DE102025131317A1 - Method for tamper-proof allocation of electrical energy consumption - Google Patents

Abstract

A method for allocating electrical energy consumption of at least two electrical consumers (14, 16, 18) supplied by at least two electrical energy sources (20, 22) comprises the following steps:
Assigning at least one first consumer (14, 16) to a first energy source (22), wherein the consumers not assigned to the first energy source (20) are second consumers (18);
Measuring and storing, using a smart meter (24, 121, 122, 123, 124, 130), as a consumption value, for each consumer (14, 16, 18) over a selectable period,
how much electrical energy from which of the electrical energy sources (20, 22) flowed into the consumer (14, 16, 18);
Rearranging the consumption values such that the consumption value of energy supplied to the second consumers (18) from the first energy source (22) is subtracted from a consumption value of the first consumers (14, 16) related to a further energy source (20) and added to the consumption value of the first consumers (14, 16) related to the first energy source (22), and the consumption value of the second consumers (18) related to the first energy source (22) is reduced and the consumption value of the second consumers (18) related to the second energy source (20) is increased accordingly. A system for allocating electrical energy consumption comprises a building distribution network (12, 112) to which at least two electrical consumers (14, 16, 18) and at least two electrical energy sources (20, 22) are connected; energy metering devices (24, 121-130) in the form of smart meters assigned to the consumers and energy sources, and a processing unit; the system is set up to perform the steps of one of the preceding procedures.

Description

The present invention relates to a method for allocating electrical energy consumption from at least two electrical consumers which are supplied from at least two electrical energy sources.

In multi-unit buildings, it's possible that a renewable energy generation system installed on a particular building, such as a photovoltaic system, is not financed by all residents. To achieve a fair distribution of the electricity generated by the photovoltaic system and the associated revenue in such buildings, various approaches are possible.

For example, all electricity generated by the photovoltaic system can be fed directly into a public grid, with the resulting revenue being shared among the parties involved in the financing. However, this has the disadvantage that only the comparatively low feed-in tariff is received.

It is also possible to install a second internal distribution network to which the photovoltaic system and only those households that contributed to the financing are connected. This results in immediate savings on electricity bills for the connected households, as they receive electricity directly from the photovoltaic system they co-financed, instead of from the public grid.

When a photovoltaic system is connected to a building's electrical distribution network, to which all residents are connected, electricity from the system is also consumed by residents who did not contribute to the financing. These residents therefore benefit without sharing in the costs and risks.

These known approaches are either inefficient, unfair, or structurally complex.

With the increasing prevalence of decentralized energy generation systems, such as photovoltaic systems, and the widespread use of smart meters in multi-family buildings, complex in-house distribution networks are emerging. While this development offers advantages in terms of energy efficiency and self-sufficiency, the decentralized arrangement of numerous metering points and energy sources presents new challenges regarding tamper protection. Distributing smart meters across various, sometimes freely accessible, areas of a building multiplies the physical points of attack for unauthorized access. Furthermore, the necessary communication between the individual devices and the energy sources requires security measures that are often insufficient in conventional systems. This makes it difficult to maintain a complete and reliable energy balance for the entire building network and makes it challenging for operators to reliably detect tampering or electricity theft, as traditional monitoring methods designed for a single, central transfer point reach their limits.

Against this background, the task arises to further develop a method for allocating electrical energy consumption of at least two electrical consumers supplied by at least two electrical energy sources in such a way that, with the simplest possible modifications, a fair allocation of the consumed energy between consumers and sources is achieved as efficiently as possible, and, if possible, protection or resistance against manipulation is achieved.

To solve the problem, a method with the features of claim 1 is proposed.

This method has the advantage that no significant modifications to the house distribution network are necessary, and yet it enables the allocation of consumed electrical energy according to ownership.

Advantageous embodiments are the subject of the dependent claims.

A method for allocating the electrical energy consumption of at least two electrical consumers supplied by at least two electrical energy sources comprises the following steps: Assigning at least one first consumer to a first energy source, wherein the consumers not assigned to the first energy source are second consumers; measuring and storing as a consumption value, for each consumer over a selectable period, how much electrical energy from which of the electrical energy sources has flowed into the consumer; rearranging the consumption values such that the consumption value of energy supplied to the second consumers from the first energy source is subtracted from a consumption value of the first consumers related to a further energy source and added to the consumption value of the first consumers related to the first energy source. The consumption value of the second consumer is reduced to the same extent in relation to the first energy source, and the consumption value of the second consumer is increased in relation to the second energy source.

This method allows electrical energy generated by the first energy source and consumed by appliances connected to the building's electrical system to be attributed to the first consumers, to the extent possible. The second consumers are supplied with energy from the first energy source, and the amount of energy they receive from the first energy source is recorded as their consumption. If the first consumers later need to be supplied from the second energy source, for example, because the first energy source cannot provide electricity without sunlight, then the energy drawn is allocated to the second consumers, and a corresponding amount of energy from the first energy source is transferred to the first consumers. Thus, the consumption of the second consumers acts as a virtual battery for the first consumers.

In some embodiments of the method, one of the smart meters is selected as a hub for data storage and/or coordination of the operation of the smart meters.

This has the advantage that centralizing data collection and coordination reduces the complexity of the overall system and increases its robustness. Data management is simplified, and a defined point of contact is created for all network-internal operations.

In other embodiments, the hub creates a redundant data backup of the consumption values stored in it, distributed across other smart meters.

This ensures extremely high reliability for billing-relevant data. Even in the event of a total failure of the smart meter acting as a hub, no data is lost, as it can be fully reconstructed from the fragments stored in the other devices, thus eliminating a single point of failure for data integrity.

In some embodiments, the method for detecting malfunctions and/or tampering may include the steps of: sending a presence signal (heartbeat) by at least one of the smart meters; receiving the presence signal by another smart meter; and detecting the absence of the presence signal.

This creates a self-monitoring system that enables proactive and timely detection of unauthorized removals, deactivations, or technical failures of individual devices, thus significantly increasing the tamper resistance of the entire network.

In some embodiments, a notification is generated when the number of missing presence signals exceeds a definable limit within a definable period.

This has the advantage of allowing a distinction to be made between transient, short-term network disturbances and a persistent, serious device failure. This minimizes false alarms and, if necessary, enables automatic maintenance or replacement of the potentially defective device, thus ensuring the long-term reliability of the system.

In advantageous embodiments, the consumption values of the second consumers are anonymously summarized as a total consumption value, whereby the total consumption value is checked using the consumption values recorded by the smart meters not assigned to the second consumers.

This ensures that the data protection requirements of consumers not participating in the system are met, while simultaneously creating an inherent control mechanism. Comparing the total consumption with external reference values enables the effective detection of manipulations such as electricity theft and guarantees the integrity of the overall energy balance.

The procedure may further include a process step in which the recorded consumption data are chained using a blockchain method, whereby the chaining results in a cryptographic hash value dependent on all the data chained therein, as well as a process step in which this hash value is transmitted to an external instance at determinable intervals.

This ensures the highest level of data integrity and immutability. Cryptographic chaining and external anchoring of the hash value create a tamper-proof and fully traceable audit trail for all billing-relevant data.

In further embodiments, the method can include the following steps: creating high-resolution load profiles for at least one of the Consumers; comparing load profiles with predefined behavioral patterns indicative of manipulation and, if there is a match, marking the load profile as suspicious; checking whether there is a legitimate, non-manipulative explanation for the load profile marked as suspicious, and confirming the marking as suspicious if no legitimate explanation exists.

This multi-stage analysis process enables the precise identification of complex manipulation attempts that would not be detectable through pure consumption measurement, and minimizes the rate of false alarms by checking for legitimate causes, thus significantly increasing the efficiency of monitoring.

In some embodiments, the first consumers are assigned to a first energy source based on renewable energy.

Such energy sources are only controllable to a very limited extent and are therefore particularly well suited for the application of the process.

In some embodiments, a public power grid is used as an additional energy source.

The public electricity grid is usually continuously available, so the additional energy source can supply electricity even when the first energy source is unavailable. This improves the reliability of the household's electrical supply.

In some versions, an electricity bill is generated from the unordered consumption data.

This ensures a fair distribution of the costs for electrical energy.

The problem is also solved by a system for allocating electrical energy consumption, comprising a home distribution network to which at least two electrical consumers and at least two electrical energy sources are connected, energy measuring devices in the form of smart meters assigned to the consumers and energy sources, and a processing device, wherein the system is adapted to perform the steps of one of the preceding methods according to one of the preceding claims.

Such a system has the advantage that not only the abstract process but also the physical device used to execute it is protected. This enables the development of an integrated and optimized overall solution in which hardware and software components are precisely coordinated to ensure the reliable and efficient allocation of energy consumption.

In some embodiments, the system is designed to increase tamper resistance such that the smart meters and the processing unit are configured to periodically exchange cryptographically secured presence signals (heartbeats) and to detect the absence of these signals. Additionally or alternatively, the processing unit can be configured to store the recorded consumption data in a cryptographically linked data structure, with at least one of the smart meters acting as a gateway to transmit a cryptographic hash value, dependent on the data structure, to an external instance.

Such a system offers multi-layered protection against tampering. The exchange of presence signals enables active, real-time monitoring of device integrity, while storing the data in a cryptographically linked and externally anchored structure ensures passive, but immutable, protection of historical data integrity. The combination of these two mechanisms creates a particularly robust and trustworthy overall system.

The task is further solved by an energy consumption allocation system with energy measuring devices and means adapted to perform the steps of one of the preceding procedures. Such an energy consumption allocation system includes energy measuring devices and means adapted to perform the steps of the aforementioned procedure.

Such an energy consumption allocation system can easily be retrofitted in existing buildings without requiring major renovations.

In some embodiments, the energy consumption control system includes a communication infrastructure for communication between at least the energy measuring devices and the processing device.

This allows the energy measuring devices of the processing unit to report, in particular, the amount of energy flowing through them. Furthermore, based on the measured energy quantities transmitted to the processing unit, the consumed electrical energy can be allocated according to its energy source. to be carried out in a particularly simple way for consumers.

The problem is further solved by a computer program according to claim 7, which includes commands that cause the described device to perform the described process steps.

A computer-readable medium on which the computer program is stored can also solve the task.

• 1 eine schematische Darstellung einer Ausführungsform eines Hausverteilnetzes, das zur Durchführung des erfindungsgemäßen Verfahrens eingerichtet ist;
• 2 eine schematische Darstellung einer Ausführungsform eines weiteren Hausverteilnetzes, das zur Durchführung des erfindungsgemäßen Verfahrens eingerichtet ist;
• 3 eine schematische Darstellung einer Energiemesseinrichtung in Form eines Smartmeter gemäß einer Ausführungsform der Erfindung und
• 4 eine schematische Darstellung einer Energiemesseinrichtung in Form eines Smartmeter mit drahtloser Kommunikationseinrichtung gemäß einer Ausführungsform der Erfindung.

Further embodiments and advantages of the invention are readily apparent to the person skilled in the art. Some of these are described below with reference to the accompanying figures. Specifically, they show:

• 1 a schematic representation of an embodiment of a house distribution network that is set up to carry out the method according to the invention;
• 2 a schematic representation of an embodiment of a further house distribution network, which is set up to carry out the method according to the invention;
• 3 a schematic representation of an energy measuring device in the form of a smart meter according to an embodiment of the invention and
• 4 a schematic representation of an energy measuring device in the form of a smart meter with wireless communication device according to an embodiment of the invention.

The figures contain simplified schematic representations. In some cases, the same reference symbols are used for similar, but not necessarily identical, elements. Different views of the same elements may have different scans. Directional terms such as "left," "right," "up," and "down" are to be understood relative to the respective figure and may indicate different directions relative to an object, depending on the representation and the figure itself.

Furthermore, elements are not necessarily shown in their correct relative sizes, particularly for the sake of simplification and to clearly illustrate their functional relationships. Where procedural steps or elements are named with enumerations, for example "first", "second", "third", or "further", these enumerations, unless explicitly stated otherwise, serve only to distinguish the individual elements and do not necessarily establish an order or hierarchy.

The in 1 The building 10 shown has a building distribution network 12 to which the first consumers 14, 16 and a second consumer 18 are connected. The building distribution network 12 is connected to a first energy source in the form of a photovoltaic system 22 located on the roof. A public electricity grid connection 20 is provided as a second energy source, which is also connected to the building distribution network 12.

Consumers 14, 16, 18 and energy sources 20, 22 are each connected to the building's distribution network 12 via an energy metering device, in this case a smart meter 24. Each smart meter 24 measures the electrical power flowing through it, or, integrated over time, the electrical energy flowing through it. In some embodiments, the smart meters 24 can be configured to communicate with each other and/or with a central processing unit (gateway). In some embodiments, the central processing unit can be integrated with one of the smart meters 24, for example, with the smart meter 24 that is connected to the public power grid connection 20.

Using the smart meter 24, it is possible to allocate the electrical energy supplied by sources 20, 22 to the consumption of consumers 14, 16, 18.

The first consumers, 14 and 16, participate in the financing of the photovoltaic system 22; they are, for example, members of an electricity distribution model and thus assigned to the first energy source 22. The allocation of the supplied electrical energy to consumption occurs during operation as follows: the electrical power fed into the system by the photovoltaic system 22 is first allocated to the consumption of the first consumers, 14 and 16. In a second step, it is determined whether the electrical power fed into the system by the photovoltaic system 22 fully covers the consumption of the first consumers, 14 and 16. If this is exactly the case, then the entire power drawn from the public grid connection 20 is allocated to the second consumer, 18. If the photovoltaic system 22 feeds in more electrical power than the first consumers, 14 and 16, consume, then this additional electrical power is initially allocated to the second consumer, 18. If the second consumer, 18, requires more power than is allocated to it, the additional power needed is drawn from the public grid connection 20. If the photovoltaic system 22 feeds in less electrical power than the first consumers 14, 16 consume, then the first consumers 14, 16 will receive a proportionate share of the missing power, and the second consumer 18 will receive the full amount. Power from the public electricity grid connection 20 is allocated.

Power consumption is measured using Smartmeter 24 devices. By integrating the data over time, the electrical energy consumed is calculated from the assigned power output. For this purpose, the Smartmeter 24 devices and/or the central processing unit have storage locations where they store numerical values representing the electrical energy consumed, both for the individual consumption and for the sources from which that consumption was supplied.

For example, after one month, the consumption data for consumer 14 might show that they consumed 50 kWh from the first source (22) and 100 kWh from the second source (20). Similarly, after one month, the consumption data for consumer 18 might show that they consumed 80 kWh from the first source (22) and 200 kWh from the second source (20).

In a rearrangement step, the consumption values are rearranged so that the consumption value of energy supplied to the second consumers from the first energy source is subtracted from a consumption value of the first consumers based on a further energy source and added to the consumption value of the first consumers based on the first energy source, and in the same proportion the consumption value of the second consumers based on the first energy source is reduced, and the consumption value of the second consumers based on the second energy source is increased.

In the example above, this means that the 80 kWh that the second consumer (18) drew from the first source (22) are subtracted from the 100 kWh consumed by the first consumer (14) from the second source (20), so that the consumption from the second source (20) for the first consumer (14) is only 100 kWh - 80 kWh = 20 kWh. Instead, the 80 kWh consumed are added to the consumption of the first consumer (14) from the first source (22), resulting in a consumption of 130 kWh for that consumer. The same 80 kWh are then subtracted from the consumption of the second consumer (18) from the first source (22), since this amount is now allocated to the first consumer (14), thus reducing the consumption for the second consumer (18) to 0 kWh. Conversely, the 80 kWh that were subtracted from the consumption value from the second source 20 for the first consumer 14 are now added to the consumption value from the second source 20 for the second consumer 18.

As a result, the first consumer is allocated 14,130 kWh from the first source 22 and 20 kWh from the second source 20, and the second consumer is allocated 18,280 kWh from the second source 20 and 0 kWh from the first source 22.

The second consumer 18, who does not participate in the electricity distribution model, therefore did not benefit from the photovoltaic system 22. However, his consumption served as a virtual storage, since the photovoltaic system 22 initially covered his electricity demand, but this demand was later allocated to the first consumer 14, to whom this electricity would actually have been due but who could not take it at that time, as compensation for electricity later drawn from the public electricity grid 20.

Consumers 14, 16, 18 can, for example, be individual consumers or residential electrical networks. In some cases, a consumer 14, 16, 18 can, for example, represent a tenant.

The energy consumption allocation system can, for example, include a communication infrastructure for communication between at least the energy metering devices 24 and the processing unit. The communication infrastructure can be based on a single standard or on a combination of different standards. For example, there are embodiments in which the energy metering devices and/or the processing unit each include at least one communication device, wherein the communication device is configured according to at least one of the following standards: ZigBee, any standard of the 802.11 family, Bluetooth, IrDA, Powerline (e.g., ITU G.hn or IEEE 1901), any mobile communication standard (e.g., GSM, UMTS, LTE, 5G), or ripple control.

In some embodiments, one of which is exemplified in 2 As shown, consumers are connected to a house network 112 via energy metering devices in the form of smart meters 122, 123, and 124. Energy metering devices in the form of smart meters 121 and 130 connect the house network 112, as shown previously, via smart meter 121 to a first energy source 22 (not shown for clarity) and via smart meter 130 to a second energy source in the form of the public electricity grid connection 20. Smart meter 130 has one processing direction.

Each of the smart meters 121, 122, 123, 124 transmits measured power in the form of digital power data to the processing unit of smart meter 130 at regular intervals via the communication infrastructure. The processing unit receives the power data and stores it, for example, as accumulated consumption data and/or in the form of a log. In particular, the consumption data records how much energy flowed through each of the smart meters 122, 123, 124 connected to consumers, energy that was fed into the building network 112 via the smart meters 121, 130 connected to energy sources.

The smart meters 121, 122, 123, 124, and 130 record the individual consumption of each party and the feed-in of energy sources. They are equipped with high-precision sensors that record electricity consumption and generation in real time. This consumption data is recorded, for example, with a resolution of milliseconds to enable accurate measurement and analysis of load profiles created based on the consumption data.

In some embodiments, the communication infrastructure has a common gateway that enables, for example, communication between the smart meters 121, 122, 123, 124, 130 and a remote billing server.

A 24-hour smart meter, as used, for example, in the 3 and 4 As shown, in some embodiments a power measuring device 26 for precise detection of the flowing electrical energy and a processing device 28 for processing, storing and communicating the measurement data may be included.

To ensure secure and reliable cooperation between the smart meters 24 and, if available, with a central processing unit, for example within the home network 12, 112, each smart meter 24 can be equipped with special versions of one or more communication devices 30, 32.

Each smart meter 24, 121, 122, 123, 124, 130 can be equipped with a dedicated communication device configured for confidential and authentic communication with other smart meters 24, 121, 122, 123, 124, 130 within the home network. This communication device can be a wired communication device 30, for example, for communication via power lines (Powerline Communication, PLC), and/or a wireless communication device 32, based on standards such as UMTS, LTE, WLAN, or ZigBee. The wireless communication device 32 can also be configured to connect to an external communication partner, such as an external server, particularly a billing server. For this purpose, it can also support communication using multiple standards. Different communication devices 32 of different smart meters 24, 121, 122, 123, 124, 130 can have differently designed communication devices 32.

The communication devices 30, 32 of the various smart meters 24, 121, 122, 123, 124, 130 can be configured to form an ad-hoc network, in particular a mesh network. If direct communication between two smart meters 24, 121, 122, 123, 124, 130 is not possible, for example due to excessive distance or structural obstacles, one or more intermediate smart meters 24, 121, 122, 123, 124, 130 can act as relay stations (repeaters). In this case, they securely forward the message packets to ensure a continuous communication connection throughout the entire home network 12. This relay function thus enables the establishment of a robust and fail-safe communication network.

To ensure confidential communication, all data exchanged between the smart meters, especially measurement data and control commands, is encrypted. For this purpose, smart meters 24, 121, 122, 123, 124, and 130 can have a training mode. In this mode, the smart meters 24, 121, 122, 123, 124, and 130 can be securely integrated into a home network 12 for the first time. This is achieved, for example, through a secure exchange of cryptographic keys or by implementing a key agreement protocol, such as the Diffie-Hellman method or variants thereof based on elliptic curves (ECDH).

A special version of the training mode allows an additional, new smart meter to be added after the initial secure integration of at least two smart meters into the network. This new smart meter is then trained using only a single, already authorized smart meter. The already integrated device acts as a trust anchor, providing the new device with the necessary cryptographic information to communicate securely with all other devices in the network.

Examples of encryption methods that allow such integration include asymmetric cryptography or group key management.

If asymmetric cryptography is used, an already integrated smart meter 24, 121, 122, 123, 124, 130 can sign a public certificate of the new smart meter 24, 121, 122, 123, 124, 130 with its own private key. This signature serves as authentication for the other network participants and enables the newly added smart meter 24, 121, 122, 123, 124, 130 to communicate with all other smart meters 24, 121, 122, 123, 124, 130 in the home network 12.

When using a group key management system, an authorized, already integrated smart meter 24, 121, 122, 123, 124, 130 can communicate the currently valid symmetric key used for group communication to the new smart meter 24, 121, 122, 123, 124, 130 via a secure, point-to-point encrypted channel, possibly also using asymmetric methods.

The secure exchange of measurement data between the smart meters 24, 121, 122, 123, 124, 130 is relevant for the confidential transmission of the measurement data and the authenticity of the transmitted data.

Within the previously described secure communication network, which can be formed by smart meters 24, 121, 122, 123, 124, 130, a hub architecture is implemented to centralize data acquisition and increase system robustness. In such configurations, one of the smart meters 24, 121, 122, 123, 124, 130 in the home network 12 assumes the function of a central hub. This hub serves as the primary collection point for all measurement data acquired by the other smart meters in the network.

The main tasks of the hub include: receiving and storing the encrypted measurement data transmitted by the other smart meters; temporarily storing data to ensure complete data collection even in the event of temporary communication disruptions; and providing the collected data to a higher authority, or to one of the smart meters 24, 121, 122, 123, 124, 130, which has an external communication device.

This hub functionality can be assigned in one of two ways, for example: statically or dynamically.

In some embodiments, the role of the hub is statically assigned to a specific smart meter 24, 121, 122, 123, 124, 130. This assignment may be determined by its hardware configuration. For example, a smart meter with significantly larger internal memory than the other devices is particularly suitable for the role of the hub, as it can temporarily store larger amounts of measurement data over longer periods. It is not essential that the hub itself has an extended processing unit (28) or a dedicated external communication unit, since its primary function is data aggregation.

The hub is configured to collect measurement data retrospectively. Should another smart meter (24, 121, 122, 123, 124, 130) temporarily lose connection to the hub or experience poor connection quality (e.g., high latency, packet loss), this smart meter (24, 121, 122, 123, 124, 130) stores its measurement data locally. As soon as the communication connection is restored or of sufficient quality, it transmits the temporarily stored data to the hub. This "store-and-forward" mechanism ensures that no measurement data is lost.

In further embodiments, the central hub can be dynamically determined by the smart meters themselves. This allows the home network 12 to self-organize and react flexibly to changes, such as the failure of a smart meter 24, 121, 122, 123, 124, or 130. The hub is selected by an automated voting process that identifies the most suitable smart meter. Possible criteria for suitability as a hub include, for example, the quality, speed, and reliability of the communication links to the other smart meters 24, 121, 122, 123, 124, and 130 in the network.

• In einem ersten Verfahrensschritt: Initiierung der Hub-Wahl. Der erste Schritt wird beispielsweise in folgenden Situationen durchgeführt: Bei der erstmaligen Inbetriebnahme des gesamten Hausnetzes 12; wenn der aktuell aktive Hub für eine vordefinierte Zeitspanne nicht mehr erreichbar ist (Ausfallerkennung) oder periodisch, um sicherzustellen, dass stets das aufgrund der aktuellen Gegebenheiten als optimal ermittelte Gerät als Hub fungiert.

Such an election procedure can be implemented as follows:

• The first step in the process is initiating the hub selection. This first step is performed, for example, in the following situations: during the initial commissioning of the entire home network 12; when the currently active hub is unreachable for a predefined period (failure detection); or periodically to ensure that the device determined to be optimal based on the current circumstances always functions as the hub.

In a second step of the process: determination of connectivity metrics. Each smart meter 24, 121, 122, 123, 124, 130 in the network measures the quality of its connection to all other reachable smart meters 24, 121, 122, 123, 124, 130. Typical metrics for this can include: Latency (Round-Trip Time): The time a small data packet needs to travel to the neighbor and back; Signal strength (e.g., RSSI in wireless communication): An indicator of the strength of the physical connection; or packet loss rate: The percentage of sent packets that were not successfully received.

In a third process step, each smart meter 24, 121, 122, 123, 124, 130 then sends a list of its measured connectivity metrics to all other reachable smart meters 24, 121, 122, 123, 124, 130 in the network (broadcast).

In a fourth step of the process, a suitability score is calculated: Each smart meter (e.g., 24, 121, 122, 123, 124, 130) receives the connectivity metrics of the other devices. Based on this information, each smart meter calculates a suitability score for itself and for every other smart meter. One possible algorithm for this is to calculate the average connection value to all other devices. For example, the suitability score of a candidate hub could be defined as the reciprocal of the average latency to all other nodes. A higher value would correspond to better suitability.

In a fifth step of the process: Selection and notification: Each smart meter identifies the candidate with the highest suitability score. It "selects" this candidate by sending its identifier (e.g., the serial number) to all other smart meters in the network.

In a sixth process step: Confirmation and role transfer: The smart meter that receives the most (ideally all) votes becomes the new hub. It confirms its new role by sending a message to the entire network. All other smart meters confirm receipt of this message and from then on send their measurement data to the newly selected hub. If a previous hub is still active, it transfers its cached data to the new hub in a further process step and assumes the role of a normal smart meter.

• Durch das dynamische Wahlverfahren ist das System hochgradig ausfallsicher. Fällt der amtierende Hub aus, wählt das Netzwerk automatisch einen neuen Hub aus den verbleibenden funktionstüchtigen Geräten. Der Betrieb des Systems zur Verbrauchszuordnung wird dadurch nur minimal oder gar nicht unterbrochen.

This hub architecture offers crucial advantages for the reliability and security of the overall system:

• Thanks to the dynamic selection process, the system is highly reliable. If the current hub fails, the network automatically selects a new hub from the remaining functioning devices. This results in minimal or no interruption to the operation of the consumption allocation system.

The hub also acts as a temporary buffer for the measurement data of the entire network. This ensures that no billing-relevant data is lost, even in the event of brief outages of the external communication link or during maintenance work on the central processing unit. Data integrity and confidentiality are maintained at all times through end-to-end encryption of the communication.

To further enhance data security and system reliability, and to prevent the loss of measurement data aggregated in the hub even in the event of a complete failure of the smart meter 24, 121, 122, 123, 124, 130 acting as the hub, a distributed, redundant data backup procedure is implemented. This procedure ensures that all data or datasets collected in the hub can be reconstructed at any time from backups distributed across other smart meters 24, 121, 122, 123, 124, 130 in the network.

The process is based on the fact that the hub does not store the entire dataset as a monolithic block, but rather transforms it into a format that allows for decentralized recovery. Instead of sending complete copies to individual devices, which would be inefficient and place high storage demands on the receiving devices, an erasure coding method is used.

• In einem ersten Verfahrensschritt: Datenaufteilung und Kodierung: Die gesamten gespeicherten Daten, insbesondere Messdaten von m Smartmetern (einschließlich seiner eigenen), werden in m Datenblöcke aufgeteilt. Unter Anwendung eines Fehlerschutz-Kodierungsverfahrens, wie beispielsweise eines Reed-Solomon-Codes oder eines vergleichbaren Algorithmus, werden aus diesen m ursprünglichen Datenblöcken n kodierte Datenblöcke erzeugt, wobei n > m ist. Die Eigenschaft dieses Verfahrens ist, dass der ursprüngliche Datensatz aus einer beliebigen Teilmenge von k der n kodierten Blöcke rekonstruiert werden kann, wobei k = m ist. Die n-m zusätzlichen Blöcke stellen die Redundanz dar.

In such embodiments, the smart meter, acting as a hub, performs the following steps periodically or after receiving a certain amount of new data:

• In the first step of the process: data splitting and encoding: All stored data, in particular measurement data from m smart meters (including its own), is split into m data blocks. Using an error-protection encoding method, such as a Reed-Solomon code or a comparable algorithm, n coded data blocks are generated from these m original data blocks, where n > m. The property of this method is that the original data set can be reconstructed from any subset of k of the n coded blocks, where k = m. The nm additional blocks represent redundancy.

In a second process step: Distribution of the coded data blocks: The hub distributes the The system generates n coded data blocks and sends them to n different smart meters 24, 121, 122, 123, 124, 130 in the network, ideally transmitting exactly one of these blocks to each participating smart meter 24, 121, 122, 123, 124, 130 (including itself) for storage. Each smart meter 24, 121, 122, 123, 124, 130 thus stores only a small part of the total information, a so-called backup copy in the form of a coded data block.

• In einem dritten Verfahrensschritt: Anforderung der Datenfragmente: Der neu gewählte Hub sendet eine Anforderungsnachricht an alle erreichbaren Smartmeter im Netzwerk und fordert diese auf, den bei ihnen gespeicherten, kodierten Datenblock zu übermitteln.

Should the current hub fail, a new hub will be selected from the remaining functioning smart meters 24, 121, 122, 123, 124, and 130 using an election procedure, as described previously. This new hub will then initiate the reconstruction process.

• In a third process step: Requesting the data fragments: The newly selected hub sends a request message to all reachable smart meters in the network, asking them to transmit the encoded data block stored on them.

In a fourth step of the process: Collecting the fragments: The new hub collects the responses from the functioning smart meters 24, 121, 122, 123, 124, 130. The process is successful as long as at least k of the originally n encoded data blocks can be received. The system thus tolerates the simultaneous failure of up to n-k smart meters 24, 121, 122, 123, 124, 130, in addition to the failure of the original hub.

In a fifth step of the process: Reconstruction of the complete dataset: Once the new hub has received the required minimum number of k encoded data blocks, it applies the corresponding decoding algorithm of the error-protection encoding method. This algorithm reconstructs the exact, complete, and original dataset, consisting of the m original data blocks, from the incomplete subset of blocks.

In a sixth step of the process: Taking over the hub function: After successful reconstruction, the new hub has the complete, uninterrupted dataset and can seamlessly continue its function as a central collection point. It then begins periodically generating and distributing new coded data blocks to ensure data integrity for the future.

This method ensures extremely high reliability, as there is no single point of failure for the stored data. Billing-relevant information is retained even in the event of multiple device failures and can be reliably restored, significantly increasing the integrity and reliability of the entire consumption allocation system.

To transmit the measurement data collected in the home network and aggregated in the central hub to an external server, such as a billing server of the energy supplier, one of the smart meters can be additionally equipped with an external radio communication device 34. This smart meter thus acts as a gateway for the entire home network 12. The external radio communication device 34 is designed, for example, for communication via a public mobile network (e.g., GSM, UMTS, LTE, 5G).

In some embodiments, the hub functionality and the gateway functionality are integrated into the same smart meter 24, 121, 122, 123, 124, 130. In this case, the gateway smart meter 24, 121, 122, 123, 124, 130 collects the data from the other smart meters 24, 121, 122, 123, 124, 130 and transmits the aggregated data set, for example, to an external server. Alternatively, the hub and gateway can also be implemented on separate smart meters 24, 121, 122, 123, 124, 130. In this case, the smart meter 24, 121, 122, 123, 124, 130 acting as a hub would forward the collected data set via the internal home network to the smart meter 24, 121, 122, 123, 124, 130 acting as a gateway for external transmission.

In some embodiments, the selection of the smart meter that assumes the gateway function can be made, for example, to ensure an optimal and reliable communication connection between smart meters 24, 121, 122, 123, 124, and 130. In some embodiments, the gateway functionality can be implemented, for example, in the smart meter 24, 121, 122, 123, 124, or 130 that is assigned to the photovoltaic system 22. This smart meter is typically installed on or near the roof of building 10. This has the technical advantage that this exposed installation location generally has good mobile network coverage, unlike smart meters 24, 121, 122, 123, 124, and 130 that are installed, for example, in basements where reception can be severely impaired. This maximizes the reliability and data rate of external communication and minimizes the probability of transmission errors or failures.

In a further embodiment, the system can be configured such that several smart meters 24, 121, 122, 123, 124, 130 are equipped with an external radio communication device 34 to create redundancy. Should the primary If gateway smart meters 24, 121, 122, 123, 124, or 130 fail or their external connection is interrupted, the central hub (or another authorized device on the network) can detect this and automatically select a secondary, functioning gateway smart meter 24, 121, 122, 123, 124, or 130 to take over data transmission. This increases the overall reliability of the system for data transmission to the external server.

To further increase the tamper resistance of the overall system and to detect device failures at an early stage, a decentralized monitoring method can be implemented in some embodiments. This method is based on the regular exchange of presence signals, hereinafter referred to as heartbeats, between the smart meters 24, 121, 122, 123, 124, 130 within the secure home network 12.

A heartbeat is a small, cryptographically secured data packet that is sent by each smart meter (24, 121, 122, 123, 124, 130) to other participants in the network at periodic, adjustable intervals. The primary technical task of the procedure described below is the continuous monitoring of the reachability and operational readiness of each smart meter (24, 121, 122, 123, 124, 130) in order to immediately detect unauthorized removals, deactivations, or other forms of manipulation.

• In einigen Ausführungsformen erfolgt eine zentralisierte Überwachung: In dieser Ausführungsform ist der zentrale Hub dafür verantwortlich, die Heartbeat-Signale von allen anderen Smartmetern 24, 121, 122, 123, 124, 130 im Hausnetz 12 zu empfangen und zu überwachen.

The verification of heartbeats can be implemented in various ways:

• In some embodiments, centralized monitoring takes place: In this embodiment, the central hub is responsible for receiving and monitoring the heartbeat signals from all other smart meters 24, 121, 122, 123, 124, 130 in the home network 12.

In some embodiments, decentralized monitoring takes place: In an alternative and particularly robust embodiment, the smart meters 24, 121, 122, 123, 124, 130 monitor each other. This can be achieved by forming changing pairs or small groups of smart meters 24, 121, 122, 123, 124, 130, each of which verifies the connection quality and reachability with each other by exchanging heartbeats. This ensures that the monitoring function in the network is maintained even if the central hub fails.

• In einem ersten Verfahrensschritt: Aussenden des Präsenzsignals (Heartbeat): Jedes Smartmeter 24, 121, 122, 123, 124, 130 sendet zyklisch in einem vorkonfigurierten, einstellbaren Intervall (z.B. alle 60 Sekunden) ein Heartbeat-Signal aus. Dieses Signal enthält beispielsweise eine eindeutige Kennung des Senders und einen Zeitstempel und ist mit dem privaten Schlüssel des Senders digital signiert, um dessen Authentizität zu gewährleisten und eine Fälschung (Spoofing) durch unautorisierte Geräte zu verhindern.
• In einem zweiten Verfahrensschritt: Empfang und Überprüfung: Das für die Überwachung zuständige Gerät (entweder der zentrale Hub oder ein zugewiesener Peer) empfängt die Heartbeat-Signale der zu überwachenden Smartmeter 24, 121, 122, 123, 124, 130. Bei jedem Empfang wird die digitale Signatur verifiziert und der Zeitstempel auf Plausibilität geprüft.

The procedure for manipulation detection can be implemented, for example, through one or more of the following steps:

• In the first step of the process: transmitting the presence signal (heartbeat): Each smart meter 24, 121, 122, 123, 124, 130 cyclically transmits a heartbeat signal at a pre-configured, adjustable interval (e.g., every 60 seconds). This signal contains, for example, a unique identifier of the sender and a timestamp and is digitally signed with the sender's private key to guarantee its authenticity and prevent spoofing by unauthorized devices.
• In a second process step: Reception and verification: The device responsible for monitoring (either the central hub or an assigned peer) receives the heartbeat signals from the smart meters to be monitored: 24, 121, 122, 123, 124, 130. With each reception, the digital signature is verified and the timestamp is checked for plausibility.

In a third step of the process, an error is detected if the signal is absent: If the expected heartbeat signal from a smart meter 24, 121, 122, 123, 124, or 130 fails to occur, this is detected and/or registered by the monitoring entity (smart meter or hub). To distinguish transient network disturbances from an actual failure, an error is only declared after a definable number of consecutive heartbeats (e.g., three) have been missed.

In a fourth process step: Consolidation and marking as potentially manipulated: If the monitoring instance (or, in the decentralized case, several instances agreeing) determines that a specific smart meter 24, 121, 122, 123, 124, 130 is no longer reachable beyond the defined tolerance threshold, this smart meter 24, 121, 122, 123, 124, 130 is marked as "potentially manipulated" or "failed." This information, along with a timestamp of the event, is immediately disseminated within the network 12 and securely stored in the central hub or, if it fails, in the newly selected hub. A sudden, isolated failure of a single smart meter 24, 121, 122, 123, 124, 130, while all others can communicate with each other, is a strong indicator of targeted manipulation (e.g., power cut to the meter, physical removal).

In a fifth step of the process: Procedure upon reconnection: If a smart meter (24, 121, 122, 123, 124, 130) previously marked as "potentially manipulated" reconnects to the network, special security measures are triggered. The data stored locally by this smart meter during its absence, which is now to be transmitted, is then processed. Meter readings are not immediately accepted as trustworthy. They undergo extended verification. This may include comparing the transmitted consumption values with historical data or the patterns of neighboring, trusted smart meters (24, 121, 122, 123, 124, 130) for plausibility and anomalies.

In a sixth procedural step: Replacement in case of repeated failures: If a smart meter (24, 121, 122, 123, 124, 130), the central hub, or the external server registers a high failure rate for a specific smart meter (24, 121, 122, 123, 124, 130), for example, if the number of missing presence signals exceeds a definable threshold within a defined period, this indicates a potentially defective device. If a predefined threshold of failure events is exceeded within a specific period, the system can automatically send a notification to the external server (e.g., the energy provider's server). This notification can trigger an order to replace the potentially defective smart meter (24, 121, 122, 123, 124, 130) to ensure the long-term stability and reliability of the network.

This process creates a self-monitoring and self-healing system that proactively detects manipulations and failures and ensures continuous, trustworthy data collection.

In further advantageous embodiments of the method, the data protection requirements of consumers who are not involved in financing the first energy source 22, for example, the photovoltaic system, and who are referred to as second consumers 18, are taken into account. To avoid requiring these second consumers 18 to transmit continuous or high-resolution consumption data to the energy consumption allocation system, their total energy consumption can be determined indirectly and anonymously using a differential balancing method. This method can simultaneously serve as an effective means of detecting manipulation.

• Erster Verfahrensschritt: Erfassung der Gesamtenergieeinspeisung: Die Smartmeter, die den Energiequellen 20, 22 zugeordnet sind, messen kontinuierlich die gesamte elektrische Energie, die in das Hausverteilnetz 12 eingespeist wird. Dies umfasst die von der ersten Energiequelle 22 erzeugte Energie sowie die aus der weiteren Energiequelle, dem öffentlichen Stromnetzanschluss 20, bezogene Energie. Die Summe dieser beiden Werte ergibt die im Hausverteilnetz 12 zur Verfügung stehende Gesamtenergie.

The procedure for the anonymized determination of the consumption of the second consumer 18 comprises the following steps, which are preferably carried out by the central hub:

• First process step: Recording the total energy feed-in: The smart meters, assigned to energy sources 20 and 22, continuously measure the total electrical energy fed into the building's distribution network 12. This includes the energy generated by the first energy source 22 as well as the energy drawn from the second energy source, the public grid connection 20. The sum of these two values yields the total energy available in the building's distribution network 12.

In a second step of the process: recording the consumption of the first consumers 14, 16: In parallel, the smart meters 24, 121, 122, 123, 124, 130, which are assigned to the first consumers 14, 16, measure their individual energy consumption. These consumption values are summed to determine the total consumption of all first consumers 14, 16 actively participating in the system.

In a third step of the process: Calculation of the anonymized total consumption: The central hub calculates the difference between the total energy feed-in determined in step 1 and the total consumption of the first consumers determined in step 2. The result of this subtraction corresponds exactly to the aggregated total consumption of all second consumers.

In a fourth step of the process: Storage of the anonymized value: This calculated, aggregated value is stored as an anonymized total consumption value for the group of second consumers 18, for example, in the hub. It is ensured that at no time is a breakdown of this value to individual second consumers 18 performed or required.

• In einem ersten Verfahrensschritt: Bereitstellung eines externen Referenzwertes: Für einen definierten Abrechnungszeitraum wird ein externer, vertrauenswürdiger Referenzwert bereitgestellt. Dieser Wert ist beispielsweise der offiziell abgerechnete und anonym zusammengefasste Gesamtenergieverbrauch aller zweiten Verbraucher 18, wie er beispielsweise von deren externem Abrechnungsdienstleister oder Energieversorger zur Verfügung gestellt wird.

To verify the integrity of the system and detect manipulations, such as unmetered electricity consumption, the anonymized total consumption value is subjected to a plausibility check at a later time. The procedure used for this may include one or more of the following steps:

• In a first procedural step: Provision of an external reference value: For a defined billing period, an external, trusted reference value is provided. This value is, for example, the officially billed and anonymously aggregated total energy consumption of all second consumers 18, as provided, for example, by their external billing service provider or energy supplier.

In a second step of the process: reconciliation of consumption values: The central hub or the external billing server performs a reconciliation. It compares the anonymized consumption data calculated for the billing period according to the previously described procedure. Total consumption value of the second consumer 18 with the externally provided reference value.

In a third step of the process: detection of deviations: If the two values do not match within a predefined, minor tolerance threshold, a significant deviation is detected. Such a deviation can be a strong indicator of an anomaly in the system.

In a fourth procedural step: Triggering a security response: The detection of a significant deviation can, for example, trigger a security response, such as an alarm or marking the data record for manual review. The deviation indicates that either there is manipulation in the building distribution network 12 (e.g., illegal electricity consumption that is recorded in the differential balancing but does not appear in the official billing of the second consumer 18) or a technical defect in one of the smart meters 24, 121, 122, 123, 124, 130.

This two-stage process not only enables the data protection-compliant integration of all parties, but also creates an additional, system-inherent control instance to ensure the correctness of the billing and to detect fraud attempts.

To proactively identify manipulations of meters or the building distribution network (12) and to detect electricity fraud, a further procedure is implemented that is based on the detailed analysis of load profiles. This procedure goes beyond the mere measurement of energy quantities by considering the dynamic consumption behavior of individual consumers 14, 16, 18 over time.

• Zunächst ein Detektormodell in einer ersten Stufe zur Identifikation aller potenziell verdächtigen oder abnormalen Verhaltensweisen mit einer hohen Erkennungsrate.

The procedure is preferably designed as a two-stage process that can be executed by a central instance, for example the smart meter acting as a hub or the external server, using different models for detecting and classifying irregularities:

• First, a detector model in a first stage to identify all potentially suspicious or abnormal behaviors with a high detection rate.

Following this, a false positive model is used in a second stage to filter the results of the first stage, in which legitimate, non-manipulative explanations for the previously classified as suspicious behavior are sought in order to minimize the rate of false alarms.

In a first step of the process, high-resolution load profiles are created: Each smart meter (24, 121, 122, 123, 124, 130) records the energy consumption of its assigned consumer not only as a cumulative value, but also creates a high-resolution load profile. This profile is a time series that depicts the power consumption at short, regular intervals (e.g., every minute or every 15 minutes).

In a second process step, detector behavior patterns are defined: The system has, for example, a library of predefined, abnormal behavior patterns ("detectors") that indicate known manipulation methods or suspicious anomalies. These patterns can, for example, be derived from a reference database containing historical, confirmed cases of manipulation and fraud. Examples of such detector behavior patterns include: Unusually stable consumption, where the load profile shows a nearly constant power draw over an extended period (e.g., several hours or days) without the usual, natural fluctuations caused by switching devices on and off. This could indicate a manipulating device that limits the measured consumption to a fixed value.

A sudden, significant drop to a persistently low level can also indicate manipulation. The load profile will show an abrupt, sharp decline in consumption, which then remains at an implausibly low level. This could indicate the activation of an illegal meter bypass.

Similarly, a lack of increase in consumption despite an expected increase can be suspicious. The load profile of an individual consumer is compared with the aggregated load profile of the entire building distribution network. If the overall profile shows an expected increase (e.g., due to a cold snap in winter or a heat wave in summer), but the individual profile does not, even though there is no legitimate explanation, this is suspicious.

Even a very low overall consumption can indicate such an irregularity. For example, if the median consumption over a longer period is significantly below a statistical threshold (e.g., below the 10th percentile of all consumers in the system), this could point to persistent partial manipulation.

In a third process step, the system systematically applies the defined detector behavior patterns to the generated load profiles of all consumers 14, 16, 18. If a match is found, If a discrepancy is found between a load profile and a detector behavior pattern, this load profile is marked as "suspicious" and passed to the next stage for further analysis.

• Der Verbraucher ist ein bekannter Erzeuger von Solarstrom (zugeordnet der Photovoltaikanlage 22), was niedrige oder negative Verbräuche während des Tages erklärt; für den betreffenden Zeitraum ist eine längere Abwesenheit des Verbrauchers (z.B. Urlaub) im System hinterlegt; es wurde ein signifikanter Gerätetausch gemeldet (z.B. der Austausch einer elektrischen Heizung gegen eine Wärmepumpe); es liegt eine bekannte technische Störung oder eine geplante Abschaltung vor.

In a fourth step, the false-positive model is applied to eliminate legitimate causes. For each load profile flagged as suspicious, the system checks whether there is a legitimate, non-manipulative explanation for the observed behavior. This involves accessing a database of contextual information. Examples of legitimate explanations include:

• The consumer is a known producer of solar power (assigned to photovoltaic system 22), which explains low or negative consumption during the day; a longer absence of the consumer (e.g., vacation) is recorded in the system for the relevant period; a significant equipment exchange has been reported (e.g., the replacement of an electric heater with a heat pump); there is a known technical fault or a planned shutdown.

If the suspicious behavior can be explained beyond doubt by such a stored fact, the marker will be removed.

In a fifth step, the remaining unexplained cases are flagged, and a notification is triggered for review. Load profiles identified as suspicious in step 3 and not explained by a legitimate cause in step 4 are classified as "suspicious." These cases are flagged for further investigation, and an automatic notification can be sent to the system operator or an external server to initiate a manual review or on-site inspection.

This multi-stage analysis method enables precise and efficient detection of manipulations by analyzing not only the pure consumption but also the characteristic behavior behind it, reliably distinguishing legitimate from genuinely suspicious patterns.

To ensure the highest possible level of tamper-proof security, traceability, and immutability of the recorded measurement and transaction data, some embodiments may implement a method that organizes the data in a cryptographically linked data structure, hereinafter referred to as a blockchain. In this embodiment, the blockchain is authoritatively managed by the central hub, which acts as a trusted authority within the home network 12.

The basic principle is that all relevant data, especially the raw measurement data, the results of the rearrangement step and the results of manipulation detection, are not stored in a conventional, easily modifiable database, but in chronologically ordered and cryptographically sealed blocks.

In the first step of the process: collecting and verifying transactions: The central hub collects all relevant data events that occur in the network. Each of these events is considered a "transaction." Examples of transactions include: a new set of measurement data from a smart meter; the result of a reordering step of consumption values; or the detection of an anomaly through load profile analysis or the heartbeat method.

Each transaction is validated by the hub before being recorded, for example by verifying the digital signature of the issuing smart meter 24, 121, 122, 123, 124, 130.

In a second step, a new block is created. After a predefined period or once a certain number of transactions have been collected, the central hub combines the verified transactions into a new block. In addition to the transaction data, this block contains, for example, a timestamp and a cryptographic hash value of the immediately preceding block in the chain. This chaining is the central security feature of the blockchain, as any subsequent modification of an earlier block would inevitably change the hash value of that block and, consequently, the hash values of all subsequent blocks.

In a third step, the block is signed and sealed. The central hub calculates the cryptographic hash value of the newly created block. It then signs this hash value (or the entire block) with its own securely stored private key. This digital signature serves as an authoritative seal, confirming that the block has been recognized as valid by the hub and added to the chain. A decentralized consensus or mining process is not required in this implementation, as the hub is granted sole write access to the blockchain.

In a fourth step of the process: Appending the block to the chain: After signing, the new block is permanently appended to the end of the blockchain stored locally in the hub. The calculated hash value of this new block is to the reference value for the next block to be created.

In an (optional) fifth step of the process: Decentralized replication of the blockchain: To increase fault tolerance, the hub can forward the newly created and signed blocks to other smart meters 24, 121, 122, 123, 124, 130 in the network for storage. These devices thus hold a read-only copy (replica) of the authoritative blockchain. In the event of a hub failure, a newly chosen hub can access these replicas to restore the last valid state of the chain by verifying the integrity of the hash chain and the signatures of the original hub.

In a sixth step of the process: Regular reporting of the chain status to an external server. To enable external, higher-level verification of the integrity of the blockchain managed by the hub, the central hub (or the gateway smart meter 24, 121, 122, 123, 124, 130) periodically reports the cryptographic hash value of the most recently added block ("top hash") to an external, trusted server (e.g., the settlement server). This server stores a chronological list of the received top hashes.

• • Unveränderbarkeit: Durch die kryptographische Verkettung ist es praktisch unmöglich, eine einmal in der Blockchain gespeicherte Transaktion unbemerkt zu ändern oder zu löschen. Jeder Manipulationsversuch würde die Hash-Kette brechen und wäre sofort detektierbar.
• • Autoritative Datenintegrität: Die alleinige Signaturhoheit des Hubs stellt sicher, dass nur von ihm verifizierte Daten in die offizielle Historie aufgenommen werden, was die Effizienz erhöht und komplexe Konsensmechanismen überflüssig macht.
• • Externe Verankerung: Die regelmäßige Meldung des Top-Hashes an einen externen Server fungiert als „Anker“. Sollte der Hub kompromittiert werden und versuchen, eine manipulierte Blockchain-Version zu erstellen, würde der neu generierte Top-Hash nicht mit der vom externen Server protokollierten Historie übereinstimmen. Dies würde den Manipulationsversuch sofort aufdecken.

Advantages and safety aspects:

• • Immutability: Due to cryptographic chaining, it is virtually impossible to alter or delete a transaction once stored in the blockchain without detection. Any attempt at manipulation would break the hash chain and be immediately detectable.
• • Authoritative data integrity: The hub's sole signature authority ensures that only data verified by it is included in the official history, increasing efficiency and eliminating the need for complex consensus mechanisms.
• • External anchoring: Regularly reporting the top hash to an external server acts as an "anchor." Should the hub be compromised and an attempt be made to create a manipulated blockchain version, the newly generated top hash would not match the history logged by the external server. This would immediately reveal the manipulation attempt.

This process transforms the data storage system into a highly secure, tamper-resistant and authoritatively managed ledger that ensures the integrity of all accounting-relevant data throughout the entire lifecycle of the system.

The virtual battery thus created solves the problem of unused energy generation capacities and enables a fairer and more efficient use of self-generated electricity.

• Zuordnen wenigstens eines ersten Verbrauchers 14, 16 zu einer ersten Energiequelle 22, wobei die nicht der ersten Energiequelle 20 zugeordneten Verbraucher zweite Verbraucher 18 sind;

A method for allocating electrical energy consumption of at least two electrical consumers 14, 16, 18, which are supplied from at least two electrical energy sources 20, 22, may comprise the following steps:

• Assigning at least one first consumer 14, 16 to a first energy source 22, wherein the consumers not assigned to the first energy source 20 are second consumers 18;

Measuring and storing as a consumption value, for each consumer 14, 16, 18 over a selectable period, how much electrical energy from which of the electrical energy sources 20, 22 has flowed into the consumer 14, 16, 18; rearranging the consumption values so that the consumption value of energy that flowed to the second consumers 18 from the first energy source 22 is subtracted from a consumption value of the first consumers 14, 16 related to a further energy source 20 and added to the consumption value of the first consumers 14, 16 related to the first energy source 22 and in the same proportion the consumption value of the second consumers 18 related to the first energy source 22 is reduced, as well as the consumption value of the second consumers 18 related to the second energy source 20 is increased.

In some embodiments, such a method is characterized in that the first consumers 14, 16 are assigned to a first energy source 22 based on renewable energies.

In some embodiments, such a method is characterized in that a public electricity grid is used as a further energy source 20.

In some embodiments, such a method is characterized in that an electricity bill is created from the rearranged consumption values.

An energy consumption allocation system comprising energy measuring devices 24, 121, 122, 123, 124, 130 and means adapted to perform the steps of one of the preceding procedures.

In some embodiments, the energy consumption allocation system is characterized by a communication infrastructure for communication between at least the energy measuring devices 24, 121, 122, 123, 124, 130 and a processing device.

Reference sign

10

Building

12

Home distribution network

14

first consumer

16

first consumers

18

second consumer

20

public electricity grid connection (second energy source)

22

Photovoltaic system (first energy source)

24

Smart meter

26

Power measuring device

28

Processing facility

30

Wired communication device

32

Wireless communication device

112

Home distribution network

120

public electricity grid connection (second energy source)

121

Smart meter

122

Smart meter

123

Smart meter

124

Smart meter

130

Smart meter with processing unit

Claims (10)

Method for allocating the electrical energy consumption of at least two electrical consumers (14, 16, 18) supplied by at least two electrical energy sources (20, 22), comprising the steps of: Assigning at least one first consumer (14, 16) to a first energy source (22), wherein the consumers not assigned to the first energy source (20) are second consumers (18); Measuring and storing, using a smart meter (24, 121, 122, 123, 124, 130), as a consumption value, for each consumer (14, 16, 18) over a selectable period, how much electrical energy from which of the electrical energy sources (20, 22) flowed into the consumer (14, 16, 18); Rearrange the consumption values so that the consumption value of energy supplied to the second consumers (18) from the first energy source (22) is subtracted from a consumption value of the first consumers (14, 16) based on a further energy source (20) and added to the consumption value of the first consumers (14, 16) based on the first energy source (22), and in the same proportion the consumption value of the second consumers (18) based on the first energy source (22) is reduced, and the consumption value of the second consumers (18) based on the second energy source (20) is increased. Procedure according to Claim 1 , characterized by one or more process steps in which one of the smart meters (24, 121, 122, 123, 124, 130) is selected as a hub for data storage and/or coordination of the operation of the smart meters (24, 121, 122, 123, 124, 130). Procedure according to Claim 2 , characterized by one or more process steps in which the hub of consumption values stored in it creates a redundant data backup distributed to other smart meters (24, 121, 122, 123, 124, 130). Method according to one of the preceding claims, characterized by the following steps for detecting malfunctions and/or manipulations: Emitting a presence signal (heartbeat) by at least one of the smart meters (24, 121, 122, 123, 124, 130); Receiving the presence signal by another smart meter (24, 121, 122, 123, 124, 130); Detecting the absence of the presence signal. Procedure according to Claim 4 , characterized by the step: If a number of missing presence signals exceeds a definable limit within a definable period, a notification is generated. Method according to one of the preceding claims, characterized in that the consumption values of the second consumers (18) are recorded anonymously summarized as a total consumption value, wherein the total consumption value is checked using the consumption values recorded by the smart meters (24, 121, 122, 123, 124, 130) not assigned to the second consumers (18). Method according to one of the preceding claims, characterized by a method step in which the recorded consumption data are chained using a blockchain method, wherein the chaining is a cryptographic key dependent on all data chained therein. a hash value is obtained and a process step in which this hash value is transmitted to an external instance at definable intervals. A method according to one of the preceding claims, characterized by the following further steps: creating high-resolution load profiles for at least one of the consumers (14, 16, 18); comparing the load profiles with predefined behavioral patterns indicating manipulation and, in the event of a match, marking the load profile as suspicious; checking whether there is a legitimate, non-manipulative explanation for the load profile marked as suspicious, and confirming the marking as suspicious if no legitimate explanation exists. System for allocating electrical energy consumption, comprising: a building distribution network (12, 112) to which at least two electrical consumers (14, 16, 18) and at least two electrical energy sources (20, 22) are connected; energy metering devices (24, 121-130) in the form of smart meters assigned to the consumers and energy sources, and a processing device; wherein the system is configured to perform the steps of a procedure according to one of the Claims 1 until 8 executes. System according to Claim 9 , characterized in that , to increase tamper resistance: the smart meters (24, 121-130) and the processing unit are configured to periodically exchange cryptographically secured presence signals (heartbeats), wherein the processing unit is configured to recognize the absence of these signals as an indicator of tampering or failure, and/or the processing unit is configured to store the recorded consumption data in a cryptographically linked data structure, and at least one of the smart meters is configured as a gateway (34) to transmit a data structure-dependent cryptographic hash value to an external instance.