With the steady rising Electric Vehicle (EV) adoption world-wide, a consideration of the Electric Vehicle (EV) charging-related load on power grids is becoming critically important. While strategies to manage this load (e.g., to avoid peaks) exist, they assume that Electric Vehicles (EVs) and charging infrastructure are trustworthy. If this assumption is, however, violated (e.g., by an adversary with control over Electric Vehicle (EV) charging systems), the threat of charging load-based attacks on grid stability arises. An adversary may, for example, try to cause overload situations, by means of a simultaneous increase in charging load coordinated over a large number of EVs. In this paper, we propose an Intrusion Detection System (IDS) that combines regression-based charging load prediction with novelty detection-based anomaly identification. The proposed system considers features from both the Electric Vehicle (EV) charging and power grid domains, which is enabled in this paper by a novel co-simulation concept. We evaluate our Intrusion Detection System (IDS) concept with simulated attacks in real Electric Vehicle (EV) charging data. The results show that the combination of support vector regression with isolation forest-based novelty detection generally provides the best results. Additionally, the evaluation shows that our Intrusion Detection System (IDS) concept, combining grid and charging features, is capable of detecting novel/stealthy attack strategies not covered by related work.

Electric Vehicle (EV) charging involves a complex system with cyber-physical components, backend systems, and communication protocols. A potential security incident in this system can open up cyber-physical threats and, for instance, lead to EV battery fires or power grid blackouts. In this paper, we propose a hybrid Intrusion Detection System (IDS) method consisting of regression-based charging session forecasting and anomaly detection. The method considers an EV’s detailed charging behavior throughout a session and we discuss and evaluate different design choices. For anomaly detection, we consider both classification- and novelty-based models as well as an ensemble method to combine both models. We perform evaluations based on real-world EV charging session data with simulated attacks. Our results show that regression-based forecasting provides a significant increase in detection performance for attacks affecting individual reports during a charging session. Additionally, the proposed ensemble method, which combines artificial neural network-based classification and local outlier factor-based novelty detection, can maintain a low false alarm rate while offering good detection performance w.r.t. known attacks as well as generalization to previously unseen attacks. We thus argue that the proposed solution can provide a positive contribution to EV charging security, resilience, and trustworthiness.

The increasing use of information and communication technology in power grids and connected e-mobility infrastructures enables cyber attacks. E-mobility infrastructure components such as Charge Points (CPs) or Electric Vehicles (EVs) could be used as attack vector on power grids via False Data Injection (FDI) or Manipulation of demand (Mad) attacks. To detect such attacks, Intrusion Detection Systems (IDSs) which are adapted to the specifics of e-mobility are required. In this paper, we propose a novel hybrid IDS for detecting e-mobility-based attacks on the power grid consisting of a rule-based IDS and an anomaly detection component using regression-based forecasting. The IDS is distributed among different e-mobility-related backend systems, namely Charge Point Operators (CPOs) and grid operators. We implemented our IDS and evaluate it on several data sets while simulating realistic attack scenarios to show the effectiveness of our approach. Our evaluation compares different IDS design choices and regression models. Especially, decision tree regression proved to be an effective base for detection at CPOs. By combining the distributed IDS reports of individual CPOs at the grid operator, the overall detection performance is further improved. The distributed nature of the system allows it to identify large-scale attacks effectively and thus robustly detect realistic threats to power grid operation.

The Electric Vehicle (EV) charging architecture consists of several actors which communicate with different protocols. A serious issue is the lack of adequate privacy-preserving measures that enables the generation of movement profiles or inferring consumer habits by all of the involved actors. In this paper, we propose an extension of a Trusted Platform Module (TPM)-based Direct Anonymous Attestation (DAA) scheme to enable privacy-preserving charging authorization and billing. Our implementation shows that our solution can be easily integrated into existing protocols of the Plug-and-Charge (PnC) EV charging architecture and introduces only minor overhead. The formal analysis using the Tamarin prover shows the security and privacy of our protocol extension.

Automotive Ethernet is increasingly used in modern vehicles and complements or replaces legacy bus systems such as CAN. Ethernet also enables service-oriented communication with the Scalable service-Oriented MiddlewarE over IP (SOME/IP) middleware. In this paper, we present a formal and practical security analysis of Scalable service-Oriented MiddlewarE over IP (SOME/IP), the identified Man-in-the-Middle (MITM) attacks, and propose two security extensions. The attacks are possible even if SOME/IP is used in combination with link layer security mechanisms. The attacker can impersonate a service offering server and a service consuming client. The two most common communication methods, request/response and publish/subscribe, are both vulnerable. In most communication scenarios, we are able to route all messages over the attacker. Our security extensions for authentication and authorization of service provisioning and usage protect against these attacks. We formally analyze the security and evaluate the overhead with practical implementations.

Plug-and-Charge (PnC) standards such as ISO 15118 enable Electric Vehicle (EV) authentication against Charge Points (CPs) without driver intervention. Credentials are stored in the vehicle itself making methods using RFID cards obsolete. However, credentials are generated in service provider backend systems and provisioned via the Internet and not in a secure Hardware Security Module (HSM) within the vehicle. In this paper, we propose HIP, a backwards compatible protocol extension for ISO 15118 where keys are generated and stored in a Trusted Platform Module (TPM) within the vehicle. Our implementation and evaluation show that our solution is feasible and is a viable option for future editions of ISO 15118.