A charging device multi-version protocol double-parsing semantic security checking method and system

Abstract

The application discloses a charging equipment multi-version protocol double-parsing semantic security checking method and system. When multiple charging communication protocol versions coexist, a target parser and a shadow parser process the same control message or transaction message. The shadow parser refers to a parser that independently parses the same immutable original message in the current checking chain, is used for collating and verifying the result of the target parser, and does not directly drive control. The system converts the two parsing results into unified charging security semantics, respectively, and determines whether the message has execution qualification according to the expected control effect corresponding to each charging security semantic under the current equipment state. During the transaction, the parser and the rule used continue to be bound during the transaction.

Description

Technical Field

[0001] This invention relates to a method and system for dual-parsing semantic security verification of multi-version protocols for charging devices, belonging to the field of communication security and control security technology for electric vehicle charging devices. Background Technology

[0002] The charging equipment, station gateway, and operation platform need to transmit business messages such as start-up, stop, power adjustment, limit condition change, status reporting, metering, and transaction settlement. During equipment modification, firmware upgrade, platform migration, or compatibility with existing equipment, the same site may use different protocol versions, different vendor extension rules, or different parsers simultaneously. Existing access systems typically select a parser based on the device profile, connection port, version indication, or message type, and then convert the result of that parser into an internal platform object.

[0003] Different protocol versions may specify different data types, units, multipliers, enumeration meanings, identifier formats, or state transition conditions for the same byte location. For example, the same numerical value may represent the original current value in one version and a current value with a multiplier in another; the same enumeration value may represent platform remote start and QR code start respectively; transaction identifiers may lose leading zeros after numerical processing; and the same status code may correspond to different charging states. Therefore, even if a message passes syntax validation in all versions, it may still generate different authorization paths, transaction objects, power boundaries, or state transitions.

[0004] Existing protocol adaptation, proxy conversion, and unified modeling technologies primarily address issues related to multi-protocol access, data exchange, or unified representation. Differential testing can uncover parsing differences between different implementations, and degradation protection can limit the security level of protocols. However, charging control systems still need to address two interrelated issues. First, before completing version-related parsing, the system doesn't know whether a message represents a heartbeat, startup, or other operation; therefore, it cannot select a parser based on the operation type beforehand, otherwise, a circular dependency will form. Second, the system cannot simply treat all semantic conflicts as "rejection." Rejecting startup or power increase may make the device more secure, but rejecting an emergency stop triggered by an independent and trusted security condition might allow the device to continue outputting energy.

[0005] Existing transaction sessions typically only store the business transaction number or connection state, without including the target resolver, shadow resolver, protocol version, normalization rules, resolver security requirements, and device minimum security requirements in a single persistent binding record. To isolate the binding relationship and execution eligibility before and after the establishment or switching of legitimate transactions, this invention records the identifier updated during the process as "Transaction Context Generation G," or simply "Transaction Generation." When the resolver or rules change midway through a transaction, the already authenticated context may be replaced undetected. Compatibility with older versions also carries similar risks: directly switching to an old resolver may bypass the original semantic verification. To prevent such bypassing, candidate resolution, independent dual resolution, comparison of expected control effects, execution eligibility, security tightening actions, binding during transactions, and controlled degradation must form an unbypassable processing chain. Summary of the Invention

[0006] The present invention aims to provide a semantic security verification scheme for dual-parsing of multiple version protocols for charging devices.

[0007] To achieve the above objectives, the first aspect of the technical solution of this invention discloses a method for dual-parsing semantic security verification of multi-version protocols in charging devices, characterized in that:

[0008] Packet access and independent parsing are achieved through the original packet access unit, the parser set management unit, the target parser, and the shadow parser, wherein: The original message access unit obtains an immutable original message byte sequence R and an external context C that does not depend on the message service content. Both the target parser and the shadow parser read the same immutable original message byte sequence R and the same external context C, and use the same state snapshot Q contained in the external context C. The two parsing chains must not read the syntax tree, field object or conversion result generated by the other. The parser set management unit stores multiple parser configurations. Before parsing, the system forms a candidate parser set. When a valid transaction binding exists, both the target parser and the shadow parser are mandatory. When no valid binding exists, the system forms a conservative candidate parser set based on outer frame evidence registered by the device, including allowed protocol families, communication endpoints, frame lengths, and checksums. This outer frame evidence is information obtainable without relying on version-related business parsing. The system must not use operation types, including start, stop, heartbeat, or power adjustment, that can only be obtained after version-related parsing to determine the candidate parser set. The system determines the target parser based on the valid transaction binding; if no valid binding exists, it determines the target parser based on the device's registered preferred security version. The system also selects at least one parser from the candidate parser set. Shadow parsers differ from the target parser in protocol version, rule set, or independent implementation source. Selected shadow parsers are all mandatory. If a set of "one target parser plus at least one shadow parser meeting the difference requirement" cannot be formed, the system records the incomplete mandatory parsing chain in the control effect comparison record D. The comparison conclusion must not be marked as equivalent, nor should a one-time execution authorization record A for ordinary business use be generated. If a message may change any aspect of charging / discharging state, direction, power, current, limitations, authorization, transaction, or settlement, the target parser and all mandatory shadow parsers directly parse the immutable original message byte sequence R. Other parsers in the candidate parser set that identify the immutable original message byte sequence R as applicable also participate in subsequent comparisons. Each parser outputs structured fields, field source evidence, and parsing status. The parsing status is categorized as "valid," "invalid," and "uncertain": "valid" indicates that the syntax, length, integrity checks, and required fields all conform to the corresponding rules; "invalid" indicates that a rule mismatch can be clearly identified; "uncertain" indicates that due to missing rules, resource anomalies, version evidence conflicts, or the undetermined key semantics required for execution, the parser cannot provide a unique result. For messages affecting control, transactions, or settlement, the system only proceeds to compare the expected control effects if the status of the target parser and all required shadow parsers is "valid." If any required parser is "invalid" or "uncertain," any required shadow parser has not yet completed parsing, the key semantics required for execution have not been determined, the expected control effects cannot be compared, or the version of the status snapshot Q has changed before submission, the system will not grant ordinary execution eligibility. The charging safety semantic normalization unit, control effect judgment unit, and execution qualification and safety action arbitration unit achieve unified expression, effect comparison, and execution release. The execution qualification and safety action arbitration unit constitutes an unavoidable entry point before the control interface; this entry point is called the final execution arbitration point, and the verification steps performed at this entry point are called the final execution arbitration. The charging safety semantic normalization unit converts each valid parsing result into a uniformly defined charging safety semantic S; the charging safety semantic normalization unit organizes the constraints into a set of constraint terms, and the system represents the state as state nodes and allowed state transitions, and the authorization as the authorizing subject, authorizing source, authorizing scope, and allowed operations; during normalization, the correspondence between "original field - semantic term" is preserved, so that each conflict can be traced back to the original message location and the parsing rule used; The control effect determination unit uses the same state snapshot Q, the same state model, and the same site security envelope as a benchmark to calculate the expected control effect of each charging safety semantic S in the current device state, denoted as the expected control effect E. The expected control effect E includes the target device, connector, state snapshot Q used, and model version. After the control effect comparison is completed, the system generates a structured record D for final arbitration verification, called the control effect comparison record D. The control effect comparison record D records the digest of the immutable original message byte sequence R, the participation status of the required parser, and the parsing status of each parser. It also records the parser and normalization rule fingerprint, state snapshot Q and its state version VQ, state model version, and security envelope version. The comparison result section includes the digest of each expected control effect E, the version of the equivalence determination rule, and a clear "equivalent" or "inequivalent" conclusion. If a set of a target parser plus at least one required shadow parser cannot be formed, the required parser is missing, parsing or normalization fails, the key semantics are not yet determined, the effect cannot be compared, or the conclusion cannot be determined, the control effect comparison record D records the corresponding failure reason and must not mark the comparison conclusion as equivalent. The execution qualification and security action arbitration unit constitute the final execution arbitration point; ordinary business actions are submitted through the ordinary business path, and only after obtaining ordinary execution qualification will they enter control submission; ordinary business paths, adapters, agents, and security action paths must all pass through the final execution arbitration point before reaching the charging control interface; for ordinary business actions, the final execution arbitration point must obtain a complete, verifiable, and equivalent control effect comparison record D; if the control effect comparison record D is missing, the mandatory parser participation is incomplete, the version of the rule or state snapshot Q is inconsistent, the conclusion is not equivalent, or it cannot be determined, ordinary execution qualification will not be granted, and execution cannot continue after simply writing the comparison result to the log; when the control effect comparison record D is valid and the key semantics required for execution are complete, the final execution arbitration point will also respectively The system verifies the applicable conditions of the target protocol, the security requirements of the parser, and the minimum security requirements of the device, as well as the freshness of the message, the state snapshot Q, and the binding during the transaction. After all verifications are successful, the final execution arbitration point generates a one-time execution authorization record A. This execution authorization record A is only used for the current control and is bound to the current message, device status, parsing environment, expected control effect, and execution objective. Within the same device, connector, and transaction generation, the system identifies the same message instance based on the verified freshness evidence. If the message instance already has a valid or used ordinary execution authorization record A, no new ordinary execution authorization record A will be generated. The generation of execution authorization record A does not mean that control has been submitted; execution authorization record A must undergo a final review before submission. Continuous constraint and recovery during the transaction process are achieved through binding units, controlled degradation units, and audit and recovery units, wherein: During a transaction, the binding unit maintains the transaction context generation G by device and physical connector. The transaction context generation G is updated when a legitimate transaction is established or when a legitimate transaction context switch is completed. It is used to isolate the binding relationship and execution eligibility before and after the update. Each transaction context generation G corresponds to a transaction-period binding record B. After a transaction is established, subsequent messages affecting control or the transaction must recalculate the current parsing environment digest before execution and verify it against the transaction-period binding record B. For the first transaction establishment, the system first establishes a protected, pending transaction context, or first legitimately activates the transaction context generation G and the transaction-period binding record B, then re-obtains the state snapshot Q and calculates the control effect comparison record D and the execution authorization record A. Regardless of the method used, before generating a usable execution authorization record A and submitting control, the transaction generations pointed to by the state snapshot Q, the control effect comparison record D, the execution authorization record A, and the valid transaction-period binding record B must be consistent. When submitting control, the control... The interface enters a mutually exclusive critical section, reads the current state snapshot Q and state version VQ, current transaction context generation G, current transaction binding record B, and current target object, and verifies the control effect comparison record D bound in the execution authorization record A, the immutable original message byte sequence R, and the state snapshot Q. The interface also verifies the parser, rules, security configuration, expected control effect, transaction context generation G, and target object, and confirms that the execution authorization record A is not yet used. If all are consistent, the interface atomically updates the state of the execution authorization record A to mark it as used within the current critical section, and then initiates only one control commit attempt. If any change occurs or the execution authorization record A is used, the execution authorization record A immediately becomes invalid. Once the execution authorization record A is marked as used, it cannot be used again regardless of the subsequent commit result. If the parser, rules, candidate parser set, version, corresponding security requirements, or transaction generation changes without authorization, the transaction binding record B also becomes invalid. When the target protocol does not meet the minimum security requirements of the device, the controlled degradation unit defaults to rejecting normal execution. If compatibility with the old version is necessary, the system must verify the one-time degradation token T generated by the authorized issuer. The controlled degradation unit sequentially verifies the issuer and integrity of the degradation token T, the device and connector, the validity period, the freshness evidence including the random number and / or monotonic counter actually carried by the degradation token T, the corresponding replay status, the allowed operation and control boundaries. After the verification is successful, the system re-verifies the token identifier, device, connector, authorization scope, original transaction generation, the unique target new transaction generation G′ specified by T, the freshness evidence actually carried by the degradation token T, the corresponding replay status, and the unused status in the same atomic transaction. When all conditions match, the current transaction marks the degradation token T as used. A new transaction generation G′ is used and established; only one concurrent transaction can succeed; if the downgrade token T fails verification, expires, is used, is out of scope, fails concurrency competition, or if the status of the downgrade token T or the new transaction generation G′ is found to be inconsistent before execution, a restricted new transaction generation is not established; after the downgrade token T is used successfully, the original transaction context generation G is closed or becomes read-only, and the new restricted transaction generation is established and a new transaction period binding record is generated; the ordinary execution qualification of the original transaction context generation G, the old one-time execution authorization record A, and the already used downgrade token cannot be used in the new transaction generation G′; the downgrade token only relaxes the explicit version and operation scope, and independent double resolution, semantic normalization, comparison of expected control effects, final execution arbitration, one-time execution authorization, transaction period binding, and auditing must still be performed; The audit and recovery unit records the original message summary, device and connector, transaction identifier and transaction generation, parser and rule fingerprint, each parsing status, semantic conflict category, expected control effect, execution eligibility, security tightening action, binding verification, token usage, and final control submission status such as confirmation of not issued or not accepted, confirmation of acceptance or completion, and uncertain result; the audit record does not store authentication secrets or plaintext sensitive credentials that can be reused; the audit record and control submission use the same associated identifier to clearly distinguish between submissions that only reject business actions, have performed physical security actions, have changed transaction status, and are awaiting reconciliation.

[0009] Preferably, the method is executed individually by the charging equipment controller, the station gateway, or the operation platform access service, or jointly by two of the charging equipment controller, the station gateway, or the operation platform.

[0010] Preferably, a single-point deployment constitutes the unbypassable final execution arbitration point only when the current node can gate all control submission paths within its protection range, or when the target control interface rejects a control request that does not carry a valid one-time execution authorization record A; otherwise, the final execution arbitration is set at a location closer to the control interface, or is completed collaboratively by the charging equipment controller, the station gateway, and the operation platform.

[0011] Preferably, the external context C includes a device identifier, a physical connector identifier, a message reception time, the current transaction generation, a saved transaction-period binding state, and a state snapshot Q. The state snapshot Q represents the physical state of the device on which this verification is based. The state snapshot Q comes from the protected local state, trusted device telemetry, or controller state, and remains unchanged in the current comparison. Each of the parsers is configured to record at least the parser identifier, applicable protocol family and version, parser program and rule file fingerprint, normalization rule identifier, parser security requirement identifier, identifiable outer frame condition and implementation source, wherein the outer frame condition is used to match the outer frame evidence; The charging safety semantics S records at least the following: Operation categories and safety action categories; Authorizing entity, source of authorization, and type of credentials; Equipment and physical connectors; Transaction identifier and transaction generation. The transaction identifier is processed as a string with a reserved format. The original identifier cannot be replaced by a numerical result to avoid losing valid information, including leading zeros. Current state, target state, and state transition conditions; Charging or discharging direction; Power, current, energy, amount, state of charge, duration, and number of times are limited; Evidence of freshness includes timestamps, serial numbers, random numbers, gun-insertion events, and replay windows; Generate the parser fingerprint and normalization rule identifier for the current semantics; The constraint items in the constraint item set should at least specify the physical quantity name, unified unit, value or interval, scale conversion rule, applicable object, applicable stage, and handling of out-of-bounds behavior; The execution authorization record A includes a control effect comparison record D and a summary of the immutable original message byte sequence R, device and connector, transaction identifier and transaction generation, state snapshot Q and state version VQ, as well as a state model and security envelope version, target and shadow resolver fingerprint, protocol version, normalization rule and security configuration summary, and expected control effect summary, permitted actions, target and usage status are also written into the execution authorization record A; The transaction binding record B binds the device, connector, transaction identifier, and transaction context generation G, and also binds the target parser, shadow parser set, protocol version, normalization rule, state model, security envelope, parser security requirements, device minimum security requirements, and random number. The transaction binding record B is protected by message authentication code, digital signature, trusted execution environment, or hardware security module. The downgrade token T is used to explicitly define which device, which connector, from which transaction generation to which target new transaction generation, which version and parser are allowed, which operations are allowed, and the maximum power or current. The token also includes at least a token identifier, the issuing party, the effective and expiration times, freshness evidence such as a random number and / or a monotonic counter, and an integrity protection value; The establishment of transactions on the same device and connector, the generation and use of one-time execution authorization records A, control submission, transaction generation switching, and token use are implemented using mutex locks, compare-and-swap, or transactional storage to avoid concurrent operations overwriting each other. The system verifies the message sequence number, freshness window, and transaction generation together, and ensures that within the same device, connector, and transaction generation, there is at most one usable ordinary execution authorization record A for the same message instance identified by the verified freshness evidence. Control submission results are at least categorized as confirmation of not sent or not accepted, confirmation of accepted or completed, and result uncertain. When the result is uncertain, the original execution authorization record A remains unusable. The system must not directly generate a new execution authorization record A that increases energy output based solely on the original control effect comparison record D. Instead, it should first reconcile the associated identifier, control submission record, and current device physical status before deciding whether to re-parse, maintain a secure state, or handle it manually. Delayed messages can only correspond to their original transaction generation and cannot change the state of the new transaction generation. After a system restart, if the binding record and control submission record during the most recent transaction period cannot be confirmed to be consistent, the action of increasing energy output will not be resumed. Instead, the physical status of the device will be read and renegotiated. The system can still perform disconnection or throttling when independent and trusted security conditions are met. If all required parsers confirm that the message will not change power, status, authorization, restrictions, transactions, or settlements, and that the binding is valid during the transaction and the candidate set remains unchanged, the fast processing path can be used. If any parser believes that the message is related to control or transactions, or cannot determine the nature of the message, the fast processing conditions are not met. This is to prevent a single version from interpreting the message as a "heartbeat" and bypassing double parsing.

[0012] Preferably, the state snapshot Q records at least the snapshot identifier, state version VQ, acquisition time, device and connector, contactor or power circuit state, charging / discharging direction, current output power or current, and currently effective control and protection limits; it also records the current transaction generation, state model version, and site security envelope version, wherein: The site safety envelope is the maximum power, current, direction, and state boundaries that a device is allowed to reach under current conditions; When the contactor, connection relationship, charging / discharging direction, critical output state, or existing restrictions change in a way that affects the effectiveness of the action, the Trusted State Manager updates the incremental state version VQ with atomic states and forms a new state snapshot. The same process is also used when the state model or security envelope changes in this way. The system locks the relevant devices and connectors during the verification to control submission period, or re-verifies the status version VQ before submission.

[0013] Preferably, the security tightening action triggered by the independent and trusted security condition uses an independent security action path, but still converges to the final execution arbitration point. The independent and trusted security condition refers to a condition that does not rely on semantically conflicting messages and their version-related parsing chains, and can correspond to the current device and connector. It is provided by any source among device connection relationship, hardware interlock, protected local state, or independent authentication channel. Before using the corresponding source, the system verifies its integrity, freshness, and correspondence with the current device and connector. Any source that passes verification can trigger the security tightening action. When there are multiple verified sources and the results conflict, hardware interlock and protected local state are given priority. If these two types of results still conflict or the result cannot be determined, energy output should not be increased or restrictions relaxed, and the process should switch to local protection. The security action arbitration first confirms the physical devices and connectors that need to be protected based on the independent and trusted security condition. After successful confirmation, only when all mandatory parsing chains provide the target, state snapshot Q version, and expected control effect E that is consistent and comparable in unit scale, will the common allowable boundary be calculated from the message interpretation. For items including power, electrical For numerical constraints including flow, the system takes the intersection of the allowable range of each candidate expected control effect, the currently effective control or protection constraint, and the site security envelope as the common allowable boundary. The resulting allowable set must not be wider than the currently effective allowable set. For charging and discharging directions and discrete states, corresponding changes are only implemented when consistent confirmation is obtained according to the aforementioned source conflict rules. If any mandatory expected control effect E is missing, invalid, or uncertain, the current constraint cannot be confirmed, the numerical range has no intersection, the direction or state transition conflicts, or the target cannot be confirmed, the system must not increase energy output or relax constraints based on conflict messages. Instead, the current security state is maintained by independent and trusted local protection conditions and local protection strategies, power derating or disconnection of power loops is implemented, and a trusted control source is requested. Already applied disconnection, derating, or tightening constraints take precedence over normal business actions. Before the protection conditions are lifted or the independent and trusted source reauthorizes, normal business paths, adapters, and agents must not cover, relax, or bypass the constraint. Security action paths cannot complete transaction settlement, change the authorized subject, or record conflict messages as normal stops. The relevant transaction status is retained as pending verification and entered into the audit log.

[0014] Preferably, in the control effect determination unit, the information related to the action includes the action to be performed, the type of safe action, the state transition, the charging and discharging direction, the allowable power and current range, and the energy or amount limit; the information related to the transaction includes the transaction object, the scope of authorization, and whether the billing or transaction status has changed.

[0015] Preferably, the system determines whether two control effects are equivalent based on three types of conditions: First) Discrete items such as equipment, connector, transaction object, authorization scope, state transition, charging / discharging direction, and billing status change must be the same. Among them, the transaction object is the transaction state entity associated with the transaction identifier. Second) After all control restrictions are converted into a unified unit and scale, the same actual control boundary must be formed; Third) Evidence of freshness must correspond to the same connection event and the same transaction generation; Measurement values ​​used only for display and not involved in control or settlement shall use a preset error, but the preset error shall not change start / stop, direction, state transition, authorization, transaction object or security restrictions; If multiple shadow resolvers exist, the target control effect must be equivalent to each valid shadow control effect.

[0016] Preferably, the system will not grant ordinary execution qualification if any of the following occurs: the expected control effect is not equivalent, the key semantics required for execution are missing, the required parser fails or is uncertain, the applicability of the target protocol fails verification, the parser security requirements or the minimum security requirements of the device are not met, or the binding fails during the transaction; for actions including starting, restoring output, increasing power or current, switching to discharge, relaxing restrictions, and changing settlement status, the system maintains or enters a safe state that does not allow for increased energy output and requires re-authentication, renegotiation, or manual handling.

[0017] The second aspect of the technical solution of the present invention discloses a multi-version protocol dual-parsing semantic security verification system for charging devices, characterized in that it has a communication interface and a control execution interface, and includes one or more processors; A storage device is provided for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the dual-parse semantic security verification method for multi-version protocols of charging devices according to claim 1. The system can be deployed as an independent security gateway or as a security component in the charging device controller, station edge device, or operation platform access service. When transmitting immutable original message byte sequence R, state snapshot Q, control effect comparison record D, or execution authorization record A across components, each component should be within the same protected execution or storage boundary, or end-to-end verification should be performed on the data source, integrity, and the association between the immutable original message byte sequence R, state snapshot Q, control effect comparison record D, and execution authorization record A; the specific protection algorithm and deployment level can be configured according to system conditions.

[0018] When multiple charging communication protocol versions coexist, this invention processes the same control message or transaction message separately using a target parser and a shadow parser. The shadow parser is a parser that independently parses the same immutable original message within the current verification chain, used for comparison and verification with the result of the target parser, and does not directly drive control. The system converts the two parsing results into unified charging safety semantics and determines whether the message is eligible for execution based on the expected control effect corresponding to each charging safety semantic in the current device state. During a transaction, the parser and rules used remain bound by the transaction period.

[0019] Compared with the method of selecting a single parser based solely on version markers and directly executing the parsing results, the present invention has the following advantages: 1) The system determines candidate parsers based on transaction binding, device registration, and outer frame evidence, and does not use operation types that have not yet been parsed. Therefore, the system does not first identify a message as a heartbeat or a certain operation, and then decide whether double parsing is required based on this, thus eliminating this circular dependency.

[0020] 2) The target parser and the shadow parser process the same immutable original message independently and retain the source of each field. Even if the message passes syntax validation in different versions, the system can still detect differences in authorization, transaction object, status, direction, or numerical scale, avoiding ambiguity masked by the adaptation layer or intermediate conversion.

[0021] 3) Each parsing result is first converted into a unified charging safety semantic, and then the corresponding expected control effect is calculated based on the same state snapshot. The control effect comparison record D retains the participating parsers, rule versions, state versions, and equivalent conclusions, so that "different expressions" and "different expected control boundaries" can be distinguished. If the comparison fails, the system must not continue execution by simply logging the information.

[0022] 4) The final execution arbitration point separates routine business actions from security tightening actions. Semantic conflicts cannot trigger startup, power increase, limit relaxation, or settlement. Degradation, limit tightening, or disconnection actions triggered by independent trusted security conditions can still be executed with priority. Existing security restrictions cannot be overridden by routine business paths, adapters, or proxies, thus preventing erroneous increases in power output without hindering trusted security shutdown.

[0023] 5) During the transaction, the persistent constraint target resolver, shadow resolver, protocol version, normalization rule, state model, security envelope, corresponding security requirements, and transaction generation are bound. The one-time execution authorization record A is also bound to the control effect comparison record D, the original message, the state snapshot and its version, the expected control effect, and the target. At most one usable ordinary execution authorization record A is retained for the same message instance. The control interface reviews the execution authorization record A within a mutually exclusive critical section, atomically updates A to mark it as used, and then initiates only one control commit attempt. If the commit result is uncertain, the execution authorization record A cannot be reused; the system first reconciles the control commit record with the current physical state. This allows for the detection of changes in state, resolution environment, or execution target that occur after verification or during the transaction, and limits cross-transaction execution risks arising from authorization reuse, concurrent operations, delayed message arrival, or system restart recovery.

[0024] 6) A one-time downgrade token explicitly restricts the device, connector, protocol version, allowed operations, control boundaries, and validity period. The system verifies the token constraints within the same atomic transaction, marks the token as used, and establishes a unique, restricted new transaction generation. Therefore, at most one of concurrent or replay requests can succeed. After downgrading, double parsing and determination of the expected control effect are still required; compatibility with older versions cannot be used as a channel to bypass core verification.

[0025] 7) Audit logs clearly indicate whether a business action was rejected, a physical security action was performed, or the transaction status has changed, and retain the parser and rule fingerprints. These logs can be used for protocol upgrades, anomaly reproduction, and security testing, without requiring the retention of reusable authentication secrets. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of the structure of the multi-version protocol dual-parsing semantic security verification system for the charging device of the present invention; Figure 2 This is a flowchart illustrating the multi-version protocol dual-parsing semantic security verification method for charging devices according to the present invention. Figure 3 This diagram illustrates the relationship between the charging safety semantics, expected control effects, eligibility for execution, and safety tightening measures of this invention. Figure 4 This is a schematic diagram illustrating the states of binding, controlled downgrading, and transaction generation switching during the transaction process of this invention. Detailed Implementation

[0027] The present invention will be further illustrated below with reference to specific embodiments. It should be understood that these embodiments are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be understood that after reading the teachings of this invention, those skilled in the art can make various alterations or modifications to the invention, and these equivalent forms also fall within the scope defined by the appended claims.

[0028] The following embodiments use abstract test protocols P1 and P2, constructed specifically to illustrate the present invention, and do not represent actual fields of any particular vendor or production protocol. The test system is deployed at the station-side gateway. One side of the gateway connects to the operation platform, and the other side connects to the charging device numbered D-017 and its physical connector C-01. The device registration information allows the use of two versions, P1 and P2, where P2 is the target version used normally, and P1 is a shadow version. The two parsers are constructed from different rule files, with fingerprints F2 and F1, respectively. The normalized rule fingerprint is N3, and the device's minimum security requirement identifier is L2.

[0029] The outer frame of the test message includes a frame header, version hint, message code, device identifier, transaction identifier, sequence number, payload, and integrity check value. The version hint can only serve as evidence for selecting candidate parsers and cannot determine whether the message can be executed independently. After receiving the message, the gateway freezes the original byte sequence R and reads the current states of D-017 and C-01 from the protected local controller, including contactor open, output 0kW, charging direction, current transaction generation, state model M4, and safety envelope H2. This information constitutes a snapshot Q77 with state version VQ=9. The same original byte sequence R, the same external context C, and the same Q77 are simultaneously delivered to the P2 target parser and the P1 shadow parser.

[0030] In the startup conflict example, the message code of the original byte sequence R passes the syntax check under both the P1 shadow parser and the P2 target parser. The transaction identifier in the message is the string "00018427" with leading zeros, sequence number 37, and startup source value "02". The P2 target parser interprets "02" as platform remote startup, thus requiring platform device credentials and remote startup authorization. The P1 shadow parser interprets "02" as QR code user startup, thus requiring user token and QR code authorization. The two unified charging safety semantics point to the same device, connector, and transaction identifier, but differ in authorization source, credential type, and authorization scope. The two parsing chains require different authentication chains, therefore the expected control effects are not equivalent. The system does not send a closing contactor or startup output command to the charging control interface, the device remains in a safe state where energy output cannot be increased, and records the conflict content, the fingerprints of the two parsers, the summary of the original byte sequence R, and the disposal result.

[0031] In the normal startup example, the authenticated startup request first establishes a legitimate transaction context. During the transaction, the binding unit determines the transaction generation G=41 and generates a valid transaction binding record B41; subsequently, it obtains a state snapshot Q77 of record G=41. Transaction binding record B41 binds D-017, C-01, transaction "00018428", G=41, target and shadow resolver, protocol version P2, N3, M4, H2, resolver security requirements, device minimum security requirement L2, and a random number. Although the P1 shadow resolver and P2 target resolver use different field names, they both interpret the same immutable original message as a platform remote startup. The transaction identifier obtained by both is "00018428", the connector is C-01, and the charging direction, maximum current 32A, maximum power 7kW, plug-in event, and sequence number window are also consistent. The control effect determination unit calculates two expected control effects under the same Q77, state model M4, and security envelope H2. After unit conversion, all discrete terms, current boundaries, and power boundaries are identical, resulting in an equivalent comparison. A control effect comparison record D41 is generated. D41 records the R summary, the participation and resolution states of F2 and F1, normalization rule N3, Q77 and VQ=9, G=41, M4, H2, two expected control effect summaries, and the equivalent conclusion. The final execution arbitration point verifies D41, B41, and other submission conditions and grants ordinary execution qualification, generating a one-time execution authorization record A41. A41 binds D41, R, Q77 and VQ=9, the resolution environment, the expected control effect, G=41, and the target object, with an initial usage state of "unused." The control interface reads the current Q77, VQ, G, B, and target object within the mutually exclusive protected critical section, completes the final verification, updates A41 to be used with atomic states, and then submits a control initiation attempt.

[0032] Assuming that after A41 is generated but before the contactor closes, the protected local controller reports that the connector has been unplugged, the charging / discharging direction has changed, or the safety envelope has changed, the trusted state manager increments VQ from 9 to 10 and forms a new snapshot Q78. Before the control interface submits, it reads VQ=10, while A41 is bound to VQ=9. Therefore, A41 cannot be marked as used, and A41 immediately becomes invalid. Subsequent processing must be based on Q78, redetermining the candidate resolver set, completing double resolution and semantic normalization, calculating the expected control effect, and generating a new control effect comparison record. The device remains in a safe state where energy output cannot be increased until the new result is qualified for execution. Once A41 is marked as used, resubmission will be rejected due to the mismatch in usage status. Consistent resolution results are only one of the conditions for approval; during execution, it must still be confirmed that the device state and execution target have not been replaced.

[0033] In the scale conflict example, the same limit field represents an integer in units of 0.1 A in the P2 target parser and an integer in units of 1 A in P1. Therefore, the original value "320" represents 32A and 320A respectively. After conversion to a unified unit, the two current limits are significantly different, and 320A exceeds the device safety envelope, so the system does not allow increasing or relaxing the power boundary. If the message requests a derated limit, and all mandatory parsing chains can provide comparable allowable ranges for the object, Q version, and unit scale, the safety action path can only take the intersection of the allowable ranges of each candidate expected control effect, the currently effective control or protection limit, and the site safety envelope as the common allowable boundary, and the final execution arbitration point forms the priority safety limit. The resulting boundary must not be wider than the current limit. Ordinary business paths cannot later restore this limit to a higher output, nor can they change the transaction settlement status based on it.

[0034] In the example of a stop conflict, one parser retains the transaction identifier "00018428", while another parser incorrectly converts the identifier to a value, obtaining "18428". The system cannot prove that both refer to the same transaction object, therefore neither a normal stop nor settlement is eligible for execution. If the device's local overcurrent protection, the status of the protected connector, or the independent authentication channel can confirm that C-01 must be disconnected, the safety action arbitration can directly disconnect the power circuit of C-01. However, the transaction "00018428" remains pending verification. The system cannot record the conflict message as a normal transaction stop, nor can it settle other transactions based on it.

[0035] When subsequent critical messages arrive, the system uses B41 to verify the target resolver, shadow resolver, protocol version, normalization rule, resolver security requirements, device minimum security requirements, and transaction generation. This forms a candidate resolver set, and dual resolution is then performed. If maintenance updates change the resolver fingerprint from F2 to F2', or if the device prompts to switch to the P1 shadow resolver mid-transaction but fails to complete a valid transaction generation switch, the current resolution environment will fail B41 verification, blocking actions such as startup, power increase, and settlement. Rapid processing is only allowed when all candidate resolvers confirm that the message is unrelated to control and transactions, and that the bindings have not changed. If the P1 shadow resolver or the P2 target resolver deems the message related to control, or cannot determine the message's nature, full dual resolution is still performed.

[0036] In the controlled degradation example, the operations and maintenance authorization system issues a one-time degradation token T56 for D-017 and C-01. T56 specifies a switch from the original transaction generation 41 to a unique new target transaction generation 42, allowing only the P1 shadow resolver to process messages required to maintain the connection and status reporting messages, with a maximum output limit of 0 kW. The token also includes an effective time, a five-minute validity period, a counter, and a random number, with integrity protection provided by the issuer. The gateway verifies the issuer, integrity, device, connector, validity period, the counter and random number actually carried by T56, and the corresponding replay status. After successful verification, the gateway checks the T56 identifier, D-017, C-01, authorization scope, original transaction generation 41, target transaction generation 42, counter, random number, corresponding replay status, and unused status within the same transaction. When all matches, the transaction marks T56 as used, invalidates the normal execution qualification of transaction generation 41, establishes restricted transaction generation 42 and generates B42; other concurrent transactions fail due to mismatched usage status.

[0037] In transaction generation 42, status reporting messages still need to be independently parsed, normalized, and compared by the P1 target parser and the P2 shadow parser, and executed using the new snapshot, new binding, and new one-time execution authorization record of transaction generation 42. Operations such as starting, increasing power, changing direction, relaxing restrictions, stopping, settling, and other operations outside the token's scope are beyond the authorization scope of T56 and cannot obtain normal execution eligibility. If T56, A41 of transaction generation 41, or old execution eligibility reappears, the system will reject them. Therefore, downgrade tokens only allow explicitly defined protocol versions and operations and cannot bypass dual parsing, expected control effect comparison, final execution arbitration, transaction-period binding, and auditing.

[0038] The test environment is configured with eight types of test cases: startup source conflict, scalar multiplier conflict, constraint scale conflict, transaction identifier leading zero difference, status code and state transition conflict, tokenless degradation, one-time restricted degradation, and mid-transaction parser or rule switching. Each test case records the same original message digest, two parsing states, charging safety semantics, expected control effect, binding or token state, and final disposal result to verify the aforementioned implementation process.

[0039] Those skilled in the art will understand that the features described in the various embodiments and / or claims of this invention can be combined or combined in various ways, even if such combinations or combinations are not explicitly described in this disclosure. In particular, the features described in the various embodiments and / or claims of this invention can be combined or combined in various ways without departing from the spirit and teachings of this disclosure. All such combinations and / or combinations fall within the scope of this disclosure.

[0040] The embodiments of the present invention have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of this disclosure. Although various embodiments have been described above, this does not mean that the measures in the various embodiments cannot be used advantageously in combination. The scope of the present invention is defined by the appended claims and their equivalents. Various substitutions and modifications can be made by those skilled in the art without departing from the scope of the present invention, and all such substitutions and modifications should fall within the scope of this disclosure.

Claims

1. A method for dual-parsing semantic security verification of multi-version protocols in charging devices, characterized in that: Packet access and independent parsing are achieved through the original packet access unit, the parser set management unit, the target parser, and the shadow parser, wherein: The original message access unit obtains an immutable original message byte sequence R and an external context C that does not depend on the message service content. Both the target parser and the shadow parser read the same immutable original message byte sequence R and the same external context C, and use the same state snapshot Q contained in the external context C. The two parsing chains must not read the syntax tree, field object or conversion result generated by the other. The parser set management unit stores multiple parser configurations. Before parsing, the system forms a candidate parser set. When a valid transaction binding exists, both the target parser and the shadow parser are mandatory. When no valid binding exists, the system forms a conservative candidate parser set based on outer frame evidence registered by the device, including allowed protocol families, communication endpoints, frame lengths, and checksums. This outer frame evidence is information obtainable without relying on version-related business parsing. The system must not use operation types, including start, stop, heartbeat, or power adjustment, that can only be obtained after version-related parsing to determine the candidate parser set. The system determines the target parser based on the valid transaction binding; if no valid binding exists, it determines the target parser based on the device's registered preferred security version. The system also selects at least one parser from the candidate parser set. Shadow parsers differ from the target parser in protocol version, rule set, or independent implementation source. Selected shadow parsers are all mandatory parsers. If a set of "one target parser plus at least one shadow parser meeting the difference requirement" cannot be formed, the system records the incomplete mandatory parsing chain in the control effect comparison record D. The comparison conclusion must not be marked as equivalent, nor should a one-time execution authorization record A for ordinary business use be generated. If a message may change any aspect of charging / discharging state, direction, power, current, limitations, authorization, transaction, or settlement, the target parser and all mandatory shadow parsers directly parse the immutable original message byte sequence R. Other parsers in the candidate parser set that identify the immutable original message byte sequence R as applicable also participate in subsequent comparisons. Each parser outputs structured fields, field source evidence, and parsing status. The parsing status is categorized as "valid," "invalid," and "uncertain": "valid" indicates that the syntax, length, integrity checks, and required fields all conform to the corresponding rules; "invalid" indicates that a rule mismatch can be clearly identified; "uncertain" indicates that due to missing rules, resource anomalies, version evidence conflicts, or the undetermined key semantics required for execution, the parser cannot provide a unique result. For messages affecting control, transactions, or settlement, the system only proceeds to compare the expected control effects if the status of the target parser and all required shadow parsers are both "valid." If any required parser is "invalid" or "uncertain," any required shadow parser has not yet completed parsing, the key semantics required for execution have not been determined, the expected control effects cannot be compared, or the version of the status snapshot Q has changed before submission, the system will not grant normal execution eligibility. The charging safety semantic normalization unit, control effect judgment unit, and execution qualification and safety action arbitration unit achieve unified expression, effect comparison, and execution release. The execution qualification and safety action arbitration unit constitutes an unavoidable entry point before the control interface; this entry point is called the final execution arbitration point, and the verification steps performed at this entry point are called the final execution arbitration. The charging safety semantic normalization unit converts each valid parsing result into a uniformly defined charging safety semantic S; the charging safety semantic normalization unit organizes the constraints into a set of constraint terms, and the system represents the state as state nodes and allowed state transitions, and the authorization as the authorizing subject, authorizing source, authorizing scope, and allowed operations; during normalization, the correspondence between "original field-semantic item" is preserved, so that each conflict can be traced back to the original message location and the parsing rule used; The control effect determination unit uses the same state snapshot Q, the same state model, and the same site security envelope as a benchmark to calculate the expected control effect of each charging safety semantic S in the current device state, denoted as the expected control effect E. The expected control effect E includes the target device, connector, state snapshot Q used, and model version. After the control effect comparison is completed, the system generates a structured record D for final arbitration verification, called the control effect comparison record D. The control effect comparison record D records the digest of the immutable original message byte sequence R, the participation status of the required parser, and the parsing status of each parser. It also records the parser and normalization rule fingerprint, state snapshot Q and its state version VQ, state model version, and security envelope version. The comparison result section includes the digest of each expected control effect E, the version of the equivalence determination rule, and a clear "equivalent" or "inequivalent" conclusion. If a set of a target parser plus at least one required shadow parser cannot be formed, the required parser is missing, parsing or normalization fails, the key semantics are not yet determined, the effect cannot be compared, or the conclusion cannot be determined, the control effect comparison record D records the corresponding failure reason and must not mark the comparison conclusion as equivalent. The execution qualification and security action arbitration unit constitute the final execution arbitration point; ordinary business actions are submitted through the ordinary business path, and only after obtaining ordinary execution qualification will they enter control submission; ordinary business paths, adapters, agents, and security action paths must all pass through the final execution arbitration point before reaching the charging control interface; for ordinary business actions, the final execution arbitration point must obtain a complete, verifiable, and equivalent control effect comparison record D; if the control effect comparison record D is missing, the mandatory parser participation is incomplete, the version of the rule or state snapshot Q is inconsistent, the conclusion is not equivalent, or it cannot be determined, ordinary execution qualification will not be granted, and execution cannot continue after simply writing the comparison result to the log; when the control effect comparison record D is valid and the key semantics required for execution are complete, the final execution arbitration point will also respectively The system verifies the applicable conditions of the target protocol, the security requirements of the parser, and the minimum security requirements of the device, as well as the freshness of the message, the state snapshot Q, and the binding during the transaction. After all verifications are successful, the final execution arbitration point generates a one-time execution authorization record A. This execution authorization record A is only used for the current control and is bound to the current message, device status, parsing environment, expected control effect, and execution objective. Within the same device, connector, and transaction generation, the system identifies the same message instance based on the verified freshness evidence. If the message instance already has a valid or used ordinary execution authorization record A, no new ordinary execution authorization record A will be generated. The generation of execution authorization record A does not mean that control has been submitted; execution authorization record A must undergo a final review before submission. Continuous constraint and recovery during the transaction process are achieved through binding units, controlled degradation units, and audit and recovery units, wherein: During a transaction, the binding unit maintains the transaction context generation G by device and physical connector. The transaction context generation G is updated when a legitimate transaction is established or when a legitimate transaction context switch is completed. It is used to isolate the binding relationship and execution eligibility before and after the update. Each transaction context generation G corresponds to a transaction-period binding record B. After a transaction is established, subsequent messages affecting control or the transaction must recalculate the current parsing environment digest before execution and verify it against the transaction-period binding record B. For the first transaction establishment, the system first establishes a protected, pending transaction context, or first legitimately activates the transaction context generation G and the transaction-period binding record B, then re-obtains the state snapshot Q and calculates the control effect comparison record D and the execution authorization record A. Regardless of the method used, before generating a usable execution authorization record A and submitting control, the transaction generations pointed to by the state snapshot Q, the control effect comparison record D, the execution authorization record A, and the valid transaction-period binding record B must be consistent. When submitting control, the control... The interface enters a mutually exclusive critical section, reads the current state snapshot Q and state version VQ, current transaction context generation G, current transaction binding record B, and current target object, and verifies the control effect comparison record D bound in the execution authorization record A, the immutable original message byte sequence R, and the state snapshot Q. The interface also verifies the parser, rules, security configuration, expected control effect, transaction context generation G, and target object, and confirms that the execution authorization record A is not yet used. If all are consistent, the interface atomically updates the state of the execution authorization record A to mark it as used within the current critical section, and then initiates only one control commit attempt. If any change occurs or the execution authorization record A is used, the execution authorization record A immediately becomes invalid. Once the execution authorization record A is marked as used, it cannot be used again regardless of the subsequent commit result. If the parser, rules, candidate parser set, version, corresponding security requirements, or transaction generation changes without authorization, the transaction binding record B also becomes invalid. When the target protocol does not meet the minimum security requirements of the device, the controlled degradation unit defaults to rejecting normal execution. If compatibility with the old version is necessary, the system must verify the one-time degradation token T generated by the authorized issuer. The controlled degradation unit sequentially verifies the issuer and integrity of the degradation token T, the device and connector, the validity period, the freshness evidence including the random number and / or monotonic counter actually carried by the degradation token T, the corresponding replay status, the allowed operation and control boundaries. After the verification is successful, the system re-verifies the token identifier, device, connector, authorization scope, original transaction generation, the unique target new transaction generation G′ specified by T, the freshness evidence actually carried by the degradation token T, the corresponding replay status, and the unused status in the same atomic transaction. When all conditions match, the current transaction marks the degradation token T as used. A new transaction generation G′ is used and established; only one concurrent transaction can succeed; if the downgrade token T fails verification, expires, is used, is out of scope, fails concurrency competition, or if the status of the downgrade token T or the new transaction generation G′ is found to be inconsistent before execution, a restricted new transaction generation is not established; after the downgrade token T is used successfully, the original transaction context generation G is closed or becomes read-only, and the new restricted transaction generation is established and a new transaction period binding record is generated; the ordinary execution qualification of the original transaction context generation G, the old one-time execution authorization record A, and the already used downgrade token cannot be used in the new transaction generation G′; the downgrade token only relaxes the explicit version and operation scope, and independent double resolution, semantic normalization, comparison of expected control effects, final execution arbitration, one-time execution authorization, transaction period binding, and auditing must still be performed; The audit and recovery unit records the original message summary, device and connector, transaction identifier and transaction generation, parser and rule fingerprint, each parsing status, semantic conflict category, expected control effect, execution eligibility, security tightening action, binding verification, token usage, and final control submission status such as confirmation of not issued or not accepted, confirmation of acceptance or completion, and uncertain result; the audit record does not store authentication secrets or plaintext sensitive credentials that can be reused; the audit record and control submission use the same associated identifier to clearly distinguish between submissions that only reject business actions, have performed physical security actions, have changed transaction status, and are awaiting reconciliation.

2. The method for dual-parsing semantic security verification of multi-version protocols in charging devices as described in claim 1, characterized in that, The method can be executed individually by the charging equipment controller, the station gateway, or the operation platform access service, or jointly by two of the charging equipment controller, the station gateway, or the operation platform.

3. The method for dual-parsing semantic security verification of multi-version protocols in charging devices as described in claim 2, characterized in that, A single-point deployment constitutes the unbypassable final execution arbitration point only when the current node can gate all control submission paths within its protection range, or when the target control interface rejects a control request that does not carry a valid one-time execution authorization record A; otherwise, the final execution arbitration is set at a location closer to the control interface, or is completed collaboratively by the charging equipment controller, the station gateway, and the operation platform.

4. The method for dual-parsing semantic security verification of multi-version protocols in charging devices as described in claim 1, characterized in that, The external context C includes the device identifier, physical connector identifier, message reception time, current transaction generation, saved transaction-period binding status, and status snapshot Q. The status snapshot Q represents the physical state of the device on which this verification is based. The status snapshot Q comes from the protected local state, trusted device telemetry, or controller state, and remains unchanged in the current comparison. Each of the parsers is configured to record at least the parser identifier, applicable protocol family and version, parser program and rule file fingerprint, normalization rule identifier, parser security requirement identifier, identifiable outer frame condition and implementation source, wherein the outer frame condition is used to match the outer frame evidence; The charging safety semantics S records at least the following: Operation categories and safety action categories; Authorizing entity, source of authorization, and type of credentials; Equipment and physical connectors; Transaction identifier and transaction generation. The transaction identifier is processed as a string with a reserved format. The original identifier cannot be replaced by a numerical result to avoid losing valid information, including leading zeros. Current state, target state, and state transition conditions; Charging or discharging direction; Power, current, energy, amount, state of charge, duration, and number of times are limited; Evidence of freshness includes timestamps, serial numbers, random numbers, gun-insertion events, and replay windows; Generate the parser fingerprint and normalization rule identifier for the current semantics; The constraint items in the constraint item set should at least specify the physical quantity name, unified unit, value or interval, scale conversion rule, applicable object, applicable stage, and handling of out-of-bounds behavior; The execution authorization record A includes a control effect comparison record D and a summary of the immutable original message byte sequence R, device and connector, transaction identifier and transaction generation, state snapshot Q and state version VQ, as well as a state model and security envelope version, target and shadow resolver fingerprint, protocol version, normalization rule and security configuration summary, and expected control effect summary, permitted actions, target and usage status are also written into the execution authorization record A; The transaction binding record B binds the device, connector, transaction identifier, and transaction context generation G, and also binds the target parser, shadow parser set, protocol version, normalization rule, state model, security envelope, parser security requirements, device minimum security requirements, and random number. The transaction binding record B is protected by message authentication code, digital signature, trusted execution environment, or hardware security module. The downgrade token T is used to explicitly define which device, which connector, from which transaction generation to which target new transaction generation, which version and parser are allowed, which operations are allowed, and the maximum power or current. The token also includes at least a token identifier, the issuing party, the effective and expiration times, freshness evidence such as a random number and / or a monotonic counter, and an integrity protection value; The establishment of transactions on the same device and connector, the generation and use of one-time execution authorization records A, control submission, transaction generation switching, and token use are implemented using mutex locks, compare-and-swap, or transactional storage to avoid concurrent operations overwriting each other. The system verifies the message sequence number, freshness window, and transaction generation together, and ensures that within the same device, connector, and transaction generation, there is at most one usable ordinary execution authorization record A for the same message instance identified by the verified freshness evidence. Control submission results are at least categorized as confirmation of not sent or not accepted, confirmation of accepted or completed, and result uncertain. When the result is uncertain, the original execution authorization record A remains unusable. The system must not directly generate a new execution authorization record A that increases energy output based solely on the original control effect comparison record D. Instead, it should first reconcile the associated identifier, control submission record, and current device physical status before deciding whether to re-parse, maintain a secure state, or handle it manually. Delayed messages can only correspond to their original transaction generation and cannot change the state of the new transaction generation. After a system restart, if the binding record and control submission record during the most recent transaction period cannot be confirmed to be consistent, the action of increasing energy output will not be resumed. Instead, the physical status of the device will be read and renegotiated. The system can still perform disconnection or throttling when independent and trusted security conditions are met. If all required parsers confirm that the message will not change power, status, authorization, restrictions, transactions, or settlements, and that the binding is valid during the transaction and the candidate set remains unchanged, the fast processing path can be used. If any parser believes that the message is related to control or transactions, or cannot determine the nature of the message, the fast processing conditions are not met. This is to prevent a single version from interpreting the message as a "heartbeat" and bypassing double parsing.

5. The method for dual-parsing semantic security verification of multi-version protocols in charging devices as described in claim 4, characterized in that, The state snapshot Q records at least the snapshot identifier, state version VQ, acquisition time, device and connector, contactor or power circuit status, charging / discharging direction, current output power or current, and currently active control and protection limits; it also records the current transaction generation, state model version, and site security envelope version, wherein: The site safety envelope is the maximum power, current, direction, and state boundaries that a device is allowed to reach under current conditions; When the contactor, connection relationship, charging / discharging direction, critical output state, or existing restrictions change in a way that affects the effectiveness of the action, the Trusted State Manager updates the incremental state version VQ with atomic states and forms a new state snapshot. The same process is also used when the state model or security envelope changes in this way. The system locks the relevant devices and connectors during the verification to control submission period, or re-verifies the status version VQ before submission.

6. The method for dual-parsing semantic security verification of multi-version protocols in charging devices as described in claim 1, characterized in that, The security tightening action triggered by independent and trusted security conditions uses an independent security action path, but still converges to the final execution arbitration point. The independent and trusted security conditions refer to conditions that do not rely on semantically conflicting messages and their version-related parsing chains, and that correspond to the current device and connector. These conditions are provided by any source among device connection relationships, hardware interlocks, protected local states, or independent authentication channels. Before using a source, the system verifies its integrity, freshness, and correspondence with the current device and connector. Any source that passes verification can trigger a security tightening action. When multiple verified sources exist and their results conflict, hardware interlocks and protected local states are prioritized. If these two types of results still conflict or the result cannot be determined, energy output should not be increased or restrictions relaxed; instead, local protection processing should be initiated. The security action arbitration first confirms the physical devices and connectors requiring protection based on the independent and trusted security conditions. After successful confirmation, only when all mandatory parsing chains provide the target, state snapshot Q version, and comparable expected control effect E at the same unit scale, is the common allowable boundary calculated from the message interpretation. For parameters including power and current... For numerical limits, the system takes the intersection of the allowable range of each candidate expected control effect, the currently effective control or protection limit, and the site security envelope as the common allowable boundary. The resulting allowable set must not be wider than the currently effective allowable set. For charging and discharging directions and discrete states, corresponding changes are only implemented when consistent confirmation is obtained according to the aforementioned source conflict rules. If any mandatory expected control effect E is missing, invalid, or uncertain, the current limit cannot be confirmed, the numerical range has no intersection, the direction or state transition conflicts, or the target cannot be confirmed, the system must not increase energy output or relax the limit based on the conflict message. Instead, the independent and trusted local protection conditions and local protection strategies will maintain the current security state, implement derating or disconnecting power loops, and request a trusted control source. The already applied disconnect, derating, or tightening limits take precedence over ordinary business actions. Before the protection conditions are lifted or the independent and trusted source reauthorizes, ordinary business paths, adapters, and agents must not cover, relax, or bypass the limit. Security action paths cannot complete transaction settlement, change the authorized subject, or record conflict messages as normal stops. The relevant transaction status is retained as pending verification and entered into the audit log.

7. The method for dual-parsing semantic security verification of multi-version protocols in charging devices as described in claim 1, characterized in that, In the control effect determination unit, the information related to the action includes the action to be performed, the type of safety action, the state transition, the direction of charging and discharging, the allowable power and current range, and the energy or amount limit; the information related to the transaction includes the transaction object, the scope of authorization, and whether the billing or transaction status has changed.

8. The method for dual-parsing semantic security verification of multi-version protocols in charging devices as described in claim 1, characterized in that, The system determines whether two control effects are equivalent based on three types of conditions: First) Discrete items such as equipment, connector, transaction object, authorization scope, state transition, charging / discharging direction, and billing status change must be the same. Among them, the transaction object is the transaction state entity associated with the transaction identifier. Second) After all control restrictions are converted into a unified unit and scale, the same actual control boundary must be formed; Third) Evidence of freshness must correspond to the same connection event and the same transaction generation; Measurement values ​​used only for display and not involved in control or settlement shall use a preset error, but the preset error shall not change start / stop, direction, state transition, authorization, transaction object or security restrictions; If multiple shadow resolvers exist, the target control effect must be equivalent to each valid shadow control effect.

9. A method for dual-parsing semantic security verification of multi-version protocols in charging devices as described in claim 1, characterized in that, The system will not grant normal execution qualification if any of the following occurs: the expected control effect is not equivalent, the key semantics required for execution are missing, the required parser fails or is uncertain, the applicability of the target protocol fails verification, the parser security requirements or the minimum security requirements of the device are not met, or the binding fails during the transaction. For actions including starting, restoring output, increasing power or current, switching to discharge, relaxing restrictions, and changing settlement status, the system will maintain or enter a safe state that does not allow for increased energy output and will require re-authentication, renegotiation, or manual handling.

10. A multi-version protocol dual-parse semantic security verification system for charging devices, characterized in that, It has communication interfaces and control execution interfaces, including one or more processors; A storage device for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors cause the one or more processors to perform the charging device multi-version protocol dual-parse semantic security verification method according to claim 1.

Images