PaperlayerView exact revision on arXiv

Source-linked AI summary

Electric Vehicle Attack Impact on Power Grid Operation

Mohammad Ali Sayed, Ribal Atallah, Chadi Assi, Mourad Debbabi

arXiv:2111.11317v1eess.SYcs.SY

TL;DR

As EV use is promoted to reduce transportation emissions, its charging ecosystem presents a grid-security concern. The paper surveys EV vulnerabilities and attack scenarios, and simulations find EV loads can be more damaging to grid operation than residential loads.

  • Problem

    The promotion of EVs to reduce transportation emissions makes understanding the grid-security implications of their charging ecosystem important.

    Source: §1 · pp. 1–2

  • Method

    The paper surveys EV charging vulnerabilities, demonstrates attack scenarios, and discusses grid-condition monitoring and EV-charging-station-based detection.

    Source: §1 · p. 2, §5.2 · p. 25

  • Results

    Simulations found that EV loads can be more damaging to grid operation than residential loads.

    Source: §6 · p. 27

  • Takeaways & Limitations

    The EV ecosystem can be targeted to create a botnet of high-wattage, high-VAR load, motivating patches and attack-detection approaches.

    Source: §5.2 · p. 25, §6 · p. 27

    The prior work discussed here relied on a DC power-flow model, which ignores reactive power flow and other grid behavior.

    Source: §2.3 · p. 6

Abstract

from arXiv · show

The increasing need for reducing greenhouse gas emissions and the drive for green cities have promoted the use of electric vehicles due to their environmental benefits. In fact, countries have set their own targets and are offering incentives for people to purchase EVs as opposed to traditional gasoline-powered cars. Manufacturers have been hastily deploying charging stations to meet the charging requirements of the EVs on the road. This rapid deployment has contributed to the EV ecosystem's lack of proper security measures, raising multiple questions related to the power grid security and vulnerability. In this paper, we offer a complete examination of the EV ecosystem from the vulnerability to the attacks and finally the solutions. We start by examining the existing vulnerabilities in the EV ecosystem that can be exploited to control the EV charging and launch attacks against the power grid. We then discuss the non-linear nature of the EV charging load and simulate multiple attacks that can be launched against the power grid using these EVs. EV loads have high reactive power demand which can have a larger impact on the grid compared to residential loads. We perform simulations on two power grids and demonstrate that while the grid can recover after a 48 MW attack utilizing traditional residential loads, a smaller 30 MW EV load attack can completely destabilize the system. Finally, we suggest several patches for the existing vulnerabilities and discuss two methods aimed at detecting EV attacks.

1 Introduction

As EV use is promoted to reduce transportation emissions, its charging ecosystem raises power-grid security concerns. The paper surveys EV charging vulnerabilities and load behavior, develops attack scenarios, and presents mitigation and detection approaches.

1 Introduction

  • Grid automation depends on sensors and remote-controlled actuators, linking grid security to the devices and communications infrastructure.The introduction frames this dependence as a source of cyber-attack exposure.Source: §1 · p. 1
  • EV adoption is promoted to reduce transportation emissions, but improperly scheduled charging can create high peak loads and degrade grid performance.The paper frames EV charging as both an emissions-related motivation and a challenge for utilities.Source: §1 · p. 2
  • The paper surveys EV charging ecosystem vulnerabilities and demonstrates multiple power-grid attack scenarios that exploit them.It also examines how EV load profiles differ from residential loads in ways that can make attacks more disruptive.Source: §1 · p. 2
  • The paper examines EV load nonlinearity and formulates attacks that use grid conditions to maximize impact while minimizing the number of compromised EVs.Its introduction contrasts EV attacks with attacks using traditional residential and IoT loads.Source: §1 · p. 3
  • The paper proposes patches for the discussed vulnerabilities and two detection mechanisms tailored to EV attacks against the power grid.The proposed measures address vulnerabilities and detection as distinct parts of the paper's contribution.Source: §1 · p. 3

2 Background

EV adoption and charging infrastructure are expanding, but the interconnected ecosystem introduces security concerns for the grid. Prior work describes EV charging impacts and attack pathways; this paper emphasizes that EV load characteristics can make grid attacks more disruptive than comparable high-power-factor loads.

2 Background

  • EV adoption and charging infrastructure are growing amid environmental goals, incentives, and continuing concerns about charging availability and range anxiety.The passage reports 7.3 million charging stations and 7.2 million EVs on the road by the end of 2019, and 3.2 million EV sales in 2020.Source: §2 · p. 3

2.1 Electric Vehicle Ecosystem

  • EV charging stations, vehicles, management systems, user applications, and protocols form an interconnected ecosystem whose communication must be secure for reliable operation.Charging stations connect EVs to the grid, while management systems schedule sessions and send chargers control signals; protocols vary across manufacturers, countries, and operators.Source: §2.1 · pp. 4–5

2.2 EV charging Impact on the Grid

  • Prior studies report that uncontrolled or high-penetration EV charging can increase system losses, investment needs, and peak-time grid stress.A cited study found losses could rise by 30–40% at 62% EV penetration; another reported loss of load up to 6.89% under uncontrolled charging.Source: §2.2 · p. 5

2.3 EV Attacks Against Users and the Grid

  • EV charging loads can have a larger grid impact than residential or high-power-factor loads, a distinction this work uses to examine EV-enabled grid attacks.The paper contrasts its treatment of EV load properties with prior work relying on DC power flow, which ignores reactive power and other grid behavior.Source: §2.3 · p. 6

3 EV Vulnerabilities, Load Properties and Attack Strategy

The EV charging ecosystem faces weaknesses across its software, communications, physical access, and security practices. The section surveys these attack surfaces, including protocol and firmware vulnerabilities that can enable unauthorized access or manipulation of charging.

3 EV Vulnerabilities, Load Properties and Attack Strategy

  • The ecosystem lacks cybersecurity best practices, a secure communication trust model, adequate testing and monitoring, and physical protection for many commercial chargers.Operators and manufacturers may forgo security measures to achieve faster, cheaper deployment.Source: §3 · p. 6

3.1 EV Ecosystem Exploits

  • Remote, physical, local, and limited-remote exploits expose EV charging infrastructure through online services, accessible chargers, firmware, and local networks.Physical access can enable damage, electricity theft, or malware installation through USB ports; public chargers can also be blocked to cause denial of service.Source: §3.1 · p. 7

3.2.1 IEC Vulnerabilities [40] [41]

  • IEC 61850-90-8 addresses smart charging, while user authentication is outside its scope and delegated to protocols such as OCPP.IEC 61851-1 defines safety-related signaling between EVs and charging stations using Pulse-Width Modulation over the control pilot pin.Source: §3.2.1 · p. 7

3.2.2 ISO 15118 Vulnerabilities

  • ISO 15118 security measures are optional and often ignored, leaving communications in plain text; the protocol also lacks demand-response compliance.SLAC can support mutual authentication and encrypted communication, and ISO 15118 can use public key infrastructure.Source: §3.2.2 · pp. 7–8

3.3 EVCS to Management System Communication Vulnerabilities [40] [44] [45]

  • OCPP’s optional or absent security protections, plain-text communication, and replayable session messages can let attackers disrupt charging or bypass authorization.The local authorization list can allow chargers to serve customers while disconnected, but attackers may exploit it to submit charging requests without proper authentication.Source: §3.3 · p. 8

3.4 Firmware / IoT Vulnerabilities

  • EV charging-station firmware and associated services face injection, request-forgery, scripting, credential, and authentication weaknesses.XML/external-entity injection can enable remote access, while server-side request forgery can redirect traffic, cause denial of service, or expose files and logs.Source: §3.4 · p. 9

3.5 Electric Vehicle Charging Properties

EV charging is nonlinear and can impose substantial reactive-power demand, making its grid effects distinct from largely resistive residential loads. The section describes how attackers can use grid-stability analysis to identify vulnerable buses and target them with fewer compromised EVs.

3.5 Electric Vehicle Charging Properties

  • EV charging is nonlinear, can increase reactive-power demand and reduce power factor, and can introduce harmonics, voltage distortion, fluctuation, and phase imbalance.The paper assumes EV attack loads have a lagging power factor of 0.6; it contrasts this with residential loads, whose average power factor is usually considered higher than 0.8.Source: §3.5 · pp. 9–10

3.6 Smart EV Attack Vector

  • Attackers with grid knowledge can use reconnaissance and stability methods to find buses where EV-load attacks may cause larger disturbances with fewer compromised vehicles.The section identifies voltage and load monitoring, MILP programming, inverter perturbations, and machine-learning estimates from PMU measurements as reconnaissance approaches.Source: §3.6 · pp. 10–11

3.6.1 PV and QV Curves

  • PV curves track bus voltage as active load and generation increase, while QV curves track voltage as reactive-power demand changes.The PV-curve knee marks maximum extra load before voltage collapse; the QV-curve valley marks maximum reactive power that can be drawn before collapse.Source: §3.6.1 · p. 11

3.6.2 Attack Strategy

  • PV and QV sensitivity analysis identifies buses 1–4 as more sensitive to increased load than buses 5–7, with attacks on buses 6 and 7 causing smaller system variations.Attackers can also account for VAR compensators and tap-changing transformers, V2G capability, and contingencies when estimating attack requirements and impact.Source: §3.6.2 · p. 12

4 Case Study: EV Attacks Against the Power Grid

This case study examines how EV loads can be used to disturb grid demand-generation balance, including attack patterns unavailable through ordinary loads. It compares EV attacks with residential-load attacks and presents simulations, while the supplied passages do not report their outcomes.

4 Case Study: EV Attacks Against the Power Grid

  • EV charging loads can produce larger disturbances with smaller loads than ordinary residential loads, owing to their distinctive load characteristics and high reactive-power demand.The passage links nonlinear battery charging and reactive-power demand to a larger impact on voltage.Source: §4 · p. 12
  • Sudden load spikes or drops can sharply change frequency, while voltage must remain within acceptable limits and is closely connected to reactive-power flow.Persistent violations can lead operators to shed load or the grid to enter blackout.Source: §4 · p. 12
  • The case study compares EV-load attacks with traditional residential-load attacks and uses power-grid simulations to examine their impacts.The passages describe the comparison and simulation plan but do not provide the results.Source: §4 · p. 12

4.1 Attack Preparation

Attack preparation combines public charging-station information and exploitable station vulnerabilities to estimate available load and coordinate grid-disrupting EV charging or discharging. The authors note that some attack magnitudes illustrate future potential rather than current EV capability.

4.1.1 EV Locations and Load Size

  • Public EVCS maps and historical utilization data can reveal station locations, power ratings, and usage profiles for attack planning.The authors identify maps from operators, third parties, PlugShare, Chargemap, and the AFDC as possible sources.Source: §4.1.1 · pp. 12–13
  • The authors acknowledge that current EV numbers may not suffice for the intended damage, framing the load example as a future possibility.The assumed 7.2-kW charging rate is described as a restrained example; 11 kW is commercially available.Source: §4.1.1 · p. 13
  • Compromising 5% of available EVs (2.5% of all cars) could provide 19% of system load in the modeled 50%-penetration, 7.2-kW case.Across the attacks, EV load is generally 3%–6% of system load; only one case uses 19%.Source: §4.1.1 · p. 13

4.1.2 EV Botnet Command and Control

  • Exploited account and station vulnerabilities can give attackers control of charging sessions and rates, enabling synchronized mass charging or discharging through a compromised EVCS botnet.The passage lists XSS, CSV, hard-coded credentials, missing authentication, SQL injection, and XML injection among routes to user, admin, or full station control.Source: §4.1.2 · p. 14

4.2 Simulation Setup

The simulations use two established test grids, PowerWorld, and common generator and turbine control models. The authors report that attack-curve shapes remain similar across controller setups, although exact values can shift.

Simulation setup

  • Simulations use the WSCC 9-bus system and Glover 7-bus test case in PowerWorld, whose free version accommodates up to 13 buses.The grids are described as commonly used for academic research; PowerWorld supports power-flow, contingency, and transient-stability studies.Source: §4.2 · p. 14
  • The setup assumes EV charging at pf=0.6 lagging and uses IEEE T1 exciter and IEEE G2 turbine-governor models.EV V2G injection is represented as a negative fixed-MW load.Source: §4.2 · pp. 14–15
  • Across different controller setups, attack curves retain their general shapes, while exact values may differ and attack magnitudes may need slight scaling.The authors say this supports attack success under different conditions.Source: §4.2 · pp. 14–15

4.3 EV Load Manipulation Attack Scenarios

The load-manipulation scenarios use synchronized EV charging to stress transmission lines and increase demand. The simulations describe cascading line trips and frequency decline, with outcomes depending on system conditions.

Load manipulation attacks

  • A 50-MW EV load increase at bus 3 overloads the bus 1–3 line, followed by further trips and a cascade ending in blackout.After the initial trip, the bus 2–3 line overloads, followed by lines L3-4, L2-4, and L2-5.Source: §4.3 · p. 15
  • Adding 7.2 MW at each of three load buses to represent 1,000 Level 2 EVs per bus slows generators and drops grid frequency.The attack begins at t=15s; the text says that falling below a preset threshold disconnects generators, potentially leading to blackout.Source: §4.3 · p. 15
  • The demand-surge attack can be worse during peak periods with fewer reserves and when renewable-energy share is high, due to lower grid inertia.The paper notes that generator disconnection after a frequency threshold can further reduce frequency.Source: §4.3 · p. 15

4.4 EV Specific Attack Scenarios

The EV-specific scenarios exploit vehicle-to-grid discharge and alternating charging and discharge, capabilities that allow controlled injections not available from ordinary residential loads. The simulations report frequency and voltage violations, and sustained switching can impede recovery.

4.4 EV Specific Attack Scenarios

  • EVs can inject power at an attacker-controlled power factor, and the injection does not participate in generation or voltage control, increasing its grid impact.The authors describe this as a capability arising from EV reverse power flow.Source: §4.4 · p. 16

4.4.1 Controlled Vehicle to Grid Injection (V2G) Attack

  • Controlled V2G injection at bus 5 raised system frequency to 61.6 Hz and pushed bus voltages above 1.05 pu during the transient; the reported bus traces remained above 1.05 pu at steady state.The figure captions identify the frequency-rise response and voltage-limit violations at buses 4, 5, 7, and 9.Source: §4.4.1 · p. 16, Figure 3 · p. 17, Figure 4 · p. 17
  • A controlled V2G injection has greater impact than a rotating generator: the generator comparison required 51 MW to reach 61.5 Hz and caused no voltage-limit violations.The comparison used a -50 MW, -10 MVAR injection at bus 5; the regular-generator alternative produced smaller violations.Source: §4.4.1 · pp. 16–17

4.4.2 Switching Attacks

  • Alternating a 21-MW load and a negative 60-MW injection produced frequency fluctuations and limit violations; sustained switching can hinder recovery and stress turbines and transformers.The modeled sequence alternated the load at bus 6 and injection at bus 5; long-duration appliance effects are outside the paper's scope.Source: §4.4.2 · p. 18
  • A simultaneous 20% demand reduction at bus 5 amplified the switching attack, driving frequency above 62.5 Hz; frequency increases over 4% may trip generators and cause blackout, depending on protections and regulations.The normal bus 5 demand is 125 MW.Source: §4.4.2 · p. 19

4.5 Other Attack Implications

EV attacks can disrupt grid operation even when their scale is too small to cause frequency or voltage violations, by shifting dispatch and increasing operating costs. They can also stress equipment and potentially obscure transmission-line outages.

4.5 Other Attack Implications

  • Moderate demand increases can shift the grid from optimal dispatch and increase costs, while forced peak-time charging raises transmission losses, voltage imbalance, and reliance on peak generators.More cycling of peak units can shorten maintenance intervals and increase maintenance costs.Source: §4.5 · p. 19
  • Sudden demand or generation changes cause generator-output oscillations that can affect generator lifetime and maintenance frequency.Oscillatory power requirements may cause rapid turbine or prime-mover acceleration and deceleration, producing rotor vibration and potentially irreparable damage.Source: §4.5 · p. 19
  • EV-load manipulation could theoretically hide a transmission-line outage by adjusting loads at both ends of the disconnected line, obscuring it from state estimators.The nonlinear EV load would also add time-distortion harmonics to the system.Source: §4.5 · p. 19

4.6 Comparison to non-EV Attacks

The modified 7-bus simulations compare residential-load attacks with EV attacks at similar active-power, apparent-power, and smaller load scales. Across these cases, EV attacks can destabilize the system under conditions where the residential-load attack recovers.

4.6.1 Residential/Home IoT Load Attack

  • An increase at t=15 s dropped frequency to 59 Hz, yet all areas and generators remained in synchronism, values returned to a steady value, with no voltage violations and parameters within acceptable limits.After stabilization, the system operator could ramp up generation beyond automatic control.Source: §4.6.1 · p. 20

4.6.2 EV Load Attack – Similar MW load (6000 EVs)

  • For the same 48 MW active-power demand, synchronized charging by 6,000 EVs at pf=0.6 represented 80 MVA versus 60 MVA in the previous attack; top-area frequency never recovered, areas oscillated, and generators lost synchronism.Voltage fluctuation at bus 1 violated safe-operation standards and could trigger protection relays, dropping large portions of load and possibly causing a blackout.Source: §4.6.2 · pp. 21–22

4.6.3 EV Load Attack – Similar MVA Load (5000 EVs)

  • At equal apparent power of 60 MVA, the 5,000-EV attack (36 MW across buses 2, 3, 4, and 5) still caused erratic generator output and voltage and frequency oscillations, showing its high reactive component could destabilize the grid.Source: §4.6.3 · pp. 23–24

4.6.4 EV Load Attack – Smaller Load (4150 EVs)

  • The final attack was smaller in EV numbers and real and reactive load, with compromised load placed at the most sensitive buses; generators and three areas lost synchronization, and generator disconnection led to blackout.Source: §4.6.4 · p. 24
  • A 30 MW (50MVA) EV load destabilized and damaged the grid, while a 48 MW (60MVA) residential load caused only a frequency drop, no other violations, and the grid returned to stability after generation was ramped up.Source: §4.6.4 · p. 24

5 Mitigation and Detection Recommendations

The paper recommends hardening EV-ecosystem vulnerabilities and proposes two complementary ways to detect EV attacks: monitoring grid conditions and monitoring charging-station behavior. The detection approaches are intended to help identify attacks if vulnerability patches leave weaknesses unaddressed.

5.2 Attack Detection

  • The paper proposes two attack-detection strategies: utility monitoring of grid conditions and EVCS-operator monitoring of charger use.The detection section is presented for use in case vulnerability patches fail to address all weaknesses.Source: §5 · p. 24, §5.2 · p. 25

5.1 Hardening the EV Ecosystem Security

  • The proposed hardening measures address individual EV-ecosystem vulnerabilities using industry practices, including standardized protocols and enforced authentication and encryption rather than plain-text transmission.Other recommendations include disabling external entities, validating pre-approved clients, filtering and encoding inputs, and enforcing authentication on critical charging-session functions.Source: §5.1 · pp. 24–25

5.2.1 Method 1: Attack Detection Based on Grid

  • Grid-based detection monitors sudden increases in reactive-power demand and harmonics at transmission and distribution levels, using compensator states as an additional indicator where VAR compensation masks demand.The approach is intended to distinguish normal operation, benign failures, and failures caused by EV-infrastructure attacks.Source: §5.2.1 · pp. 25–26

5.2.2 Method 2: Attack Detection Based on EVCS

  • The EVCS-based machine-learning approach monitors collective charging patterns for unusual mass charging, discharging, or station utilization relative to historical and projected behavior.Its two complementary levels monitor the entire system and individual stations; the control center aggregates station alarms to help circumvent stealthy attacks.Source: §5.2.2 · p. 26

6 Conclusion

The paper links EV-ecosystem vulnerabilities to grid attacks through control of charging and discharging, and reports that EV-load simulations were more damaging than residential-load simulations. It also describes topology-informed attacks using fewer EVs and presents vulnerability patches and detection strategies.

6 Conclusion

  • EV-ecosystem vulnerabilities can give attackers control of charging stations, which can be used to launch grid attacks through mass charging and discharging.The paper presents the EV ecosystem as a cyber-physical system of interconnected hardware and software elements.Source: §6 · p. 26
  • EV-load simulations were more damaging to grid operation than residential-load simulations, which the paper relates to the nonlinear EV charging load.The paper concludes that high reactive-power demand amplifies the impact of EV attacks.Source: §6 · p. 27
  • An attacker able to estimate grid topology can use stability metrics to craft higher-impact attacks with fewer EVs.The paper also presents patches for vulnerabilities and two possible detection strategies.Source: §6 · p. 27
Loading 2111.11317v1…