchers.

[0145] The hardware security module supports SM2 fast signing and has built-in payment key storage; the trusted cryptography module can measure the charging control firmware and payment module.

[0146] The real-time collected operating parameters include, but are not limited to, charging voltage, current, power, user identity, vehicle identification number (VIN), and grid load.

[0147] like Figure 6As shown, the user inserts the gun to complete vehicle identification, and the hardware security module dynamically derives the session key Ksession=SM3_KDF(Kroot, UserID||VIN||Timestamp||"CHARGE_SESSION").

[0148] The charging station uses Ksession for two-way authentication with the vehicle's T-Box, with the charging station verifying the vehicle's certificate and the vehicle verifying the charging station's certificate, thus establishing a secure channel.

[0149] During charging, the hardware security module dynamically derives the billing key Kbilling and the privacy protection key Kprivacy.

[0150] Kbilling=SM3_KDF(Ksession,Energy||Price||"BILLING").

[0151] Kprivacy=SM3_KDF(Ksession,"PRIVACY"||Nonce).

[0152] Once charging is complete, transaction evidence is generated and signed using a hardware security module. The evidence is then uploaded to the blockchain. Each transaction generates evidence Evidence={UserIDhash, VINhash, Energy, Price, Timestamp, SigHSM}. The evidence hash is written to the blockchain, and the user obtains the blockchain transaction hash as a billing credential.

[0153] This application also provides a power supply device.

[0154] The power supply equipment can be photovoltaic power generation equipment, energy storage regulation equipment, charging equipment, photovoltaic-energy storage equipment, or photovoltaic-energy storage-charging equipment. For example, the photovoltaic power generation equipment can be a photovoltaic inverter, the energy storage regulation equipment can be an energy storage converter, the charging equipment can be a car charging pile, and the photovoltaic-energy storage equipment can be an integrated photovoltaic-energy storage unit.

[0155] The power supply device includes a hardware security module and a trusted cryptographic module.

[0156] The hardware security module is used to securely generate, store, and manage digital keys, and has anti-tampering and anti-side-channel attack capabilities. The hardware security module can also support Chinese national cryptographic algorithms. For example, the Chinese national cryptographic algorithms supported by the hardware security module may include at least one of the SM2, SM3, and SM4 algorithms.

[0157] The trusted cryptography module uses the SM series algorithm and has integrity measurement capabilities. It can be used to perform integrity measurement and trust chain transmission.

[0158] In this embodiment, the hardware security module and the trusted cryptographic module serve as carriers of the device's root of trust, enabling key management and secure startup processes for the power supply equipment in dynamic and ever-changing application scenarios.

[0159] The power supply device also includes a processor, a memory, and a computer program stored in the memory and executable on the processor. When the program is executed by the processor, it implements the various processes of the above-described safe startup method embodiment of the power supply device and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0160] This application also provides a power supply system, including at least one power supply device as described above.

[0161] This application also provides a non-transitory computer-readable storage medium storing a computer program. When the computer program is executed by a processor, it implements the various processes of the above-described safe startup method embodiment for power supply equipment and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0162] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0163] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described safe startup method for power supply equipment.

[0164] The processor is the processor in the electronic device described in the above embodiments. The readable storage medium includes computer-readable storage media, such as computer read-only memory (ROM), random access memory (RAM), magnetic disk, or optical disk.

[0165] This application embodiment also provides a chip, which includes a processor and a communication interface. The communication interface is coupled to the processor. The processor is used to run programs or instructions to implement the various processes of the above-described safe startup method embodiment for power supply equipment, and can achieve the same technical effect. To avoid repetition, it will not be described again here.

[0166] It should be understood that the chip mentioned in the embodiments of this application may also be referred to as a system-on-a-chip, system chip, chip system, or system-on-a-chip, etc.

[0167] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element. Furthermore, it should be noted that the scope of the methods and apparatuses in the embodiments of this application is not limited to performing functions in the order shown or discussed, but may also include performing functions substantially simultaneously or in the reverse order, depending on the functions involved. For example, the described methods may be performed in a different order than described, and various steps may be added, omitted, or combined. Additionally, features described with reference to certain examples may be combined in other examples.

[0168] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the related technology, can be embodied in the form of a computer software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0169] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of this application.

[0170] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "illustrative embodiment," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of this application. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0171] Although embodiments of this application have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of this application, the scope of which is defined by the claims and their equivalents.

Claims

1. A safe start-up method for power supply equipment, characterized in that, The power supply equipment has a hardware security module and a trusted cryptographic module, and the method includes: Obtain the current operating parameters of the power supply equipment; When the hardware security module and the trusted cryptographic module establish a communication connection, the hardware security module generates a key for the power supply device based on the current operating parameters and the current register value of the trusted cryptographic module; wherein, the trusted cryptographic module is used to update the current register value based on the integrity metric values ​​of each level of components in the trust chain; The power supply device is securely started based on its key.

2. The safe start-up method for power supply equipment according to claim 1, characterized in that, The method further includes: Obtain the current operating mode of the power supply equipment; Based on the current operating mode of the power supply equipment, the validity period corresponding to the key of the power supply equipment is determined.

3. The safe start-up method for power supply equipment according to claim 2, characterized in that, The device operation modes include off-grid mode, grid-connected mode, and fault mode; the key validity period corresponding to the fault mode is shorter than the key validity period corresponding to the grid-connected mode, and the key validity period corresponding to the grid-connected mode is shorter than the key validity period corresponding to the off-grid mode.

4. The safe start-up method for power supply equipment according to claim 1, characterized in that, The secure startup of the power supply device based on the key of the power supply device includes: Based on the key of the power supply equipment, the power supply equipment is triggered to run the business application; The components of the trust chain include a startup program, a bootloader, an operating system, and the business application.

5. The safe start-up method for power supply equipment according to claim 4, characterized in that, The hardware security module generates a key for the power supply device based on the current operating parameters and the current register value of the trusted cryptographic module, including: The hardware security module and the trusted cryptographic module perform bidirectional verification; If the two-way verification between the hardware security module and the trusted cryptographic module is successful, the boot program measures the bootloader to obtain a first measurement value, and extends the first measurement value to the current register value. Based on the current register value, the hardware security module generates a first device key. The bootloader measures the operating system to obtain a second measurement value, and extends the second measurement value to the current register value. The hardware security module generates a second device key based on the current register value and the first device key. The operating system measures the business application to obtain a third measurement value, and extends the third measurement value to the current register value. The hardware security module generates a third device key based on the current register value and the second device key. The third device key is used to run the business application.

6. The safe start-up method for power supply equipment according to any one of claims 1-5, characterized in that, The hardware security module includes a blockchain node, which is used to write the key operation log of the power supply device into the blockchain.

7. The safe start-up method for power supply equipment according to claim 6, characterized in that, The key operation log includes at least one of the following: key operation type, device status information of the power supply equipment, register value data of the trusted cryptographic module, and signature information of the hardware security module.

8. The safe start-up method for power supply equipment according to any one of claims 1-5, characterized in that, The method further includes: The hardware security module performs security verification based on the operating mode switching signal of the power supply equipment; The hardware security module generates a mode switching token upon successful security verification. The trusted cryptographic module verifies the mode switching token; If the mode switching token is successfully verified, the device operating mode of the power supply equipment is switched in response to the operating mode switching signal.

9. A power supply device, characterized in that, include: Hardware security module and trusted cryptographic module; A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the program, implements the safe startup method of the power supply device as described in any one of claims 1-8.

10. A power supply system, characterized in that, include: At least one power supply device as described in claim 9.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the safe startup method for the power supply equipment as described in any one of claims 1-8.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the safe startup method of the power supply equipment as described in any one of claims 1-8.

Images