Modular power distribution cabinet remote operation privacy protection communication method

Abstract

The application belongs to the technical field of data communication security and cryptographic communication, and specifically relates to a privacy protection communication method for remote operation of a modular power distribution cabinet. The method obtains a target module logical identifier of remote operation, an operation category, pre-confirmation information and an expected response type, constructs an operation context fingerprint, establishes a control causal chain node, generates a dynamic communication alias of the current control causal chain according to a session key state and the fingerprint, binds and encrypts transmission of remote instructions, cabinet end responses and execution confirmations and corresponding nodes, evolves a next session key state using a closed node digest after the control causal chain is closed, and invalidates the original dynamic communication alias, and only migrates a session key state of an abnormal branch in abnormal termination. Through the above processing, module identity representation, message causality and key evolution are kept synchronized, cross-operation communication association and historical message replay are reduced, and the propagation of a single abnormal branch to other normal branch session states is limited.

Description

Technical Field

[0001] This invention belongs to the field of data communication security and cryptographic communication technology, specifically a privacy-protecting communication method for remote operation of modular power distribution cabinets. Background Technology

[0002] Remote operation communication for existing modular distribution cabinets typically involves a protected session established between the remote operation platform and the cabinet's communication program. After authentication, remote operation commands, status responses, and execution confirmations are encapsulated into communication messages. These messages are encrypted using a session key, and integrity verification information is appended to prevent content theft and message tampering during transmission. To identify the specific module corresponding to the remote operation, the communication process usually retains the device number, module number, session identifier, or a logical identifier derived from fixed identity information. The remote platform maps received responses to the corresponding module based on these identifiers. Some solutions also employ periodic key updates to the session key, such as generating new session keys at fixed time intervals, after a fixed number of communications, or upon re-login, ensuring that messages at different stages are protected by different keys. This type of processing primarily focuses on the confidentiality of message content and the legitimacy of the communication subjects. Identification, session status, and key update processes are typically maintained separately, and the business sequence between messages is mainly associated through request sequence numbers, response sequence numbers, or timestamps.

[0003] To reduce information leakage caused by the long-term exposure of fixed device identifiers, some existing solutions further replace the real identifier with temporary identifiers, random identifiers, or device identifiers with digest processing, and update the identifier after the remote operation ends, the connection is re-established, or a predetermined period is reached. Correspondingly, key management usually still updates the entire connection or the entire device session. When the session reaches the key change condition, both communicating parties switch to the new key state. When message anomalies, authentication failures, or connection interruptions occur, communication is usually resumed by re-handshaking, renegotiating the key, or restoring to the most recent global session state. In scenarios where multiple modules are controlled in parallel, although different modules can send requests and responses separately, they often share the same remote connection and the session key of the same stage. Communication between modules depends on a unified session state. Temporary identifiers can reduce the direct exposure of the real identity, and periodic key changes can shorten the continuous use time of a single key, but there is a lack of a state binding relationship between the two that is consistent with the specific remote control process.

[0004] The operation sequence, device identity changes, and session key changes reflected in remote control messages lack a unified causal constraint. Even if the message content is encrypted, attackers can still associate communication records generated by the same module across multiple remote operations based on long-term stable or regularly changing communication identifiers and the persistent temporal relationship between commands and responses. When a unified periodic key change is used, the identity association characteristics do not disappear synchronously with the end of a single control process; if the key change period is shortened, multiple parallel modules need to frequently synchronize session states, and the entire connection may be renegotiation may be triggered due to communication anomalies in one branch. The resulting technical contradiction is that the communication system needs to maintain a continuous control relationship between remote commands, responses, and acknowledgments while allowing the module identity representation and key state to evolve locally with the actual control causal relationship. Existing methods of management by connection, by period, or by fixed identifiers cannot simultaneously satisfy these two constraints, resulting in the long-term retention of cross-operation communication associations and making it easy for a single abnormal control branch to expand into the session states of other normal branches. Summary of the Invention

[0005] The purpose of this invention is to provide a privacy-protected communication method for remote operation of modular power distribution cabinets, which can solve the problems mentioned in the background art.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A privacy-preserving communication method for remote operation of modular power distribution cabinets includes: obtaining the target module logical identifier, operation category, prior confirmation information and expected response type corresponding to the remote operation, constructing an operation context fingerprint, and establishing a control causal chain node based on the operation context fingerprint; Based on the current session key state and the operation context fingerprint, a dynamic communication alias corresponding only to the current control causal chain is generated; Remote commands, counter responses, and execution confirmations are each bound to the control causal chain node and transmitted in encrypted form. After controlling the causal chain closure, the closure node digest and the current session key state input key are used to perform a derivation operation to generate the next session key state, and the dynamic communication alias is invalidated. When the control causal chain terminates abnormally, only the session key state corresponding to the abnormal branch is migrated.

[0007] Preferably, the construction of the operation context fingerprint includes: forming a context field sequence according to a fixed semantic order of target module logical identifier, operation category, prior confirmation information and expected response type; writing the digest of the previous control causal chain node and the current session random variable into the context field sequence; and performing a key digest operation on the context field sequence using the message authentication key corresponding to the current session key state to obtain the operation context fingerprint that is continuously associated with the prior control state.

[0008] Preferably, the generation of the dynamic communication alias includes: combining the operation context fingerprint, the current session key state identifier, and the current control causal chain number into an alias input value; performing a one-way pseudo-random mapping on the alias input value using the alias derived key obtained from the current session key state; and extracting data of a predetermined identifier field length from the mapping result as the dynamic communication alias. The same target module uses different alias input values ​​in different control causal chains.

[0009] Preferably, the binding of the remote command, the cabinet response, and the execution confirmation with the control causal chain node includes: writing a predecessor node summary, a current message role identifier, and a current chain position identifier to each communication message, and generating a message authentication tag based on the operation context fingerprint and the current session key status; The receiving end recovers the sequence of events of the message in the control causal chain according to the predecessor node digest. When the authentication tag is verified and the message role corresponds to the current chain position, the receiving end registers the communication message as a new valid node.

[0010] Preferably, the operation context fingerprint is formed by a recursive update method: each time an authenticated valid node is received or sent, the message role identifier, chain position identifier and current node ciphertext digest in the valid node are combined with the previous operation context fingerprint to generate a new context state value. Before the next communication message is formed, the new context state value replaces the previous operation context fingerprint in the message authentication key calculation, and the initial context field sequence is retained as the starting binding basis for the current control causal chain.

[0011] Preferably, the dynamic communication alias performs inter-chain migration when the control causal chain is closed: extracting the node digest of the last valid node, the closure confirmation information and the current session key status identifier to form a closure input value, and driving the alias derived key update by the closure input value; When the next control causal chain is established, the dynamic communication alias is regenerated using the updated alias-derived key and the new operation context fingerprint, and the alias input value corresponding to the previous control causal chain is registered as a historical input that cannot be accepted again.

[0012] Preferably, when remote operations corresponding to multiple target modules exist in parallel, an independent branch identifier is assigned to each control causal chain, and the branch identifier is written into the authentication input of the predecessor node digest; Nodes within the same branch only reference the summary of their predecessor nodes in that branch; cross-referencing between different branches is prohibited. When the execution confirmation ends the corresponding branch, the summary of the last valid node of the branch is written into the branch closure record, and the unclosed branches continue to form independent authentication continuity relationships along their respective predecessor node summaries.

[0013] Preferably, when the control causal chain times out, authentication fails, or sequence conflicts, the most recently authenticated valid node is determined as the abnormal branch anchor point, and the migration input value is formed based on the node summary, abnormal type identifier, and current branch identifier of the abnormal branch anchor point. The migration input value is processed using the branch-derived key in the current session key state to generate a new branch key state, and the abnormal node and its subsequent unconfirmed node are marked as not being referenced as a subsequent predecessor node.

[0014] Preferably, after the new branch key state is generated, the recursive context state value corresponding to the abnormal branch anchor point and the migration input value are written together into the branch recovery state; When communication is restored, the branch recovery state is used as the starting point of the new operation context fingerprint, and the message authentication tag of the first recovery node is generated from the new branch key state; The first recovery node carries both the summary of the abnormal branch anchor point and the recovery sequence number. Subsequent nodes only re-establish the predecessor reference relationship along the first recovery node.

[0015] Preferably, after the control causal chain is closed or the anomaly is recovered, the final node summary of the corresponding branch, the current dynamic communication alias status, and the branch key status are combined to form a session checkpoint, and an integrity tag is generated using the checkpoint authentication key corresponding to the current session key status. In the event of subsequent message loss or inconsistency between the states of the two parties, only the most recent session checkpoint that can be verified by the integrity tag and is consistent with the current branch identifier will be accepted, and the alias derivation state, branch key state, and predecessor node reference starting point will be restored accordingly.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. By combining the target module's logical identifier, operation category, prior confirmation information, and expected response type to form an operation context fingerprint, and using this fingerprint to establish control causal chain nodes, remote commands, counter responses, and execution confirmations all form a continuous authentication chain along a defined preceding relationship. The current session key state, together with the operation context fingerprint, participates in dynamic communication alias generation, allowing the same target module to correspond to different communication representations in different control causal chains. After the control causal chain is closed, the closing node digest participates in the derivation of the next session key state, while simultaneously invalidating the previous dynamic communication alias. This ensures that changes in module identity representation and key state are triggered by the actual remote control process, rather than relying on a fixed time or a fixed number of messages. Even if an attacker continuously obtains encrypted messages, it is difficult to directly merge two control processes into the same module based solely on a stable identifier or a regular number change relationship. The aliases and key states used in the historical control causal chain exit subsequent communication after the chain is closed, reducing the possibility of cross-operation identity association and historical encrypted messages continuing to participate in subsequent sessions.

[0017] 2. After the operation context fingerprint is updated using a node-recursive method, each authenticated message incorporates its message role, chain position, and current node ciphertext digest into the subsequent context state. This prevents inserted, swapped, or disconnected messages from their predecessor relationships from continuing along the original authentication continuity. When multiple target modules run in parallel, each control causal chain is kept separate through independent branch identifiers and independent predecessor node digests. When a branch times out, fails authentication, or experiences a sequence conflict, the most recently authenticated valid node is used as the anchor point for the abnormal branch. A new branch key state is generated only based on the corresponding branch's node digest, abnormal type, and branch identifier. Other unclosed branches maintain their original authentication continuity. Combined with session checkpoints that save the final node digest, dynamic communication alias state, and branch key state, the corresponding branch can be recovered from the most recent checkpoint after integrity verification in case of message loss or inconsistency between the two parties' states, without resetting the entire parallel session. This limits the scope of abnormal propagation and maintains the isolation of key states, alias states, and predecessor reference relationships between different control branches. Attached Figure Description

[0018] Figure 1 A flowchart illustrating the control causal chain and privacy protection communication process for remote operation of modular power distribution cabinets; Figure 2 For operation context fingerprinting; Figure 3 Flowchart for parallel control of causal chain anomaly migration and session checkpoint recovery; Figure 4 This is a branch key migration graph. Detailed Implementation

[0019] In one embodiment, a privacy-preserving communication method for remote operation of a modular power distribution cabinet includes: acquiring the target module logical identifier, operation category, prior confirmation information, and expected response type corresponding to the remote operation; constructing an operation context fingerprint; and establishing a control causal chain node based on the operation context fingerprint; generating a dynamic communication alias that corresponds only to the current control causal chain based on the current session key state and the operation context fingerprint; binding the remote command, cabinet response, and execution confirmation to the control causal chain node and transmitting them encrypted; after the control causal chain is closed, performing a key derivation operation on the closed node digest and the current session key state to generate the next session key state, and invalidating the dynamic communication alias; and migrating the session key state corresponding to the abnormal branch when the control causal chain terminates abnormally.

[0020] In this embodiment, please refer to Figure 1 When the remote operation platform initiates remote operation on a modular distribution cabinet, it does not directly use the long-term stable module identity as the basis for continuous addressing throughout the communication process. Instead, it obtains the target module logical identifier, operation category, pre-confirmation information, and expected response type related to the current remote operation within the established protected session. The target module logical identifier distinguishes the logical object being remotely operated within the cabinet; the operation category indicates the control semantic category carried by this communication; the pre-confirmation information indicates the continuity between the current operation and previously completed or accepted control states; and the expected response type limits the remote platform's permissions after the current operation. In accordance with the response semantics of the causal chain, the communication program encodes the above content into a context record with a defined field order. It also introduces a random quantity used only in the current session state and a node digest formed by the previous control causal chain for each remote operation. This ensures that even if the same target module continuously receives the same type of remote operation, its context record will not form a reusable fixed input. Subsequently, the context record is processed with a key digest to form an operation context fingerprint. The operation context fingerprint is used as the common state basis for the initial node of this control causal chain, subsequent dynamic alias generation, and message authentication. This avoids the identity protection process and the control message order maintenance process being independent of each other.

[0021] Specifically, the control causal chain advances according to the actual sequential dependencies of remote commands, counter responses, and execution confirmations in this operation. After generating a remote command, the remote platform records the predecessor digest of the current node and completes encryption and authentication. After receiving the message, the counter verifies the dynamic communication alias, predecessor relationship, and authentication data based on the same session state. Only after successful verification is a counter response node corresponding to the remote command generated. The remote platform then forms an execution confirmation node based on the response node. Therefore, the communication stages of the same remote operation are continuously associated through cryptographic states rather than solely relying on time order. When the execution confirmation meets the predetermined closure conditions of this operation, the last authenticated node is determined as the closure node, and the closure node digest is extracted to participate in the derivation of the next session key state. The alias-related keys and message authentication-related keys required for subsequent operations are re-derived from the new session key state. At the same time, the previous dynamic communication alias is removed from the acceptable state set. When the current control process cannot continue to close due to timeout, authentication failure, or message order conflict, a migration state is established only for the abnormal causal chain branch. Branches that have been established by other target modules and still maintain continuous authentication relationships do not participate in the migration.

[0022] Operation context fingerprints can be constructed according to the following relationship: ; in, This represents the operation context fingerprint formed by the nth remote operation. Indicates the length of data retained from the keyed digest result. This represents the message authentication key corresponding to the nth remote operation. Indicates the logical identifier of the target module. Indicates the operation category code. This indicates the preceding confirmation information referenced by the current operation. Indicates the expected response type encoding. This indicates that the digest of the final node in the control causal chain has been confirmed prior to the current operation. This represents a random variable generated by the current session state and used in this context construction, symbol... This indicates that byte strings are concatenated according to the predefined field order. Indicates truncation. The key digest is represented by a truncation operation that continuously extracts the key digest from a fixed position. The length data ensures that both communicating parties obtain a consistent operation context fingerprint when they have the same field encoding method and hold the corresponding key status.

[0023] In a preferred embodiment, each field in the formula employs a length-defined data encoding method, enabling the receiving end to recover the input boundary according to the order of target module logical identifier, operation category, prior confirmation information, expected response type, previous node summary, and random quantity. For example, when the same target module performs two consecutive remote operations belonging to the same operation category and with the same expected response type, even if... , and Maintain consistency, as long as the previous control formed the causal chain. Or the random number this time If the input byte sequence with key digest changes, the resulting sequence will also change. As the current causal state changes, when the attacker only obtains the transmitted message but cannot obtain... In some cases, it is impossible to establish a stable context fingerprint mapping by repeatedly calculating public fields. Instead, the communicating parties can use the jointly maintained session state to recalculate the fingerprint, which serves as a common input for the calculation of subsequent dynamic communication aliases and authentication tags, ensuring that the source of changes in identity representation is consistent with the progress of remote control status.

[0024] In a preferred embodiment, each field in the formula employs a length-defined data encoding method, enabling the receiving end to recover the input boundary according to the order of target module logical identifier, operation category, prior confirmation information, expected response type, previous node summary, and random quantity. For example, when the same target module performs two consecutive remote operations belonging to the same operation category and with the same expected response type, even if... , and Maintain consistency, as long as the previous control formed the causal chain. Or the random number this time If the input byte sequence with key digest changes, the resulting sequence will also change. As the current causal state changes, when the attacker only obtains the transmitted message but cannot obtain... In some cases, it is impossible to establish a stable context fingerprint mapping by repeatedly calculating public fields. Instead, the communicating parties can use the jointly maintained session state to recalculate the fingerprint, which serves as a common input for the calculation of subsequent dynamic communication aliases and authentication tags, ensuring that the source of changes in identity representation is consistent with the progress of remote control status.

[0025] Please refer to Figure 2 , Figure 2 The horizontal axis represents the remote operation sample number, ranging from 1 to 96, and the vertical axis represents the fingerprint change intensity, ranging from 0 to 0.75. Figure 2The solid black line in the middle represents the fingerprint change intensity curve marked with hollow circles, indicating the proportion of differences in the operational context fingerprints formed by adjacent samples; the gray dotted line represents the input perturbation level curve marked with hollow squares, indicating the degree of perturbation of fields such as target module logical identifier, operation category, preceding confirmation information, expected response type, previous node summary, and current session randomness in the sample sequence. Figure 2 The short dashed line and the dotted line represent the first warning threshold and the second warning threshold, respectively, and are used to distinguish between general context changes and high-intensity context changes.

[0026] from Figure 2 As can be seen, the fingerprint change intensity curve maintains a high level of fluctuation throughout the sample sequence. Most sampling points are above the first warning threshold and fluctuate around the medium-to-high intensity range. This indicates that even if consecutive remote operations belong to the same target module or the same operation category, changes in prior confirmation information, the summary of the previous control causal chain node, and the randomness of the current session will still cause significant changes in the output fingerprint. The input disturbance level curve shows periodic declines and jumps, reflecting that when different field combinations are repeatedly included in the context record, the input disturbance is not a simple increase, but rather undergoes phased reorganization as the control state progresses.

[0027] Figure 2 Corresponding operation context fingerprint symbol The engineering meaning of it. Figure 2 The intensity of fingerprint changes can be understood as the intensity of fingerprint changes. A visual representation of the degree of difference between adjacent remote operations; the input perturbation level corresponds to the construction. The strength of changes in the context fields involved in the connection is measured. The curve consistently above the low threshold indicates that key digest and truncation processing did not compress the same modules and operation categories into stable, traceable identities; when individual samples approach the second warning threshold, it indicates that changes in the predecessor digest or random variables have a more significant impact on the current context fingerprint.

[0028] Preferably, according to the aforementioned privacy-preserving communication method for remote operation of modular power distribution cabinets, the construction of the operation context fingerprint includes: forming a context field sequence according to a fixed semantic order of target module logical identifier, operation category, prior confirmation information and expected response type; writing the digest of the previous control causal chain node and the current session random quantity into the context field sequence; and performing a key digest operation on the context field sequence using the message authentication key corresponding to the current session key state to obtain the operation context fingerprint continuously associated with the prior control state.

[0029] In this embodiment, the fixed semantic order is not a simple string concatenation of each field. Instead, each field is assigned a field type, field length, and field value range under the encoding rules agreed upon by both parties in advance. The encoding result of the target module logical identifier is only used to represent the target logical object within the session. The operation category is converted into a control category code that can be recognized by the current remote communication protocol. The pre-confirmation information is generated from the status record corresponding to the previous confirmed control result. The expected response type is determined based on the next type of message that the current operation allows to enter the control causal chain. Subsequently, the digest of the previous control causal chain node and the current session random quantity are written to the end of the field sequence. The entire field sequence is used as the complete input for the key digest operation. The receiving end is not allowed to omit unknown fields and continue verification. Instead, it must restore the same byte sequence as the sending end according to the field type and length and recalculate the digest. Therefore, there is no situation where equivalent inputs are generated by adjusting the separator position between different fields. The pre-confirmation status, node continuity relationship, and current random status jointly participate in fingerprint generation.

[0030] Furthermore, the current session key state can store separate message authentication key states, alias-derived key states, and branch-derived key states. The message authentication key is only used for operation context and message authentication data calculation and is not directly used as the message content encryption key or dynamic communication alias output value. After the communication parties establish the session, they derive each purpose state according to the common session secret and purpose identifier, and update the application when the control causal chain is closed or the branch migrates abnormally. This ensures that the same key material does not simultaneously serve different cryptographic processing purposes. When constructing the operation context fingerprint, the program reads the message authentication key state bound to the current target branch and the digest of the most recent valid node. After completing the operation context fingerprint with key digest, the obtained operation context fingerprint is written into the current chain state record. The chain state record is associated with at least the dynamic communication alias generation state, the current predecessor node digest, the allowed next message role, and the current branch identifier, so that subsequent processing can determine whether a message belongs to the current control process from the same context state.

[0031] Preferably, according to the aforementioned privacy-preserving communication method for remote operation of modular power distribution cabinets, the generation of dynamic communication aliases includes: combining the operation context fingerprint, the current session key status identifier, and the current control causal chain sequence number into an alias input value; performing a one-way pseudo-random mapping on the alias input value using the alias derived key obtained from the current session key status; and extracting data of a predetermined identifier field length from the mapping result as a dynamic communication alias; the same target module uses different alias input values ​​in different control causal chains.

[0032] In this embodiment, the current session key status identifier is used to distinguish the key evolution generation of the two communicating parties, and the control causal chain sequence number is used to distinguish different control processes that have been established under the same key evolution generation. When the program generates alias input values, it encodes them in a fixed order according to the operation context fingerprint, the current session key status identifier, and the current control causal chain sequence number, and performs one-way pseudo-random mapping using a derived key dedicated to alias generation to obtain data with a length greater than the actual communication identifier field. Then, it truncates the identifier according to the identifier length allowed by the communication protocol. If the truncation result is duplicated with other dynamic communication aliases that are still in an acceptable state in the current session, the conflict is not handled by modifying the target module logic identifier. Instead, the alias recalculation count inside the current control causal chain is incremented and the recalculation count is added to the original alias input value to re-execute the mapping until an identifier value not occupied by the current valid chain is obtained. The recalculation count is only stored in the session state of both parties and is updated synchronously with the alias state.

[0033] Specifically, when the remote platform sends remote commands, it uses dynamic communication aliases to represent the communication objects of the current control causal chain. After obtaining the dynamic communication alias, the cabinet does not directly restore the real module identity through the long-term mapping table. Instead, it obtains the operation context fingerprint, session key status identifier, and control causal chain sequence number of each candidate chain from the currently valid control causal chain state. It then recalculates the corresponding alias-derived input and locates the matching chain state. After matching, the internal processing object is determined by the target module logical identifier stored in the chain state. When a control causal chain is closed or determined to be unusable, its dynamic communication alias is removed from the current matching set. Even if subsequent new operations point to the same target module, different alias input values ​​will be generated due to changes in the operation context fingerprint, key status identifier, or control causal chain sequence number. No module identifier that remains unchanged across the control process is retained in the communication transmission data.

[0034] Preferably, according to the aforementioned privacy-protected communication method for remote operation of modular distribution cabinets, the binding of remote commands, cabinet responses, execution confirmations, and control causal chain nodes includes: writing a predecessor node summary, a current message role identifier, and a current chain position identifier to each communication message, and generating a message authentication tag based on the operation context fingerprint and the current session key status; the receiving end restores the message's sequential relationship in the control causal chain according to the predecessor node summary, and registers the communication message as a new valid node when the authentication tag is verified and the message role corresponds to the current chain position.

[0035] In this embodiment, the predecessor node digest is taken from the most recently authenticated node in the current control causal chain that has been accepted by both parties. When the initial remote command does not have a predecessor node within this chain, the initial binding digest saved when the chain was established is used as the predecessor basis. The message role identifier limits the current message to a communication role among remote command, counter response, or execution confirmation. The current chain position identifier is used to indicate the logical position of the role in the current causal chain. After the sender encrypts the content of the message to be sent, it performs authentication processing on the dynamic communication alias, predecessor node digest, message role identifier, chain position identifier, ciphertext digest, and operation context fingerprint to generate a message authentication tag corresponding to the current session key state. After the receiver completes the tag verification, it checks whether the message role belongs to the successor role allowed by the current chain state and whether the chain position can be obtained by advancing from the current valid node. If any condition is not met, the message is not registered as a valid node.

[0036] Furthermore, each valid node can store a node digest, a predecessor node digest, a message role identifier, a chain position identifier, a ciphertext digest, a dynamic communication alias state reference, and the corresponding operation context state value when the node was generated. The node digest is formed by encoding the above fields in a determined order and then performing a ciphertext digest operation. When a subsequent message is received, the communication program first uses the predecessor node digest it carries to locate the valid node in the current branch's valid node record, and then checks whether the located node is the end node that is currently allowed to continue. If an attacker copies the historical response and resends it, even if the ciphertext and authentication data of the historical message itself remain intact, its predecessor node digest and the current chain end state cannot form an allowed successor relationship, and the program will not use the historical response to change the current control chain position. Similarly, when two legitimate messages are exchanged in the order of sending, the predecessor node referenced by the later message is inconsistent with the current state, so it is impossible to enter the current control causal chain by verifying the authenticity of only a single message.

[0037] Preferably, according to the aforementioned privacy-preserving communication method for remote operation of modular power distribution cabinets, the operation context fingerprint is formed by a recursive update method: each time an authenticated valid node is received or sent, the message role identifier, chain position identifier, and current node ciphertext digest in the valid node are combined with the previous operation context fingerprint to generate a new context state value; before the next communication message is formed, only the new context state value replaces the previous operation context fingerprint in the message authentication key calculation, and the initial context field sequence is retained as the starting binding basis of the current control causal chain.

[0038] In this embodiment, the initial operation context fingerprint generated when the causal chain is established serves as the initial context state of this chain. After a remote instruction forms a valid node, the sending end combines the message role identifier, chain position identifier, and ciphertext digest of the remote instruction with the initial context state in a determined order, and generates the first recursive context state using the message authentication key corresponding to the current branch. After the counter authenticates the same remote instruction, it executes the same recursion and obtains a consistent state. Subsequently, the authentication tag of the counter response is formed based on the first recursive context state. After the response is authenticated, the message role, chain position, and ciphertext digest corresponding to the response are incorporated into the recursive input again, thereby obtaining the next context state used for the execution confirmation phase. Therefore, the authentication state used by subsequent messages accumulates the sequence information and ciphertext change information of all valid nodes in this chain, rather than just binding the initial remote operation field.

[0039] In a preferred embodiment, the program simultaneously saves the initial context field sequence and the current recursive context state for each control causal chain. The initial context field sequence remains unchanged throughout the chain's lifetime and is used for session recovery, abnormal branch anchor verification, and reconfirmation of the current chain's initial semantics. The current recursive context state is updated with each valid node. When the receiving end detects a lost message, it is not allowed to skip the missing node and continue recursion directly. Instead, it maintains the last recursive state confirmed by both parties and enters an exception handling phase. Only after re-establishing the starting point through the branch recovery mechanism is it allowed for subsequent nodes to form a new recursive relationship. When the message content changes during transmission, its ciphertext digest changes accordingly. If the authentication verification of the current node fails or the recursive context states formed by both parties are inconsistent, subsequent messages cannot continue to form an acceptable authentication continuity relationship based on the erroneous context.

[0040] Preferably, according to the aforementioned privacy-preserving communication method for remote operation of modular power distribution cabinets, the dynamic communication alias undergoes inter-chain migration when the control causal chain is closed: the node digest of the last valid node, the closure confirmation information, and the current session key status identifier are extracted to form a closure input value, which drives the alias-derived key update; when the next control causal chain is established, the updated alias-derived key and the new operation context fingerprint are used to regenerate the dynamic communication alias, and the alias input value corresponding to the previous control causal chain is registered as a historical input that cannot be accepted again.

[0041] In this embodiment, the closure confirmation information is generated by the confirmation data in the current control causal chain that indicates that the remote operation has entered the final state. After confirming the last valid node, both communicating parties obtain the same node digest, the same closure confirmation information, and the current session key state identifier, and form a closure input value in a predefined order. Then, the closure input value and the current alias derived key state are input into the key derivation process. The result replaces the original alias derived key state and is written into the next available session state. During the update process, the generation identifier that can identify that the previous generation state has been discontinued is retained, but the entry point for generating a new alias using the previous derived key is not retained. Therefore, when the next control causal chain is established, even if the target module logic identifier is exactly the same as the previous control causal chain, the new operation context fingerprint and the updated alias derived key jointly determine the new dynamic communication alias.

[0042] Specifically, the alias input value corresponding to the previous control causal chain consists of the old operating context fingerprint, the old session key status identifier, the old control causal chain sequence number, and the recalculation count used when a conflict occurs. After the chain is closed, the program writes the alias input value or its protected digest into the historical input set and marks the corresponding dynamic communication alias status as invalid. When the receiving end receives a message carrying an invalid alias, it does not restore the business processing status with the historical alias, but only uses it to determine whether the message belongs to a terminated historical control process. The historical input set is organized according to the key status generation. When there is no control causal chain that can be restored in the corresponding generation and the checkpoint is solidified, only the irreversible digest of the historical input can be retained for repeated detection, avoiding the need to restore the cross-session identity relationship by storing the direct mapping between the real module identifier and the historical dynamic communication alias for a long time.

[0043] Preferably, please refer to Figure 3 According to the aforementioned privacy-protected communication method for remote operation of modular power distribution cabinets, when remote operations corresponding to multiple target modules exist in parallel, an independent branch identifier is assigned to each control causal chain, and the branch identifier is written into the authentication input of the predecessor node summary; nodes in the same branch only reference the predecessor node summary of this branch, and cross-referencing between different branches is prohibited; when the execution confirmation ends the corresponding branch, the last valid node summary of the branch is written into the branch closure record, and the unclosed branches continue to form an independent authentication continuity relationship along their respective predecessor node summaries.

[0044] In this embodiment, the branch identifier is determined by the current session state, the control causal chain sequence number, and the local unoccupied branch space when the control causal chain is created. The branch identifier is only used to distinguish the control chains that exist in parallel within the current session and does not directly express the true identity of the target module. When the sending end forms the node digest and the message authentication label, it uses the branch identifier as part of the authentication input. After receiving the message, the receiving end first locates the candidate control chain based on the dynamic communication alias, and then checks whether the predecessor node referenced by the message belongs to the same candidate chain based on the branch identifier. If the predecessor node digest carried by the message comes from other branches, even if the referenced node itself actually exists and has been authenticated, it cannot form a successor relationship allowed by the current branch. Thus, different control processes in the same remote connection are separated into cryptographic state chains that advance independently.

[0045] Furthermore, when the remote platform controls multiple target modules simultaneously, each branch maintains its current operation context state, current dynamic communication alias, most recently valid node digest, allowed next message role, message authentication key reference, and branch key state reference. The shared session only provides the upper-layer key state generation and communication channel, without using a global chain position to force all modules to proceed in a uniform order. For example, if one branch has received a cabinet response and is waiting for execution confirmation, while another branch is still in the remote command authentication stage, the communication program processes subsequent messages according to its respective most recently valid node digest. After the first branch completes execution confirmation, it writes its last valid node digest and closure confirmation data into the branch closure record and exits the active branch set. The other branch continues to advance using its original predecessor node digest, recursive context state, and dynamic communication alias, without needing to reconstruct the control chain that has not yet ended due to the closure of other branches.

[0046] Preferably, according to the aforementioned privacy-preserving communication method for remote operation of modular power distribution cabinets, when a timeout, authentication failure, or sequence conflict occurs in the control causal chain, the most recently authenticated valid node is identified as the abnormal branch anchor point. A migration input value is formed based on the node digest, abnormal type identifier, and current branch identifier of the abnormal branch anchor point. The migration input value is processed using the branch-derived key in the current session key state to generate a new branch key state, and the abnormal node and its subsequent unconfirmed nodes are marked as not being referenced as subsequent predecessor nodes.

[0047] In this embodiment, a timeout indicates that the current branch has not obtained a successor authentication message matching the current chain position within its session control window after sending a valid node. Authentication failure indicates that the authentication tag, dynamic communication alias status, or ciphertext integrity of the received message cannot pass the current branch status verification. Sequence conflict indicates that although the message can complete the basic integrity verification, its predecessor node digest or message role is inconsistent with the successor relationship allowed by the current branch. When any of the above anomalies occur, the program does not construct a new node with the abnormal message. Instead, it reverses the location of the most recent valid node that has been confirmed by the local end and is in a stable state in the current branch node record, identifies the node as the abnormal branch anchor point, and freezes the candidate nodes that have not yet been mutually confirmed after the abnormal anchor point. The frozen candidate nodes are retained for duplicate message identification but are no longer allowed as predecessor nodes for subsequent messages.

[0048] The new branch key state can be formed according to the following relationship: ; in, This indicates the branch key state corresponding to branch b before the anomaly occurred. This indicates the new branch key status used by branch b after the migration is complete. A node summary representing the anchor point of an abnormal branch. Indicates the current exception type identifier. Indicates the current branch identifier. This represents the migration randomness used in this branch migration and bound to the current session state, symbol... Continuing, this indicates that byte string concatenation is performed according to predefined field boundaries. This represents a key derivation operation. The key derivation operation takes the original branch key state as the secret input and the above connection result as the state context, so that the key material after the branch migration is simultaneously bound to the last trusted node before the anomaly, the anomaly category, and the specific branch where the anomaly occurred.

[0049] In a preferred embodiment, if branch b experiences authentication failure, then Take the authentication failure type code agreed upon by both communicating parties. Retrieve the digest of the most recently confirmed node before the authentication failure message, keeping the current branch identifier unchanged. Generated from the random state of the current session, forming Only the branch key state saved in branch b is replaced. Other branches that exist in parallel with branch b retain their original branch key states. For example, if branch c does not have any abnormalities, it continues to use its existing state to complete message authentication and predecessor reference. When an abnormal branch recovers, it does not reference the node digest or key material of branch c. This ensures that the cause of the abnormality, the location of the abnormality, and the key migration boundary remain consistent, and avoids the state of branches without abnormalities being synchronously changed by uniformly updating the entire session.

[0050] Furthermore, the branch derivation key can be obtained from The process is further divided according to purpose into message authentication sub-states required for node authentication recovery, encryption sub-states required for message content protection after recovery, and authentication sub-states required for subsequent checkpoint generation. Purpose-based separation uses different purpose codes for derivation. Before writing the new state, the recovery procedure marks the old branch key state as only allowing verification of previously confirmed historical records and prohibiting the generation of new messages. During migration, when a message is received referencing an abnormal node or a frozen candidate node as a predecessor, it directly enters the duplicate message processing path without using message modification. Therefore, the old state and the new state remain isolated in terms of usage and time boundaries, while the chain history that has been stably confirmed before the migration occurs can be verified using the anchor points of the abnormal branches.

[0051] Please refer to Figure 4 , Figure 4 The horizontal axis represents the sequence number of the abnormal event sample, ranging from 1 to 48, and the vertical axis represents the state transition index, ranging from 0 to 4.5. Figure 4 The solid black line represents the state difference ratio curve marked with hollow circles, indicating the degree of change in the key state digest before and after the anomalous branch migration; the dark gray dotted line represents the key generation change curve marked with hollow squares, indicating whether the branch key state has entered a new generation after anomaly handling; the thick dark gray dashed line represents the number of frozen nodes marked with hollow triangles, indicating the size of candidate nodes excluded from subsequent predecessor references after the anomalous anchor point. The short dashed line and dotted line represent the first and second warning thresholds, respectively.

[0052] from Figure 4 As can be seen, the state difference ratio curve is stably distributed in the low to medium range, indicating that each anomalous migration creates a detectable state difference, but this difference does not expand into unbounded growth. The key generation change curve remains basically near a fixed step, indicating that each anomalous sample triggers a controlled branch key update, rather than a repeated reset of the entire session state. The frozen node number curve shows a clear periodic peak, which is usually located in the high range, indicating that there is a batch of candidate nodes after the anomalous anchor point that need to be frozen and cannot continue to serve as trusted precursors for recovered messages. The three curves together show the sequential relationship between anomaly identification, node freezing, and key migration.

[0053] Figure 4 Corresponding new branch key state symbol The formation process. The proportion of state differences reflects... Relative to the original branch key state The update effect is that the key generation change corresponds to the state advancement after the abnormal branch b is migrated separately, and the number of frozen nodes corresponds to the range of unconfirmed nodes that need to be isolated after the abnormal branch anchor point digest. Figure 4 Only anomalous samples trigger changes in migration metrics, rather than all parallel branches changing synchronously, indicating that the anomaly type identifier... Branch identifier and migration random variables They jointly constrained the migration boundary.

[0054] Preferably, according to the aforementioned privacy-preserving communication method for remote operation of modular power distribution cabinets, after the new branch key state is generated, the recursive context state value corresponding to the abnormal branch anchor point and the migration input value are jointly written into the branch recovery state; during communication recovery, the branch recovery state is used as the starting point of the new operation context fingerprint, and the message authentication tag of the first recovery node is generated from the new branch key state; the first recovery node carries both the abnormal branch anchor point summary and the recovery sequence number, and subsequent nodes only re-establish the predecessor reference relationship along the first recovery node.

[0055] In this embodiment, the branch recovery state includes the recursive context state that both parties can recalculate at the abnormal branch anchor point, the protected representation of the migration input value, the current branch identifier, the generation of the new branch key state, and the initial value of the recovery sequence number. The recursive context state ensures that the recovery process still inherits the control semantics that were confirmed before the anomaly occurred. The migration input value ensures that the recovery starting point is associated with the current anomaly handling process. The recovery sequence number is used to distinguish multiple recovery processes formed by the same branch after different anomaly events. After the two communicating parties generate the recovery state, they do not continue to use the last unconfirmed recursive result before the anomaly occurred. Instead, they combine the stable recursive state corresponding to the abnormal branch anchor point with the migration state to form a new context starting point. The authentication data of the first recovery node is calculated by the new branch key state, and the abnormal branch anchor point digest and the current recovery sequence number are added to the authentication input.

[0056] Specifically, after receiving the first recovery node, the receiving end first locates the branch in the recovery state based on the branch identifier, then checks whether the abnormal branch anchor digest it carries is equal to the stable anchor digest recorded by the receiving end. Subsequently, it checks whether the recovery sequence number is equal to the current recovery sequence number that the receiving end is allowed to accept, and uses the new branch key state verification message authentication label. Only after the verification is successful is the first recovery node registered as the new starting point of the recovery chain. At the same time, a new node digest is calculated and the current predecessor reference in the recovery state is replaced. Subsequent counter responses or execution confirmations can only reference the first recovery node or the nodes that have been authenticated afterward. It is not allowed to re-reference the abnormal nodes frozen before the migration. In this way, a new authentication continuity relationship is formed on the basis of preserving the trusted control state before the abnormality. After the recovery is completed, the current recovery sequence number is written into the branch state. When an abnormality occurs again, the sequence number is incremented and a new recovery starting point is formed.

[0057] In a preferred embodiment, if the anomaly occurs at the stage where the remote command has been authenticated by the counter but the counter response has not been confirmed by the remote platform, the abnormal branch anchor point that can be jointly recognized by the counter and the remote platform can be identified as the remote command node. During the recovery process, the unconfirmed response is not directly re-identified as a valid node. Instead, the party holding the new branch key state re-forms the first recovery node according to the current control semantics. The first recovery node carries the original remote command node digest and the new recovery sequence number. If the original unconfirmed response subsequently arrives due to network delay, its authentication label belongs to the pre-migration state and its predecessor relationship does not belong to the new recovery chain. The communication program identifies it as a pre-migration candidate node and prohibits the advancement of the current chain state, thus avoiding the formation of a double successor between delayed historical messages and the new messages after recovery.

[0058] Preferably, according to the aforementioned privacy-preserving communication method for remote operation of modular power distribution cabinets, after the control causal chain is closed or anomaly is recovered, the final node summary of the corresponding branch, the current dynamic communication alias status, and the branch key status are combined to form a session checkpoint, and an integrity label is generated using the checkpoint authentication key corresponding to the current session key status; when subsequent message loss or inconsistency between the two parties occurs, only the most recent session checkpoint that can be verified through the integrity label and is consistent with the current branch identifier is accepted, and the alias derivation status, branch key status, and predecessor node reference starting point are restored accordingly.

[0059] In this embodiment, a session checkpoint is generated after the control causal chain has been re-established and a stable confirmed state has been formed. The checkpoint record includes the branch identifier of the corresponding branch, the final node digest, the current dynamic communication alias state reference, the current alias derived key generation, the protected representation of the branch key state, the current recursive context state digest, the current recovery sequence number, and the checkpoint sequence number. The communication program encodes the above fields in a fixed order and generates an integrity label using the key in the current session key state that is dedicated to checkpoint authentication. The integrity label is stored together with the checkpoint. The checkpoint itself does not directly record a plaintext mapping that can interpret the real module identity without the key state. Therefore, when resuming the session from the checkpoint, a legitimate session state that matches the checkpoint generation is still required.

[0060] Furthermore, when the states of both parties are inconsistent, the locally saved checkpoint records are retrieved within the range of the current branch identifier, and integrity verification is performed starting from the checkpoint with the newest sequence number. The verification includes whether the checkpoint field encoding is complete, whether the integrity label can be recalculated from the corresponding checkpoint authentication key, whether the checkpoint branch identifier is consistent with the branch to be recovered, and whether the final node digest exists in the local confirmed history. If any condition is not met, the current state is not overwritten by the checkpoint. After finding the most recent checkpoint that meets the conditions, the alias-derived state generation, branch key state, current recursive context state, and predecessor node reference starting point are recovered from it. Then, both parties confirm the same checkpoint sequence number through protected messages. Only after the checkpoint is confirmed can a new remote command node or recovery node be formed, avoiding the unilateral use of an old state that has not been confirmed by the other party to continue sending messages.

[0061] In this embodiment, for a normally closed control causal chain, the final node digest in the session checkpoint corresponds to the closed node digest, and the dynamic communication alias state is recorded as an invalid state while simultaneously recording the next alias derivation state generation. Therefore, the old dynamic communication alias of the closed control causal chain will not be reactivated during subsequent recovery. For branches that have completed abnormal recovery but whose control process still needs to continue, the final node digest in the session checkpoint corresponds to the most recent stable node in the recovery chain. The dynamic communication alias state can maintain the current state bound to the recovery chain, while the branch key state uses the new state after migration. Thus, within the same checkpoint structure, the terminated historical chain and the recovery chain that is still allowed to continue can be distinguished. When a message carrying an old alias or an old predecessor node digest is received, the communication program can determine that the message belongs to the historical communication before the checkpoint based on the state recovered from the checkpoint and refuse it to enter the current predecessor relationship.

[0062] Specifically, during the entire communication process between the remote platform and the cabinet, the target module's logical identifier is only used between the protected internal session state and the control causal chain state. External transmission messages are associated with the dynamic communication alias of the current control causal chain. The dynamic communication alias is jointly determined by the current operation context fingerprint, key state identifier, and control causal chain sequence number. The operation context fingerprint is formed by the target module's logical identifier, operation category, prior confirmation information, expected response type, previous node digest, and current session randomness. Therefore, the identity representation is continuously bound to the current control semantics, prior state, and key state. Even if an attacker collects encrypted messages from multiple remote control stages over a long period, they cannot directly connect all historical records into a long-term communication trajectory of the same module using only a fixed device field. Both communicating parties can still use their own saved protected states to complete the current control object location and causal chain verification.

[0063] In a specific operation, after the remote platform performs a remote operation on a target module, it reads the current session key state and constructs the context fingerprint of this operation. Then, it generates the dynamic communication alias and initial chain state of the current control causal chain. The remote command is encrypted and sent together with the initial binding digest, message role identifier, chain position identifier, and authentication tag. The cabinet locates the candidate chain based on the dynamic communication alias and recalculates the operation context state. After authentication, the remote command node is registered and the context state is updated recursively. The cabinet response uses the remote command node digest as the predecessor and uses the recursively updated context state to form authentication data. After the remote platform completes the verification, it registers the response node and continues to recursively update. Execution confirmation establishes a successor relationship along the response node. When the execution confirmation meets the closure condition, a closed node digest is formed. The digest enters the next session key state and alias-derived key update process. The old dynamic communication alias exits the active state along with the current chain.

[0064] During the operation of multiple remote operations, each control causal chain uses different branch identifiers and their respective node predecessor relationships. Even if communication messages arrive intermittently within the same transmission connection, they are classified into the corresponding chain states according to the dynamic communication alias, branch identifier, predecessor node summary, and current message role. When an authentication failure occurs in a branch, the communication program determines its nearest stable node as the abnormal branch anchor point, freezes the nodes after the anchor point that have not yet been confirmed, and derives a new branch key state. Then, it establishes a recovery state based on the recursive context state at the abnormal branch anchor point. Other branches do not change their respective branch key states, dynamic communication aliases, and predecessor node references. The abnormal branch re-establishes the authentication continuity relationship through the first recovery node and then continues the original control process, so that the scope of abnormal handling is consistent with the scope of the control causal chain where the abnormality occurred.

[0065] Preferably, when the two communicating parties retain different numbers of unacknowledged messages due to a short-term connection interruption, the party with more messages is not used as the basis for recovery. Instead, the most recent common state with the same branch identifier and verifiable by the checkpoint integrity tag is searched. If the most recent checkpoint numbers of the two parties are different, the newer party will backtrack step by step to the checkpoint that both parties can verify and the final node digest exists in the common confirmation history. Then, the alias-derived state, branch key state, and predecessor node reference starting point are restored based on the checkpoint. Nodes formed by only one party after the checkpoint but not jointly confirmed are entered into the frozen history set and do not participate in the authentication continuity relationship after recovery. After the recovery is completed, a new message is formed with the current branch state to avoid inconsistencies in key generation, dynamic communication aliases, or predecessor node digests caused by directly using the latest local state of either end.

[0066] Furthermore, all fields used to generate operational context fingerprints, dynamic communication aliases, message authentication labels, node digests, branch key migration states, and session checkpoint integrity labels employ deterministic encoding rules. The same field type uses the same length encoding, byte order, and null value representation at both the sending and receiving ends. When variable-length data is involved, the corresponding length information is written before the data value. When enumerating states, fixed state encoding within the protocol is used. Natural language descriptions are not allowed as direct cryptographic inputs. When node digests or ciphertext digests are involved, a fixed digest output length is used. This enables both communicating parties to construct completely consistent cryptographic inputs for the same control causal state and to pinpoint input inconsistencies as differences in field content, node position, or key state, rather than verification failures caused by serialization differences.

[0067] In a preferred embodiment, the remote operation platform can continuously establish multiple closed and still active control causal chains within a single session. The closed chain retains only the information required for recovery and repetition detection, such as checkpoints, historical alias input summaries, and final node summaries. The active chain retains the current recursive context state, dynamic communication aliases, the most recently valid node summary, and allowed successor roles. The anomaly recovery chain additionally stores the anomaly branch anchor point, recovery sequence number, and migrated branch key state on top of the active chain state. The communication program restricts executable data processing operations according to the chain state category. The closed chain no longer generates new nodes, the active chain cannot reference other branch nodes, and the anomaly recovery chain cannot resume normal successor processing until the first recovery node is authenticated. This ensures that control chains with different lifecycles within the same session do not mix key states or predecessor relationships due to shared transmission connections.

[0068] Specifically, the privacy-preserving communication process does not adopt the method of simply changing all target module identifiers and all branch keys uniformly at fixed times. Instead, it uses the establishment, node advancement, normal closure, and abnormal termination of the control causal chain as the boundaries of state changes. The operation context fingerprint binds the logical identity of the target module with the current control semantics and the previous state when the chain is established. The dynamic communication alias converts the context state into a communication representation that can be used by the current chain. Message authentication and predecessor digest restrict remote instructions, counter responses, and execution confirmations to the same causal chain. The closing node digest drives the subsequent key state and alias-derived state changes. The abnormal branch anchor point limits the starting point of local key migration. Each processing stage reads and writes back the same chain state record. Therefore, a recalculable continuous relationship is formed between the remote operation control sequence, identity representation changes, and cryptographic state evolution.

[0069] Furthermore, during session state persistence, the control causal chain that is still active adopts a storage method combining checkpoints and incremental node records. The checkpoint stores the most recent stable state, and each valid node after the checkpoint stores the node summary, predecessor summary, message role, chain position, and recursive context state summary. When the system reloads the session state, it starts from the checkpoint that has most recently passed integrity verification and verifies the incremental nodes that have been confirmed after the checkpoint in sequence according to the node predecessor relationship. After each verification, the recursive context state is reconstructed. If an incremental node is found to be missing, discontinuous in order, or the authentication state cannot be recovered, the node that has most recently completed verification is used as the stable boundary to enter the abnormal branch recovery process, instead of directly treating the subsequent nodes as the current state. This makes the reload process use the same causal chain constraints as online communication.

[0070] In a preferred embodiment, for a target module that has completed inter-chain alias migration, when establishing a new control causal chain in the next remote operation, the communication program first reads the current alias-derived key generation and the set of historical alias input digests from the most recent session checkpoint. Then, it generates a new operation context fingerprint based on the context field corresponding to the new operation and forms an alias input value by combining it with the new control causal chain sequence number. After completing the one-way pseudo-random mapping, it checks whether the obtained alias conflicts with the current active chain alias or the historical invalid alias. If a conflict occurs, the input is changed and remapped by recalculating the alias count, instead of reactivating the historical alias. Therefore, even if the length of the dynamic identifier field of the communication protocol is limited, the uniqueness of the active alias and the invalid state of the historical alias can be maintained within the current session state.

[0071] Specifically, when a remote command is repeatedly transmitted due to network issues, the cabinet receives the first message, authenticates it, registers it as a valid node of the current branch, and completes context recursion. The second repeated message still carries the original starting predecessor digest and the original chain position identifier. Although its password content is the same as the first message, the most recent valid node of the current branch has become the node of the first remote command. The predecessor relationship of the repeated message no longer satisfies the current successor condition. Therefore, the communication program identifies it as a historical repetition and does not perform new node registration. When a similar repetition occurs in the cabinet response, it is handled in the same way. Thus, it is not necessary to rely on a large-scale historical message number table independent of the causal chain to determine whether the repeated message can advance the control process based on the current predecessor status.

[0072] In this embodiment, after the remote operation ends, the closed node digest participates in the generation of the next session key state and the migration of dynamic communication aliases. The new session state provides new message authentication keys, alias derivation keys and branch derivation states for subsequent control causal chains. The key state used by the previous chain is only retained in the restricted historical verification context and is no longer used to form new remote instructions, counter responses or execution confirmations. If an attacker obtains the historical ciphertext and resends it in a subsequent session, the dynamic communication alias, predecessor node digest and authentication tag carried in the message all correspond to the control causal chain that has exited the active state. The receiving end can determine that it does not belong to the currently allowed communication state based on the current active chain set and the historical alias input digest, and avoids the re-establishment of the closed control relationship by the historical message.

[0073] Furthermore, when the anomaly recovery is completed and the original control process continues, the subsequent execution confirmation node forms a predecessor reference based on the digest of the most recent valid node in the recovery chain. After the execution confirmation is authenticated and meets the closure semantics of the original remote operation, it still extracts the current final node digest, closure confirmation information and the current session key status identifier to form a closure input value according to the normal closure rules, and then completes the alias derivation state update and session checkpoint generation. Therefore, the anomaly migration will not form a long-term bypass that deviates from the normal key evolution rules. Once the recovery chain completes the original control semantics, it re-enters the normal closure state. The historical anomaly anchor, recovery sequence number and migration input are only retained in the corresponding checkpoint and historical verification data, and do not continue to be used as the direct communication identifier of the next normal control causal chain.

[0074] In a preferred embodiment, the current session may contain closed branches, normal activity branches, and abnormal recovery branches. The checkpoint authentication key is derived separately from the session key state and managed according to the key state generation. Each time a checkpoint is generated, the corresponding generation is written. During recovery, a valid checkpoint authentication state is selected for verification based on the generation recorded by the checkpoint itself. For old generations that have been revoked and are no longer allowed to be recovered, only the verification state that cannot generate new checkpoints is retained, so that the checkpoint verification capability is separated from the new checkpoint generation capability. Both communicating parties can verify the historical stable state, but cannot use the old generation to re-establish the control causal chain with the current generation permission.

[0075] Specifically, when processing each inbound message, the counter-side communication program can complete the state transition according to the internal processing order of dynamic communication alias matching, branch status location, predecessor node check, message role check, authentication tag verification, ciphertext decryption, node registration, and recursive context update. If any of the preconditions are not met, the subsequent node registration and recursive update will not be executed. The remote platform uses the same type of verification logic to confirm the counter-side response and execution. When an outbound message is formed, the current stable chain state is read and the predecessor digest and context state used for this generation are frozen until the message is registered as a valid node on this end or enters the exception handling. This avoids parallel threads using the same predecessor node on the same branch to form two unconstrained successor nodes at the same time.

[0076] Furthermore, for parallel remote operations allowed to exist within the same target module, the communication program does not directly merge control chains based on the target module's logical identifier. Instead, it establishes branch states based on the operation context fingerprint and the control causal chain sequence number. If two operations have a dependency that must be determined by a prior confirmation relationship, the prior confirmation information of the latter operation references the closed record of the former control causal chain and writes the corresponding closed node summary into its context field sequence. If no such dependency exists, the two control causal chains advance using their own initial binding basis. Therefore, whether a cross-operation continuous relationship is formed is determined by the authenticated prior confirmation information, rather than automatically determined by the identity of the same target module, thus keeping the communication association between different remote operations of the same module within the scope required by the control semantics.

[0077] In this embodiment, the operational context fingerprint, dynamic communication alias, node digest, branch key state, and session checkpoint are linked according to a unified state chain. The operational context fingerprint determines the initial semantics of the current control process, the dynamic communication alias points to the current active control causal chain, the node digest records the communication history already accepted by the chain, the branch key state limits the secret state used by the subsequent cryptographic processing of the current branch, and the session checkpoint records the most recently mutually confirmed stable recovery position. Any state change is driven by the preceding state that has been cryptographically authenticated. Inputs that have not been authenticated are not written to the stable state area. This enables remote operation communication to form an identity privacy protection and local key evolution process around the control causal relationship, in addition to content encryption.

Claims

1. A privacy-protected communication method for remote operation of modular power distribution cabinets, characterized in that, include: Obtain the target module logical identifier, operation category, prior confirmation information and expected response type corresponding to the remote operation, construct the operation context fingerprint, and establish a control causal chain node based on the operation context fingerprint; Based on the current session key state and the operation context fingerprint, a dynamic communication alias corresponding only to the current control causal chain is generated; Remote commands, counter responses, and execution confirmations are each bound to the control causal chain node and transmitted in encrypted form. After controlling the causal chain closure, the closure node digest and the current session key state input key are used to perform a derivation operation to generate the next session key state, and the dynamic communication alias is invalidated. When the control causal chain terminates abnormally, only the session key state corresponding to the abnormal branch is migrated.

2. The privacy-protected communication method for remote operation of modular power distribution cabinets according to claim 1, characterized in that, The construction of the operation context fingerprint includes: forming a context field sequence according to a fixed semantic order of target module logical identifier, operation category, prior confirmation information and expected response type; writing the digest of the previous control causal chain node and the current session random variable into the context field sequence; and performing a key digest operation on the context field sequence using the message authentication key corresponding to the current session key state to obtain the operation context fingerprint that is continuously associated with the prior control state.

3. The privacy-protected communication method for remote operation of modular power distribution cabinets according to claim 1, characterized in that, The generation of the dynamic communication alias includes: combining the operation context fingerprint, the current session key state identifier, and the current control causal chain sequence number into an alias input value; performing a one-way pseudo-random mapping on the alias input value using the alias derived key obtained from the current session key state; and extracting data of a predetermined identifier field length from the mapping result as the dynamic communication alias. The same target module uses different alias input values ​​in different control causal chains.

4. The privacy-protected communication method for remote operation of modular power distribution cabinets according to claim 1, characterized in that, The binding of the remote command, the cabinet response, and the execution confirmation with the control causal chain node includes: writing a predecessor node summary, a current message role identifier, and a current chain position identifier to each communication message, and generating a message authentication tag based on the operation context fingerprint and the current session key status; The receiving end recovers the sequence of events of the message in the control causal chain according to the predecessor node digest. When the authentication tag is verified and the message role corresponds to the current chain position, the receiving end registers the communication message as a new valid node.

5. The privacy-protected communication method for remote operation of modular power distribution cabinets according to claim 2, characterized in that, The operation context fingerprint is formed using a recursive update method: each time an authenticated valid node is received or sent, the message role identifier, chain position identifier, and current node ciphertext digest in the valid node are combined with the previous operation context fingerprint to generate a new context state value. Before the next communication message is formed, the new context state value replaces the previous operation context fingerprint in the message authentication key calculation, and the initial context field sequence is retained as the starting binding basis for the current control causal chain.

6. The privacy-protected communication method for remote operation of modular power distribution cabinets according to claim 3, characterized in that, The dynamic communication alias undergoes inter-chain migration when the control causal chain is closed: extracting the node digest of the last valid node, the closure confirmation information, and the current session key status identifier to form a closure input value, which drives the alias derived key update; When the next control causal chain is established, the dynamic communication alias is regenerated using the updated alias-derived key and the new operation context fingerprint, and the alias input value corresponding to the previous control causal chain is registered as a historical input that cannot be accepted again.

7. The privacy-protected communication method for remote operation of modular power distribution cabinets according to claim 4, characterized in that, When remote operations corresponding to multiple target modules exist in parallel, an independent branch identifier is assigned to each control causal chain, and the branch identifier is written into the authentication input of the predecessor node digest; Nodes within the same branch only reference the summary of their predecessor nodes in that branch; cross-referencing between different branches is prohibited. When the execution confirmation ends the corresponding branch, the summary of the last valid node of the branch is written into the branch closure record, and the unclosed branches continue to form independent authentication continuity relationships along their respective predecessor node summaries.

8. The privacy-protected communication method for remote operation of modular power distribution cabinets according to claim 1, characterized in that, When the control causal chain times out, fails to authenticate, or has a sequence conflict, the most recently authenticated valid node is determined as the abnormal branch anchor point, and the migration input value is formed based on the node summary, abnormal type identifier, and current branch identifier of the abnormal branch anchor point. The migration input value is processed using the branch-derived key in the current session key state to generate a new branch key state, and the abnormal node and its subsequent unconfirmed node are marked as not being referenced as a subsequent predecessor node.

9. The privacy-protected communication method for remote operation of modular power distribution cabinets according to claim 8, characterized in that, After the new branch key state is generated, the recursive context state value corresponding to the abnormal branch anchor point and the migration input value are written together into the branch recovery state; When communication is restored, the branch recovery state is used as the starting point of the new operation context fingerprint, and the message authentication tag of the first recovery node is generated from the new branch key state; The first recovery node carries both the summary of the abnormal branch anchor point and the recovery sequence number. Subsequent nodes only re-establish the predecessor reference relationship along the first recovery node.

10. The privacy-protected communication method for remote operation of modular power distribution cabinets according to claim 8, characterized in that, After the control causal chain is closed or the anomaly is recovered, the final node digest of the corresponding branch, the current dynamic communication alias status, and the branch key status are combined to form a session checkpoint, and an integrity tag is generated using the checkpoint authentication key corresponding to the current session key status. In the event of subsequent message loss or inconsistency between the states of the two parties, only the most recent session checkpoint that can be verified by the integrity tag and is consistent with the current branch identifier will be accepted, and the alias derivation state, branch key state, and predecessor node reference starting point will be restored accordingly.

Images