A v2g charging and discharging whole-process safety evaluation method and system

Abstract

The application relates to the technical field of V2G charging and discharging safety evaluation, and particularly discloses a V2G charging and discharging whole-process safety evaluation method and system, which comprises the following steps: establishing an evaluation node chain comprising vehicle access, identity verification, start access, power interaction, operation monitoring, stop control and record archiving, and generating a session evaluation identifier for one charging and discharging session; collecting the interaction records of a vehicle, a two-way charging pile, a station server and a power grid side platform, and collecting the interaction records according to the session evaluation identifier to perform time sequence alignment; comparing the interaction records of the evaluation nodes with node entry conditions, protocol verification results, device alarm states and operation sequences to generate node states, and generating whole-process safety evaluation records according to the node states, previous records and subsequent feedback records. Through session collection, time sequence alignment and node state transmission, the application enables the multi-end records of the charging and discharging session to form continuous evaluation basis.

Description

Technical Field

[0001] This invention relates to the field of V2G charging and discharging safety evaluation technology, and in particular to a method and system for full-process V2G charging and discharging safety evaluation. Background Technology

[0002] The V2G charging and discharging safety assessment technology field typically revolves around the charging and discharging interactions between electric vehicles, bidirectional charging piles, station-side servers, and grid-side platforms. This involves status acquisition, command transmission, process monitoring, and recording and storage. Relevant information is transmitted via communication protocols from the vehicle interface, charging equipment, metering devices, and management platform, and is used to determine whether the connection status, operational status, and control process comply with established rules. Traditional V2G charging and discharging full-process safety assessment methods and systems refer to technical approaches that conduct safety assessments of vehicle access, identity verification, charging / discharging initiation, operational interaction, stop control, and record archiving. Typically, the bidirectional charging pile acquires the vehicle and charging process status, the station-side server receives control commands and operational records, saves the interaction process in chronological order, and compares, marks, and generates assessment records for each stage based on protocol verification results, equipment alarm status, operation records, and preset judgment conditions.

[0003] Traditional V2G charging and discharging safety assessments often involve segmented recording around vehicle access, identity verification, charging and discharging initiation, operational interaction, stop control, and record archiving. The interaction records between the vehicle, bidirectional charging pile, station-side server, and grid-side platform are scattered across different stages. The sequential relationship between command issuance, equipment response, operational status, and stop feedback lacks continuity. The location of anomalies is unclear in relation to preceding and following records. There are gaps in the process tracing of the same charging and discharging session in the assessment records, resulting in the basis for subsequent assessment conclusions being distributed across multiple records. Summary of the Invention

[0004] The purpose of this invention is to provide a method and system for safety evaluation of the entire V2G charging and discharging process. Addressing the issues of scattered interaction records between vehicles, bidirectional charging piles, station servers, and grid-side platforms in V2G charging and discharging sessions, lack of continuous correspondence between evaluation nodes, and unclear correlation between abnormal node states and preceding and subsequent feedback records, this invention incorporates the process of vehicle access to record archiving into the same evaluation node chain. Furthermore, it uses session evaluation identifiers to aggregate and align the interaction records within the same charging and discharging session, providing a traceable process basis for the entire safety evaluation record.

[0005] To achieve the above objectives, this invention provides a V2G charging and discharging full-process safety evaluation method, comprising the following steps: establishing an evaluation node chain consisting of vehicle access, identity verification, start-up access, power interaction, operation monitoring, stop control, and record archiving, and generating a session evaluation identifier for each charging and discharging session; collecting interaction records formed by the vehicle, bidirectional charging pile, station-side server, and grid-side platform during the charging and discharging session, aggregating the interaction records according to the session evaluation identifier, and aligning them in sequence according to the order of instruction issuance, equipment response, operation status reporting, and stop feedback; and sequentially executing the steps for each evaluation node in the evaluation node chain. Point status determination includes comparing the interaction records corresponding to the current evaluation node with the node entry conditions, protocol verification results, device alarm status, and operation sequence in sequence. When the node status of the previous evaluation node is normal and all comparison results of the current evaluation node are satisfied, a normal node status of the current evaluation node is generated and transmitted to the next evaluation node. When any comparison result is not satisfied, or when there are missing or conflicting interaction records, an abnormal node status of the current evaluation node is generated and associated with the preceding and subsequent feedback records of the current evaluation node. Based on the node status, preceding records, and subsequent feedback records of each evaluation node, a full-process security evaluation record is generated.

[0006] As a constraint on the establishment of the evaluation node chain and the generation of session evaluation identifiers, the vehicle access node is determined after the vehicle plug-in confirmation and charging interface handshake are completed; the identity verification node is determined after the identity credential verification and vehicle identification information comparison are completed; the start access node is determined after obtaining the charging / discharging direction, power command and equipment readiness status; the power interaction node is determined after obtaining the charging / discharging power command and equipment response record; the operation monitoring node is determined after obtaining the operation status reporting record; the stop control node is determined after obtaining the stop command and stop feedback record; and at the record archiving node, the node status of each evaluation node and the corresponding session evaluation identifier are written into the full-process safety evaluation record.

[0007] As a constraint on the generation process of the session evaluation identifier, the session evaluation identifier is generated when the vehicle access node obtains the vehicle identification information, the bidirectional charging pile identifier, and the session start time, and the vehicle identification information is consistent with the verification record formed by the identity verification node. The session evaluation identifier is then written to both the vehicle access node and the identity verification node. When the vehicle identification information is inconsistent with the verification record, the session evaluation identifier is not transmitted to the access node, and the inconsistency between the vehicle identification information and the verification record is used as the basis for the anomaly of the identity verification node.

[0008] As a constraint on the process of collecting interaction records, after the session evaluation identifier is written into the vehicle access node and the identity verification node, a session record index is formed based on the session evaluation identifier. The session record index records at least the vehicle identification information, the bidirectional charging pile identifier, the session start time, the evaluation node name, and the node status. After the access node, power interaction node, operation monitoring node, and stop control node generate interaction records, the vehicle identification information, the bidirectional charging pile identifier, and the record occurrence time in the interaction records are checked against the session record index. Interaction records that match are written into the corresponding evaluation node, and interaction records that do not match are written into the abnormal record item of the corresponding evaluation node.

[0009] As a limitation on the content and collection rules of the interaction records, the interaction records include vehicle status records sent by the vehicle through the charging interface, equipment response records generated by the bidirectional charging pile, control command records generated by the station server, and power scheduling records generated by the grid-side platform. When collecting the interaction records, the charging and discharging session to which the interaction record belongs is determined by the session evaluation identifier, the order of the interaction record in the charging and discharging session is determined by the record occurrence time, and the source of the interaction record is verified by the record generating entity. If the session evaluation identifier, record occurrence time, or record generating entity is missing, the corresponding interaction record is written into the collection anomaly record item.

[0010] As a constraint on timing alignment, the command issuance time is determined by the control command record generated by the station server, the equipment response time is determined by the equipment response record generated by the bidirectional charging pile, the operating status reporting time is determined by the vehicle status record and power scheduling record, and the stop control time is determined by the stop command and stop feedback record. The command issuance time, equipment response time, operating status reporting time and stop control time are written into the corresponding evaluation nodes respectively. When the time sequence of adjacent evaluation nodes conforms to the order of the evaluation node chain, the interaction records of adjacent evaluation nodes are regarded as continuous records of the same charging and discharging session. When the time sequence of adjacent evaluation nodes does not conform to the order of the evaluation node chain, the interaction records of adjacent evaluation nodes are written into the timing anomaly record item.

[0011] As a limitation on the handling of abnormal node states, after the abnormal node state is generated, the name of the evaluation node that generated the abnormal node state and the time of the abnormal occurrence are recorded. In the interaction records corresponding to the same session evaluation identifier, the retrospective impact of the abnormal node state on the preceding records and the triggering and blocking relationship on the subsequent feedback records are further determined. The preceding records include the node state of the adjacent previous evaluation node, the node entry condition comparison result, and the protocol verification result. The subsequent feedback records include the device response record after the abnormality occurs, the operation status reporting record, and the stop feedback record. The abnormal evaluation node, the preceding records, the subsequent feedback records, and the impact relationship are written into the same abnormal record item.

[0012] As a constraint on the generation process of the full-process security assessment record, when generating the full-process security assessment record, the assessment node name, node status, interaction record index, and abnormal record item are written in the order of the assessment node chain. When the abnormal record item is empty, the node status of each assessment node is used as the basis for the formation of the full-process security assessment record. When the abnormal record item is not empty, the abnormal assessment node, the preceding record, and the subsequent feedback record are used as the basis for the formation of the full-process security assessment record, and the corresponding session assessment identifier is retained in the full-process security assessment record. The full-process security assessment record further includes a security level assessment result generated based on the abnormal node status, the preceding record, and the subsequent feedback record. The security level assessment result is used to determine whether subsequent charging and discharging sessions are allowed.

[0013] The present invention also provides a V2G charging and discharging full-process safety evaluation system, which is used to support the above method and includes a communication interface, a storage unit and a processor. The communication interface is connected to the vehicle, the bidirectional charging pile, the station server and the grid-side platform respectively, and the storage unit stores programs that can be executed by the processor. The processor is used to establish a chain of evaluation nodes consisting of vehicle access, identity verification, start access, power interaction, operation monitoring, stop control and record archiving, and to generate a session evaluation identifier for a single charge-discharge session; The processor is also used to receive interaction records formed by the vehicle, bidirectional charging pile, station server and grid-side platform in the charging and discharging session through the communication interface, and to collect the interaction records and perform time-series alignment based on the session evaluation identifier; The processor is also used to sequentially perform node status judgment on each evaluation node in the evaluation node chain, and generate a full-process security evaluation record based on the node status, previous records and subsequent feedback records.

[0014] The beneficial effects of the technical solutions provided in the embodiments of the present invention include at least the following: In this invention, an evaluation node chain consisting of vehicle access, identity verification, start-up access, power interaction, operation monitoring, stop control, and record archiving is established, and a session evaluation identifier is generated for each charging and discharging session, thus incorporating multi-terminal interaction records into the same session process. By aligning the timing according to instruction issuance, device response, operation status reporting, and stop feedback, the judgments of each evaluation node have continuous basis. By forming an abnormal node state when the comparison result is not satisfied or there are missing or conflicting interaction records, and associating it with previous records and subsequent feedback records, the entire process of safety evaluation records retains the location of the abnormality and the associated process. Attached Figure Description

[0015] Figure 1 This is the main flowchart for the safety evaluation of the entire V2G charging and discharging process of this invention;

[0016] Figure 2 This is a schematic diagram illustrating the relationship between the evaluation node chain and the session evaluation identifier in this invention;

[0017] Figure 3 This is a schematic diagram of the interaction record collection and session record indexing of the present invention;

[0018] Figure 4 This is a schematic diagram of the communication security test record access of the present invention;

[0019] Figure 5 This is a schematic diagram illustrating the timing alignment and node state determination of the present invention;

[0020] Figure 6 This is a schematic diagram of the abnormal record items and system structure of the present invention. Detailed Implementation

[0021] The technical solution of the present invention will now be described with reference to the accompanying drawings.

[0022] In embodiments of the present invention, words such as "exemplarily," "for example," etc., are used to indicate that something is an example, illustration, or description. Any embodiment or design described as "exemplary" in the present invention should not be construed as being more preferred or advantageous than other embodiments or designs. Specifically, the use of the word "exemplary" is intended to present the concept in a concrete manner. Furthermore, in embodiments of the present invention, the meaning expressed by "and / or" can be both, or either one.

[0023] Please see Figures 1 to 5 This embodiment provides a safety evaluation method for the entire V2G charging and discharging process. This method is applied to the evaluation process of vehicles interacting with the station server and the grid-side platform through bidirectional charging piles. The evaluation process takes a single charging and discharging session as the processing unit, incorporates the process of vehicle access to the record archiving into the same evaluation node chain, and collects, aligns the timing of the interaction records in the same charging and discharging session through session evaluation identifiers, judges the node status, and generates records.

[0024] S1. Establish the evaluation node chain and generate session evaluation identifiers.

[0025] In S1, the evaluation node chain consists of vehicle access, identity verification, start-up access, power interaction, operation monitoring, stop control, and record archiving. The vehicle access node corresponds to the process of establishing a physical connection between the vehicle and the bidirectional charging pile and the charging interface handshake; the identity verification node corresponds to the process of verifying identity credentials and comparing vehicle identification information; the start-up access node corresponds to the access judgment process after obtaining the charging / discharging direction, power command, and equipment readiness status; the power interaction node corresponds to the correspondence between charging / discharging power commands and equipment response records; the operation monitoring node corresponds to the collection of operation status reporting records and the entry into the evaluation process; the stop control node corresponds to the correspondence between stop commands and stop feedback records; and the record archiving node corresponds to the process of writing the node status, session evaluation identifier, and related records of each evaluation node into the full-process safety evaluation record.

[0026] When the evaluation node chain is established, after vehicle connection confirmation and charging interface handshake are completed, the vehicle access node is determined to be eligible for entry; after identity verification and vehicle identification information comparison are completed, the identity verification node is determined to be eligible for entry; after obtaining charging / discharging direction, power commands, and equipment readiness status, the start-up access node is determined to be eligible for entry; after obtaining charging / discharging power commands and equipment response records, the power interaction node is determined to be eligible for entry; after obtaining operational status reporting records, the operation monitoring node is determined to be eligible for entry; after obtaining stop commands and stop feedback records, the stop control node is determined to be eligible for entry. Each evaluation node constitutes the evaluation node chain according to the above-mentioned business occurrence sequence, and subsequent node status judgments are executed according to the order of the evaluation node chain.

[0027] The session evaluation identifier is used throughout a single charge / discharge session, across the vehicle access node, identity verification node, start-up access node, power interaction node, operation monitoring node, stop control node, and record archiving node. After the vehicle access node obtains the vehicle identification information, bidirectional charging pile identifier, and session start time, the identity verification node generates a verification record. When the vehicle identification information matches the verification record generated by the identity verification node, a session evaluation identifier is generated and written to both the vehicle access node and the identity verification node. When the vehicle identification information does not match the verification record, the session evaluation identifier is not transmitted to the start-up access node, and the inconsistency between the vehicle identification information and the verification record is used as the basis for an anomaly at the identity verification node.

[0028] In the identity verification node, vehicle identification information includes the VIN code, and verification records include identity credential verification results, vehicle identification information comparison results, and function negotiation records. For communication interaction security assessment, the test case set includes charging system external message encryption testing, charging system external message tampering testing, charging system identity impersonation testing, charging system external message replay testing, charging system command security testing, charging system upgrade response testing, charging system BMS isolation testing, charging parameter anomaly detection, charging status anomaly attack detection, charging system standard compliance testing, and VIN security strength testing. When the identity verification node receives a VIN tampering, unauthorized diagnostic write operation, or identity credential verification failure record, it writes the corresponding record to the anomaly criteria of the identity verification node. The above test case types correspond to the requirement of no less than 11 types of test cases in the communication interaction security testing tool.

[0029] S2. Collect interaction records and aggregate them according to the conversation evaluation identifier.

[0030] In S2, interaction records are generated by the vehicle, bidirectional charging pile, station-side server, and grid-side platform during the charging and discharging session. The vehicle sends a vehicle status record via the charging interface, the bidirectional charging pile generates a device response record, the station-side server generates a control command record, and the grid-side platform generates a power scheduling record. The objects used for aggregation in the interaction records include at least the session evaluation identifier, vehicle identification information, bidirectional charging pile identifier, record occurrence time, and record generating entity. The session evaluation identifier is used to determine the charging and discharging session to which the interaction record belongs, the record occurrence time is used to determine the order of the interaction record within the charging and discharging session, and the record generating entity is used to verify the source of the interaction record.

[0031] Vehicle status records and equipment response records must include at least the DC-side voltage, DC-side current, charging / discharging direction, power command, equipment readiness status, operating status, equipment alarm status, and the time of occurrence. When evaluating power interaction nodes, the existing DC power formula is used: in, The charging and discharging power is expressed in kW. This is the DC side voltage, in volts (V). This is the DC current, measured in amperes (A). To maintain consistency with engineering records, when... In V Using time A, When recording by kW, it is necessary to... and The product is divided by 1000. Taking a V2G discharge condition as an example, with a DC side voltage of 750V and a DC side current of 80A, the charging and discharging power is 60kW. This power value is used to verify whether the power command is consistent with the output capacity in the equipment response record.

[0032] When evaluating operational monitoring nodes, the existing power consumption formula is used: in, The charge / discharge capacity is expressed in kWh. The charging and discharging power is expressed in kW. This refers to the duration, expressed in hours (h). For example, taking an operation record with a charging / discharging power of 60kW and a duration of 10 minutes, the duration is converted to 1 / 6 hour, corresponding to a charging / discharging capacity of 10kWh. This capacity value is used to verify the cumulative capacity changes in the operation status reporting record and the stop feedback record.

[0033] After the session evaluation identifier is written to the vehicle access node and the identity verification node, a session record index is formed based on the session evaluation identifier. The session record index records at least the vehicle identification information, bidirectional charging pile identifier, session start time, evaluation node name, and node status. After the access node, power interaction node, operation monitoring node, and stop control node generate interaction records, the vehicle identification information, bidirectional charging pile identifier, and record occurrence time in the interaction records are checked against the session record index. Interaction records that match are written to the corresponding evaluation node, while interaction records that do not match are written to the abnormal record item of the corresponding evaluation node. If the session evaluation identifier, record occurrence time, or record generating entity is missing, the corresponding interaction record is written to the aggregated abnormal record item.

[0034] The above aggregation process ensures that interaction records from vehicles, bidirectional charging piles, station servers, and grid-side platforms are first grouped into the same charging / discharging session before entering the corresponding evaluation node. Interaction records lacking session evaluation identifiers, record occurrence times, or record generating entities are not directly used as the basis for judging the normal node status. Instead, they are included in the aggregation of abnormal records for subsequent node status judgment and for use when generating full-process safety evaluation records.

[0035] S3. Align the timing according to the order of instruction issuance, equipment response, operation status reporting, and stop feedback.

[0036] In S3, timing alignment is used to organize the sequential relationships between various interaction records within the same charging / discharging session. The command issuance time is determined by the control command record generated by the station server; the device response time is determined by the device response record generated by the bidirectional charging pile; the operating status reporting time is determined by the vehicle status record and power scheduling record; and the stop control time is determined by the stop command and stop feedback record. The command issuance time, device response time, operating status reporting time, and stop control time are written to the corresponding evaluation nodes.

[0037] During timing alignment, the temporal relationship between adjacent evaluation nodes is compared with the order of the evaluation node chain. When the temporal relationship between adjacent evaluation nodes matches the order of the evaluation node chain, the interaction records of adjacent evaluation nodes are treated as consecutive records of the same charging / discharging session. When the temporal relationship between adjacent evaluation nodes does not match the order of the evaluation node chain, the interaction records of adjacent evaluation nodes are written into the timing anomaly log item.

[0038] For message period anomaly detection, the judgment object is consecutive CAN messages of the same type sent by the same record-generating entity. The measured message period is determined based on the recording occurrence time of two adjacent frames of the same type of message. The message period deviation rate adopts the existing relative deviation formula: in, This refers to the message cycle deviation rate. The measured time interval between two adjacent frames of the same type of message; The baseline time interval set in the test configuration for this type of message. For 100ms Taking 150ms as an example, The threshold is 50%, and the corresponding interaction record is written to the timing anomaly record item. For CAN replay attack detection, after receiving the vehicle charging request message 0x74, if a duplicate 0x74 message is sent under the same session evaluation identifier and does not conform to the evaluation node chain order, the occurrence time of the duplicate message, the record generating subject, and the name of the corresponding evaluation node are written to the timing anomaly record item. The above anomaly detection content corresponds to the requirements in the communication interaction security testing tool regarding frame period anomaly detection, short-time multi-data replay attack detection, and malicious data tampering message attack detection.

[0039] The aforementioned timing alignment process uses the existing interaction records between the station server, bidirectional charging piles, vehicles, and the grid-side platform as input, without introducing additional time parameters. The occurrence time of each record serves as the basis for sorting and comparison within the same charging and discharging session. By writing command issuance, equipment response, operating status reporting, and stop feedback into the corresponding evaluation nodes, subsequent node status judgments can be based on continuous records within the same charging and discharging session.

[0040] S4. Perform node status judgment on each evaluation node in the evaluation node chain in sequence.

[0041] In S4, node status determination follows the order of the evaluation node chain. For the current evaluation node, the interaction record corresponding to the current evaluation node is first obtained, and then compared with the node entry conditions, protocol verification results, device alarm status, and operation sequence in sequence. The node entry conditions are used to determine whether the current evaluation node has the business prerequisites to enter the evaluation; the protocol verification results are used to determine whether the interaction content of the current evaluation node passes the protocol-level verification; the device alarm status is used to determine whether there are alarms on the device corresponding to the current evaluation node; and the operation sequence is used to determine whether the execution order of the current evaluation node in the evaluation node chain is consistent with the predetermined order.

[0042] The execution order of node status judgment is as follows: First, compare the interaction record corresponding to the current evaluation node with the node entry conditions. If the node entry conditions are met, compare the interaction record corresponding to the current evaluation node with the protocol verification result. If the protocol verification result passes, compare the interaction record corresponding to the current evaluation node with the device alarm status. If the device alarm status is no alarm, compare the interaction record corresponding to the current evaluation node with the operation sequence. When the node entry conditions, protocol verification result, device alarm status, and operation sequence are all met, a normal node status for the current evaluation node is generated. If any item is not met, an abnormal node status for the current evaluation node is generated, and the unmet comparison item is written into the abnormal record item of the current evaluation node.

[0043] The operation monitoring node further verifies the charging and discharging efficiency, using the existing power conversion efficiency formula: in, For electrical energy conversion efficiency; The active power on the output side is expressed in kW. This refers to the active power on the input side, measured in kW. Under charging conditions, The input power recorded at the station end or pile end. This refers to the power received on the vehicle side; under discharge conditions, For vehicle-side output power, This refers to the power received from the grid. Taking charging mode as an example, For 65kW, When it is 60kW, The success rate was 92.31%; taking the discharge condition as an example, For 60kW, When it is 57kW, 95.00% The aforementioned efficiency data is written to the operation monitoring node to assist in verifying the correspondence between the operation status reporting records, power scheduling records, and equipment response records. The V2G evaluation materials include efficiency evaluation, voltage and current regulation accuracy, power factor, harmonic emission, and immunity of the bidirectional charger in both rectification and inverter operating modes as electrical performance evaluation content. This supplementary data aligns with this type of evaluation approach.

[0044] When the current evaluation node is not a vehicle access node, the node status of the previous evaluation node must also be considered for judgment. If the node status of the previous evaluation node is normal and all comparison results of the current evaluation node are satisfied, a normal node status for the current evaluation node is generated and passed to the next evaluation node. If the node status of the previous evaluation node is abnormal, or any comparison result of the current evaluation node is not satisfied, or there are missing or conflicting interaction records, an abnormal node status for the current evaluation node is generated. Missing interaction records refer to the current evaluation node lacking a session evaluation identifier, record occurrence time, record generating entity, or necessary records for comparison within this evaluation node. Conflicting interaction records refer to the vehicle identification information, bidirectional charging pile identifier, record generating entity, or record occurrence time corresponding to the same session evaluation identifier not meeting the verification relationship of the current evaluation node.

[0045] After a normal node status is passed to the next evaluation node, the next evaluation node continues to compare the node status according to the node entry conditions, protocol verification results, device alarm status, and operation sequence. Once an abnormal node status is formed, the normal node status is no longer passed to the next evaluation node; instead, the process of associating previous records and subsequent feedback records begins.

[0046] S5. After generating the abnormal node status, associate it with the preceding record and subsequent feedback record.

[0047] In S5, after generating an abnormal node status, the name of the evaluation node that generated the abnormal node status and the time of the abnormal occurrence are recorded. Furthermore, in the interaction records corresponding to the same session evaluation identifier, the retrospective impact of the abnormal node status on preceding records and its triggering and blocking relationship on subsequent feedback records are determined. Preceding records include the node status of the adjacent previous evaluation node, the node entry condition comparison result, and the protocol verification result. Subsequent feedback records include the device response record after the abnormality occurred, the operation status reporting record, and the stop feedback record.

[0048] The preceding record indicates whether the adjacent previous evaluation node was in a normal node state before the abnormal node state was formed, and whether the node entry condition comparison and protocol verification results of the adjacent previous evaluation node had been met. The subsequent feedback record indicates whether the bidirectional charging pile generated a device response record after the abnormal node state was formed, whether the vehicle continued to generate an operating status reporting record, and whether a stop feedback record was generated during the stop control process. The triggering and blocking relationship characterizes the impact of the abnormal node state on the formation of subsequent feedback records, the entry of the stop control process, and the permitted state of subsequent charging and discharging sessions.

[0049] Anomaly assessment nodes, preceding records, subsequent feedback records, and their impact relationships are written into the same anomaly record item.

[0050] The anomaly type field in the anomaly log entry includes message encryption anomaly, message tampering anomaly, identity spoofing anomaly, message replay anomaly, command security anomaly, charging parameter anomaly, charging status anomaly, frame period anomaly, denial-of-service anomaly, whitelist anomaly, and malicious data tampering anomaly. For vulnerability verification anomalies, the anomaly log entry also records the anomaly source corresponding to spoofing discharge, charging function denial-of-service, vehicle-to-pile communication man-in-the-middle tampering, charging parameter tampering, and VIN tampering. For spoofing discharge anomalies, the vehicle charging demand message 0x74 in the pre-charging and energy transfer function module is used as the preceding record tracing object; for charging function denial-of-service anomalies, the vehicle stop message and charging process termination status are used as subsequent feedback records; for vehicle-to-pile communication man-in-the-middle tampering anomalies, the vehicle-side messages before and after tampering and the pile-side messages are written to the same anomaly log entry respectively. The above anomaly types and vulnerability verification types correspond to the requirements for anomaly detection methods and vulnerability verification testing in the communication interaction security testing tool.

[0051] Anomaly log entries are associated with session assessment identifiers and, together with the assessment node name, anomaly occurrence time, and node status, are incorporated into the generation process of the full-process security assessment record. Therefore, anomaly node statuses do not exist in isolation as isolated alarm records, but are linked to preceding and subsequent feedback records within the same charging / discharging session.

[0052] S6. Generate a full-process security assessment record based on the node status, preceding records, and subsequent feedback records of each assessment node.

[0053] In S6, when generating a full-process security assessment record, the assessment node name, node status, interaction record index, and abnormal record item are written in the order of the assessment node chain. The assessment node name is used to identify the specific node in vehicle access, identity verification, start access, power interaction, operation monitoring, stop control, and record archiving; the node status is used to identify the normal or abnormal node status; the interaction record index is used to trace back the interaction records corresponding to the same session assessment identifier; and the abnormal record item is used to record the abnormal assessment node, the preceding record, the subsequent feedback record, and the impact relationship.

[0054] When the anomaly log entry is empty, the node status of each evaluation node serves as the basis for forming the full-process security evaluation record. When the anomaly log entry is not empty, the anomaly evaluation node, preceding records, and subsequent feedback records serve as the basis for forming the full-process security evaluation record, and the corresponding session evaluation identifier is retained in the full-process security evaluation record. The full-process security evaluation record further includes a security level assessment result generated based on the anomaly node status, preceding records, and subsequent feedback records. The security level assessment result is used to determine whether subsequent charging and discharging sessions are permitted.

[0055] The security level assessment results are generated based on the source and scope of impact of the abnormal record items. If the abnormal record item is empty, and the vehicle access node, identity verification node, start access node, power interaction node, operation monitoring node, stop control node, and record archiving node are all in normal node status, the security level assessment result is recorded as allowing subsequent charging / discharging sessions. If the abnormal record item only involves aggregated abnormal record items or timing abnormal record items, and the stop feedback record is complete, the security level assessment result is recorded as requiring review before allowing subsequent charging / discharging sessions. If the abnormal record item involves identity verification inconsistency, 0x74 message replay, vehicle stop message injection, charging parameter tampering, deceptive discharge, or man-in-the-middle tampering in vehicle-pile communication, the security level assessment result is recorded as disallowing subsequent charging / discharging sessions. The security level assessment result, along with the session evaluation identifier, abnormal evaluation node, preceding records, and subsequent feedback records, is written into the full-process security evaluation record. The test verification materials list test items such as charging pile VIN tampering attack, charging system external message replay test, charging system command security test, deceptive discharge attack, charging function denial-of-service attack, and charging pile man-in-the-middle tampering attack. The trigger objects of the above security level assessment results correspond to these test items.

[0056] The safety level assessment results are formed based on the abnormal node status, preceding records, and subsequent feedback records, and are not directly generated from a single interaction record. The abnormal node status is used to determine the location of the abnormality, the preceding records are used to determine the node conditions before the abnormality occurred, and the subsequent feedback records are used to determine the device response, operational status reporting, and cessation of feedback after the abnormality occurred. After the safety level assessment results are generated, they serve as the basis for determining whether subsequent charging and discharging sessions are permitted, and are saved together with the session assessment identifier in the full-process safety assessment record. This process ensures that each assessment node, interaction record, and abnormal record item in the same charging and discharging session can form a continuous assessment basis during the record archiving stage.

[0057] Please see Figure 6 This embodiment provides a V2G charging and discharging full-process safety evaluation system. This system supports the aforementioned V2G charging and discharging full-process safety evaluation method and includes a communication interface, a storage unit, and a processor. The communication interface connects to the vehicle, bidirectional charging pile, station-side server, and grid-side platform, respectively, and is used to receive interaction records generated by the vehicle, bidirectional charging pile, station-side server, and grid-side platform during the charging and discharging session. The storage unit stores programs executable by the processor and is used to save session evaluation identifiers, session record indexes, interaction records, node states, anomaly record items, and full-process safety evaluation records.

[0058] The processor establishes a chain of evaluation nodes comprising vehicle access, identity verification, startup access, power interaction, operation monitoring, stop control, and record archiving, and generates a session evaluation identifier for each charge-discharge session. The processor receives interaction records generated during the charge-discharge session from the vehicle, bidirectional charging pile, station server, and grid-side platform via a communication interface, aggregates these records based on the session evaluation identifier, and performs time-series alignment. The processor sequentially performs node status checks on each evaluation node in the chain. This check involves comparing the current evaluation node's interaction record with the node entry conditions, protocol verification results, device alarm status, and operation sequence. If the previous evaluation node's status is normal and all comparison results for the current evaluation node are satisfied, a normal node status is generated for the current evaluation node and passed to the next evaluation node. If any comparison result is unsatisfactory, or if there are missing or conflicting interaction records, an abnormal node status is generated for the current evaluation node, and the preceding and subsequent feedback records are associated with this status. The processor also generates a full-process safety evaluation record based on the node status, preceding records, and subsequent feedback records.

[0059] During system operation, the CAN message parsing results, BLF log file playback results, 0x74 message replay results, vehicle abort message injection results, and VIN tampering detection results received by the communication interface are all stored in the storage unit as interaction records. The processor retrieves the corresponding interaction record based on the session evaluation identifier and completes the node status judgment sequentially according to the evaluation node chain. For voltage and current anomaly detection under network attacks, the processor substitutes the DC-side voltage and DC-side current into the formula. The processor obtains the charging and discharging power; for power verification, it substitutes the charging and discharging power and duration into the formula. The processor obtains the charge / discharge capacity; for message cycle anomaly detection, the processor substitutes the measured time interval and the reference time interval into the formula. The message cycle deviation rate is obtained by %; for charge / discharge efficiency verification, the processor substitutes the output-side active power and input-side active power into the formula. The percentage represents the power conversion efficiency. The parameters in the above formulas are all derived from interaction records received via the communication interface, test configuration records, or operational records generated by the corresponding evaluation nodes.

[0060] In this system, the communication interface is responsible for accessing interaction records, the storage unit is responsible for storing program and evaluation process data, and the processor is responsible for establishing the evaluation node chain, generating session evaluation identifiers, collecting interaction records, aligning timing, judging node status, forming abnormal record items, and generating full-process security evaluation records. The data flow between the communication interface, storage unit, and processor corresponds to the steps described above. During system operation, the sequential relationship of each evaluation node, the collection relationship of session evaluation identifiers, the timing relationship of interaction records, and the correlation relationship of abnormal node statuses in the method remain unchanged.

[0061] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A safety evaluation method for the entire V2G charging and discharging process, characterized in that, include: Establish a chain of evaluation nodes consisting of vehicle access, identity verification, start access, power interaction, operation monitoring, stop control and record archiving, and generate a session evaluation identifier for each charge and discharge session; The interaction records formed by the vehicle, bidirectional charging pile, station server and grid-side platform in the charging and discharging session are collected, the interaction records are collected according to the session evaluation identifier, and the time sequence is aligned according to the order of instruction issuance, equipment response, operation status reporting and stop feedback. For each evaluation node in the evaluation node chain, the node status judgment is performed sequentially, including: Based on the interaction records corresponding to the current evaluation node, compare them sequentially with the node entry conditions, protocol verification results, device alarm status, and operation sequence; When the node status of the previous evaluation node is normal and all comparison results of the current evaluation node are satisfied, the normal node status of the current evaluation node is generated and passed to the next evaluation node. If any comparison result is not met, or if the interaction record is missing or conflicting, an abnormal node state of the current evaluation node is generated, and the preceding record and subsequent feedback record of the current evaluation node are associated. A complete security assessment record is generated based on the node status, preceding records, and subsequent feedback records of each assessment node.

2. The V2G charging and discharging full-process safety evaluation method according to claim 1, characterized in that, The establishment of the evaluation node chain and the generation of the session evaluation identifier are specifically as follows: after the vehicle connection confirmation and charging interface handshake are completed, the vehicle access node is determined; after the identity credential verification and vehicle identification information comparison are completed, the identity verification node is determined; after obtaining the charging / discharging direction, power command and equipment readiness status, the start access node is determined; after obtaining the charging / discharging power command and equipment response record, the power interaction node is determined; after obtaining the operating status reporting record, the operation monitoring node is determined; after obtaining the stop command and stop feedback record, the stop control node is determined; and at the record archiving node, the node status of each evaluation node and the corresponding session evaluation identifier are written into the full-process safety evaluation record.

3. The V2G charging and discharging full-process safety evaluation method according to claim 2, characterized in that, The generation of the session evaluation identifier is specifically as follows: when the vehicle access node obtains the vehicle identification information, the bidirectional charging pile identifier and the session start time, and the vehicle identification information is consistent with the verification record formed by the identity verification node, the session evaluation identifier is generated and written into the vehicle access node and the identity verification node. When the vehicle identification information is inconsistent with the verification record, the session evaluation identifier will not be transmitted to the access node, and the inconsistency between the vehicle identification information and the verification record will be used as the basis for the abnormality of the identity verification node.

4. The V2G charging and discharging full-process safety evaluation method according to claim 1, characterized in that, After the session evaluation identifier is written into the vehicle access node and the identity verification node, a session record index is formed based on the session evaluation identifier. The session record index records at least the vehicle identification information, the bidirectional charging pile identifier, the session start time, the evaluation node name and the node status. After the access node, power interaction node, operation monitoring node and stop control node generate interaction records, the vehicle identification information, bidirectional charging pile identification and the time of record occurrence in the interaction records are checked against the session record index. Interaction records that match are written to the corresponding evaluation node; interaction records that do not match are written to the exception record item of the corresponding evaluation node.

5. The V2G charging and discharging full-process safety evaluation method according to claim 4, characterized in that, The interaction records include vehicle status records sent by the vehicle through the charging interface, equipment response records generated by the bidirectional charging pile, control command records generated by the station server, and power scheduling records generated by the grid-side platform. When collecting the interaction records, the session evaluation identifier is used to determine the charging and discharging session to which the interaction record belongs, the time of occurrence of the record is used to determine the order of the interaction record in the charging and discharging session, and the source of the interaction record is verified by the record generating entity. If the session evaluation identifier, the time of occurrence of the record, or the subject that generated the record is missing, the corresponding interaction record will be written into the collection of abnormal records.

6. The V2G charging and discharging full-process safety evaluation method according to claim 1, characterized in that, The timing alignment includes: The command issuance time is determined by the control command record generated by the station server, the equipment response time is determined by the equipment response record generated by the bidirectional charging pile, the operating status reporting time is determined by the vehicle status record and power scheduling record, and the stop control time is determined by the stop command and stop feedback record. Write the instruction issuance time, device response time, operating status reporting time, and stop control time into the corresponding evaluation nodes respectively; When the temporal sequence of adjacent evaluation nodes conforms to the order of the evaluation node chain, the interaction records of adjacent evaluation nodes are regarded as consecutive records of the same charging and discharging session. When the temporal relationship between adjacent evaluation nodes does not conform to the order of the evaluation node chain, the interaction records of the adjacent evaluation nodes are written into the timing anomaly record item.

7. The V2G charging and discharging full-process safety evaluation method according to claim 1, characterized in that, After generating the abnormal node state, the name of the evaluation node that generated the abnormal node state and the time of the abnormal occurrence are recorded. In the interaction records corresponding to the same session evaluation identifier, the retrospective impact of the abnormal state on the previous records and the triggering and blocking relationship on the subsequent feedback records are further determined. The preceding records include the node status of the adjacent previous evaluation node, the node entry condition comparison results, and the protocol verification results. The subsequent feedback records include the device response records after the anomaly occurs, the operation status reporting records, and the stop feedback records. Write the abnormal evaluation node, the preceding record, the subsequent feedback record, and the influence relationship into the same abnormal record item.

8. The V2G charging and discharging full-process safety evaluation method according to claim 7, characterized in that, When generating the full-process security assessment record, the assessment node name, node status, interaction record index, and anomaly record item are written in the order of the assessment node chain; When the anomaly record is empty, the node status of each evaluation node is used as the basis for forming the full-process security evaluation record; When the abnormal record item is not empty, the abnormal evaluation node, the preceding record and the subsequent feedback record are used as the basis for the formation of the full-process security evaluation record, and the corresponding session evaluation identifier is retained in the full-process security evaluation record.

9. The V2G charging and discharging full-process safety evaluation method according to claim 8, characterized in that, The full-process security assessment record further includes a security level assessment result generated based on the abnormal node status, previous records, and subsequent feedback records. The security level assessment result is used to determine whether to allow subsequent charging and discharging sessions.

10. A V2G charging and discharging full-process safety evaluation system, used to support the method described in any one of claims 1 to 9, characterized in that, It includes a communication interface, a storage unit, and a processor. The communication interface is connected to the vehicle, the bidirectional charging pile, the station server, and the grid-side platform, respectively. The storage unit stores programs that can be executed by the processor. The processor is used to establish a chain of evaluation nodes consisting of vehicle access, identity verification, start access, power interaction, operation monitoring, stop control and record archiving, and to generate a session evaluation identifier for a single charge-discharge session; The processor is also used to receive interaction records formed by the vehicle, bidirectional charging pile, station server and grid-side platform in the charging and discharging session through the communication interface, and to collect the interaction records and perform time-series alignment based on the session evaluation identifier; The processor is also used to perform node status judgment on each evaluation node in the evaluation node chain in sequence, including: comparing the current evaluation node's interaction record with the node entry condition, protocol verification result, device alarm status and operation sequence in sequence; When the node status of the previous evaluation node is normal and all comparison results of the current evaluation node are satisfied, the normal node status of the current evaluation node is generated and passed to the next evaluation node. If any comparison result is not met, or if the interaction record is missing or conflicting, an abnormal node state of the current evaluation node is generated, and the preceding record and subsequent feedback record of the current evaluation node are associated. The processor is also used to generate a full-process security assessment record based on the node status, previous records, and subsequent feedback records.

Images