ELECTRIC VEHICLE SECURITY What's holding back electric vehicle charging security?

Related Vendors

Rogers Corporation

Schunk Sonosystems GmbH

ROHM Semiconductor GmbH

EA Elektro-Automatik GmbH & Co. KG

AMETEK Programmable Power

more less

PINK GmbH Thermosysteme

Maschinenfabrik Reinhausen GmbH

ICT SUEDWERK GmbH

Infineon Technologies AG

Littelfuse Europe GmbH

DEWETRON GmbH

onsemi

less

While security is front of mind when it comes to connected and autonomous vehicles, little consideration is given to security the risks associated with electric vehicle (EV) charging stations. Research demonstrates that EV charging stations can be a conduit for DDoS attacks, ransomware, theft of ID, and could jeopardize the security of the power grid.

Electric cars are an essential part of a low-carbon future. In 2020, battery electric vehicles (BEV) and Plug-in Hybrid (PHEV) vehicle adoption increased significantly. Up to the end of November 2020, the total volume was above 2,544,000 (up 32% year-over-year), with an average market share of 3.8% (2.6% BEVs, 1.2% PHEVs).
Following the growth of electric vehicles (EVs) is increased health in associated markets like electric vehicle charging systems. There are already over a million public electric vehicle charging plugs globally, and the demand shows no sign of abating. But while the security of electric vehicles receives plenty of attention, the issue of securing electric vehicle charging stations is less prevalent. This is even though EV chargers face numerous security threats that could have serious consequences.

BATTERY CHARGING

Charger Topologies of Today and Tomorrow

What are the security risks of securing EV chargers?

Like any connected device, EV chargers, when poorly secured, face a plethora of cyber threats. Attack sites can include EV charging system hardware and software, apps for locating charging stations and paying for services, and wireless communication links.
Cybercriminals can use unprotected physical communication links, and app vulnerabilities to deliver DDoS attacks, ransomware, and trojan viruses. They can also steal personal and financial data.
In 2018, research by Positive Technologies detected three vulnerabilities in the Schneider Electric EVlink Parking electric vehicle charging station. Hackers could use these to deliver a denial-of-service attack to stop the charging process by switching the device to the reservation mode, which would render it inaccessible to any customer until reservation mode is turned off. They could also unlock the cable during the charging by manipulating the socket locking hatch, meaning attackers could walk away with the cable. Schneider Electric has since released firmware regularly to eliminate security vulnerabilities.

In November last year, engineers at Southwest Research Institute (SwRI) were able to interfere with the charging of an electric vehicle by simulating a malicious attack as part of an automotive cybersecurity research initiative.
The SwRI team reverse-engineered the signals and circuits on an EV and a J1772 charger, the most common interface for managing EV charging in North America. They successfully disrupted vehicle charging with a spoofing device developed in a laboratory using low-cost hardware and software.
“This was an initiative designed to identify potential threats in common charging hardware as we prepare for widespread adoption of electric vehicles in the coming decade,” said Austin Dodson, the SwRI engineer who led the research.
SwRI performed three manipulations: limiting the rate of charging, blocking battery charging, and overcharging. A SwRI-developed “man-in-the-middle” (MITM) device spoofed signals between charger and vehicle. Researchers also drained the battery and generated signals to simulate J1772 charging rates.
“The project effectively tricked the test vehicle into thinking it was fully charged and also blocked it from taking a full charge,” Dodson said. “This type of malicious attack can cause more disruption at scale.” SwRI is evaluating future testing of Level 3 chargers and penetration of other devices used on fleet vehicles and electric scooters.

Could electric vehicles threaten the security of the grid?

Since an infected EV can communicate with its connected charging station, there is the risk that malware can spread from this point to a network of other vehicles and the electric grid at large. Yury Dvorkin, an assistant professor of electrical and computer engineering at the NYU Tandon School of Engineering, recently researched the threat of electric vehicles and cyber attacks on urban power grids.
Electric vehicle charging stations represent a link between plug-in electric vehicles and the power grid — a high-wattage access point that hackers can potentially exploit to manipulate the grid. Each vehicle that uses a public charging station generates data on its location and charging time, along with information on the average hourly power draw at each station. Information on the power usage is critical for a malicious actor who wishes to manipulate demand at a particular charging station. This information is easily accessible, as it is transmitted wirelessly by third-party apps that cater to electric vehicle owners. While much information is not made public, the research team demonstrated that a combination of public documents and resources available through industry standards-setting organizations and from utilities’ public releases may be tapped to construct power grid topology and model the system components.

E Mobility

Bosch to offer more than 150,000 recharging points for electric cars throughout Europe

Together, these elements allow an attacker to use charging stations as portals to remotely manipulate electric vehicle charging and the power grid by causing instabilities that could range from barely noticeable to significantly disruptive.
Yury’s analysis showed that it is a credible scenario for multiple charging EVs to be hacked simultaneously, disrupting grid operations or even a blackout by targeting the frequency stability of the grid:
“In simulations using publicly available information about charging station usage in Manhattan and the structure of the island’s power grid, our research team found that a fleet of just roughly 1,000 simultaneously charging electric vehicles would be adequate for mounting a [serious] attack...”

EV CHARGING

High-pressure heat exchanger ensures shorter charging times for electric vehicles

Security standards are a logistical nightmare

Currently, there is no agreed-upon cybersecurity protocol to protect data generated by electric vehicle charging. Collaboration is needed between vehicle and power station component manufacturers, utility companies, and third-party service providers. They need to agree upon a unified set of cybersecurity protocols and issue guidelines to encourage electric vehicle owners to maintain strong passwords change them regularly.
A 2020 symposium on research standards for EV charging security found a lack of coordination among the sectors involved (automotive, energy, and financial). Each sector had little understanding of each other’s concerns and approaches to cybersecurity. This complicates the development of cybersecurity models for EV charging since it is difficult to establish a reasonable cybersecurity response or even agree upon a forum of discussion to develop such a response without a common understanding of risks and concerns.

BATTERY ELECTRODE

New Li-ion battery electrode charges EVs in just 6 minutes

Fortunately, progress is coming

Earlier this year, - SAE International announced a contract with a team comprised of specialists from Eonti, DigiCert, and VerSprite to begin technical work on the SAE Electric Vehicle Charging Public Key Infrastructure (PKI) project. They aim to develop a secure EV charging industry PKI platform that is agnostic to the charging system and protocol standards, resulting in strong end-to-end cybersecurity between the electric vehicle (EV) and the rest of the charging ecosystem. A range of companies has been involved in the project, including ABB, ChargePoint, Ford Motor Company, General Motors, and Shell. The project aims to design and test the PKI solution within 18-24 months.

(ID:47303068)