The electric mobility charging infrastructure sector (EVI) is growing exponentially, with hundreds of thousands of new EV chargers connecting to critical energy infrastructure globally. In parallel, new heat pumps, renewables, batteries, and other distributed energy resources (DERs) are being added.
Why EV charging infrastructure is a very particular energy asset
EVI differs from other new energy assets in several ways. It is:
- located in many different places (residential, commercial, public);
- made up of different types of low-power and high-power chargers (DC fast chargers, extreme fast chargers, and megawatt charging systems);
- a source of significant new load (it can be several times the pre-EVI demand at a single location);
- characterized by volatile demand profiles;
- increasingly predictable over time through pattern recognition;
- able to support the grid via storage and vehicle-to-grid (V2G) options.
Because of these particularities, EVI provides several interesting functionalities and capabilities to the electric power system — e.g. grid management, load balancing (EV infrastructure communicates with the grid and helps prevent congestion), support for renewables (using green electrons in times of overproduction), virtual power plants, storage, and more.
A growing attack surface
With the rise of EVI, increased interoperability with the energy infrastructure (e.g. the distribution grid control room) is a must, especially for high-power charging, and an increasing dependency on digital technologies is obvious. This will increase vulnerability and open new pathways for malicious actors to attack critical energy and transportation infrastructure.
Some of EVI’s vulnerabilities to digital attacks are caused by the complexity of the hardware and software components that make up the EVI ecosystem: EVs and their batteries, charging and car apps, EV chargers, metering equipment, communication equipment, charging control systems, switches, controllers, clouds, grid connections and integration, network management systems, and more.
EVI security is therefore a significant challenge. Most of these components are exposed to an ever-evolving list of attacks such as malware and ransomware, insider threats, spoofing, tampering, supply chain vulnerabilities, and more. This can have severe consequences for businesses, customers, and infrastructure: service disruptions, financial loss, data and privacy breaches, safety risks, grid instability, damaged hardware and more.
What the research shows
Recent research suggests that the industry has an incomplete understanding of the threat vectors, the attack surface, connections, and unsecured interfaces in EVI, and significant knowledge gaps concerning these risks. The research even identified weaknesses and security concerns in the communication-focused ISO 15118 EV-to-charger interface standard and in the underlying public key cryptography and public key infrastructure (PKI) components. It also finds that data security is not comprehensive. To make things worse, the cryptography deployed today is not quantum-safe and cannot be replaced easily (limited crypto-agility).[1]
How to protect EV charging infrastructure
In addition to known security concepts such as encryption, access control, and IoT-oriented concepts, zero-trust-based secure system approaches following the NIST guidelines should also be evaluated.[2] These are device-oriented approaches that add further layers of security for the devices and the data they generate. Data needs full protection both at rest and while being processed — and this is exactly where current approaches for EVI fail.
References
[1] Cybersecurity for Electric Vehicle Charging Infrastructure, prepared for the US Department of Energy, July 2022. https://www.osti.gov/servlets/purl/1877784
[2] Julian Durand, Zero Trust Architecture: The Unapologetic Approach To Cybersecurity In A Digital Jungle, Forbes Technology Council, September 2023. https://www.forbes.com/sites/forbestechcouncil/2023/09/14/zero-trust-architecture-the-unapologetic-approach-to-cybersecurity-in-a-digital-jungle/