PaperlayerView exact revision on arXiv

Source-linked AI summary

Wicked Problem, Parsimonious Solution: Securing Electric Vehicle Charging Station Software

Emma Sheppard, Zachary Wadhams, Dalton Arford, Clemente Izurieta, Ann Marie Reinhold

arXiv:2609.10502v1cs.CRcs.SE

TL;DR

EVSE software is a poorly characterized and vulnerable attack surface within expanding electric vehicle charging infrastructure. The paper advocates hierarchical software quality assurance, integrating quality and security characteristics to assess EVSE software across levels and throughout development. It concludes that HSQA offers a comprehensive approach for improving EVSE software quality and security posture.

  • Problem

    EVSE software is a vulnerable, poorly characterized attack surface within charging infrastructure, especially as public-facing infrastructure expands.

  • Method

    The paper proposes HSQA by integrating software quality standards, EVSE cybersecurity practices, and relevant power, industrial-control, and automotive security standards.

  • Results

    HSQA provides a hierarchical assessment of EVSE software quality and security, from individual vulnerabilities to high-level characteristics and overall system posture.

  • Takeaways & Limitations

    The authors conclude that HSQA is a secure-by-design and comprehensive approach for assessing EVSE software and improving its quality and security posture.

Abstract

from arXiv · show

Electric vehicle charging infrastructure presents a suite of novel cyber-physical threats. Among this infrastructure, charging stations are the most vulnerable elements. The software in the charging station supply equipment is particularly vulnerable. Currently, the software is an attack surface that is largely unprotected and poorly characterized. To represent the vulnerabilities in this attack surface, we advocate for applying modern software quality assurance to characterize vulnerabilities in electric vehicle charging station software. Specifically, we advocate for the application of hierarchical software quality assurance (HSQA) to specialized electric vehicle charging station software. HSQA provides a comprehensive view of the code quality and security -- from the level of individual vulnerabilities (e.g., CVEs) to high level characteristics (e.g., CIA Triad). HSQA incorporates quality and security considerations throughout the software development lifecycle. Thus, our position is that HSQA is an excellent approach for assessing electrical vehicle charging station software.

I. INTRODUCTION

EVCI is a growing, complex cyber-physical infrastructure whose public-facing EVSE components create an expanding and varied attack surface. The paper focuses on EVSE software and proposes HSQA to assess its quality and security.

  • I. INTRODUCTION: EVCI connects electric vehicles, cloud systems, the power grid, and payment or authorization mechanisms into one charging ecosystem.It includes EVCS, EVSE, CSMS, grid or operator systems, and payment and authorization mechanisms.
  • I. INTRODUCTION: Public EVCI expansion supports EV adoption but introduces access, reliability, and cybersecurity challenges.Public charging infrastructure serves rural and urban areas while requiring substantial investment as the EV market grows.
  • I. INTRODUCTION: EVSE is the most vulnerable infrastructure element because it is public-facing and central to exchanging power and data among multiple stakeholders.The EVSE links the vehicle, user, applications, OEM, charge point operator, and grid operator.
  • I. INTRODUCTION: The EVSE digital attack surface is driven by software that governs interdependent functions and can expose multiple interfaces to adversarial attacks.The paper distinguishes physical hardware from the software-driven digital surface and focuses on software quality and security.
  • I. INTRODUCTION: The paper proposes integrating EVSE software quality and security assessment through hierarchical software quality assurance.The approach applies a familiar software quality assurance framework to the EVSE software attack surface.

A. Prior Work

The prior-work discussion characterizes EVSE threats across four interfaces and identifies concrete vulnerabilities spanning physical connections, operator authentication, internet communications, and maintenance access.

  • A. Prior Work: The Four-Interface threat model divides the EVSE attack surface into EV-to-EVSE, EV operator, EVSE internet, and EVSE maintenance interfaces.Each interface represents a distinct pathway for interaction with or access to EVSE components.
  • A. Prior Work: The EV-to-EVSE interface uses a heterogeneous coupling cable vulnerable to malware exchange, charging disruption, privilege escalation, and protocol-related security issues.Variation in power level, power type, and communication protocols contributes to the interface's heterogeneity.
  • A. Prior Work: The EV operator interface authenticates charging sessions through RFID, NFC, and credit cards but faces cloning, authorization bypass, and application reverse-engineering threats.ISO 15118-202 recommends PKI encryption for this attack vector.
  • A. Prior Work: OCPP connects EVSEs to charging management systems, while widely used OCPP 1.6 lacks PKI encryption and relies on VPNs against MITM attacks and energy theft.Later OCPP versions include PKI encryption and ISO 15118 plug-and-charge functionality.
  • A. Prior Work: The maintenance interface exposes physical ports, unencrypted internal communications, local web servers, unsigned firmware, and hard-coded credentials.These conditions can enable monitoring, unauthorized access, and exposure of personally identifiable information.

2) CharIN EVSE Threat Model:

The CharIN EVSE threat model provides a broad characterization of the EVSE attack surface by enumerating attack vectors and threat scenarios and mapping them to established security frameworks.

  • 2) CharIN EVSE Threat Model:: CharIN's model is described as the most current and comprehensive characterization of the EVSE attack surface.It enumerates several attack vectors and threat scenarios for EVSE security analysis.
  • 2) CharIN EVSE Threat Model:: The model maps each threat scenario to Microsoft's STRIDE threat model and recommends mitigations and best practices.Referenced frameworks and standards include ISA/IEC 62443, MITRE ATT&CK, ISO 15118, and OCPP.

3) Integrating Known Threat Models for Comprehensive EVCI Security:

The paper integrates established EVSE threat models with secure-by-design principles and HSQA to evaluate software quality and security across the EVSE lifecycle. This approach is intended to support a comprehensive, adaptable assessment of a complex cyber-physical system.

  • 3) Integrating Known Threat Models for Comprehensive EVCI Security:: The proposed approach combines the Four-Interface and CharIN threat models to address exploitable attack vectors across vendor-dependent and changing EVSE components.The authors position the integration as a foundation for comprehensive EVCI security assessment.
  • 3) Integrating Known Threat Models for Comprehensive EVCI Security:: Secure-by-design principles place security considerations throughout the EVSE software development lifecycle.The paper contrasts this proactive posture with a historical build-and-forget mentality.
  • 3) Integrating Known Threat Models for Comprehensive EVCI Security:: HSQA models organize overall quality and security scores through high-level characteristics and their sub-characteristics.The conceptual architecture provides a hierarchical view of assessment dimensions.
  • 3) Integrating Known Threat Models for Comprehensive EVCI Security:: HSQA enables identification, prioritization, and mitigation of software security issues while incorporating secure-by-design principles.The authors describe it as a promising approach for evaluating EVSE software quality and security and promoting resilient EVSEs.

A. Quality Modeling for Software Components in the EVSE

The paper proposes applying HSQA to EVSE software by integrating quality standards, cybersecurity practices, and static-analysis outputs into a system-level assessment. HSQA organizes software vulnerabilities across abstraction levels to support quality and security evaluation.

  • A. Quality Modeling for Software Components in the EVSE: HSQA promotes EVSE software quality and security by integrating existing work from industrial control, operational technology, distributed energy, and automotive domains.
  • A. Quality Modeling for Software Components in the EVSE: HSQA generalizes EVSE software quality by connecting individual vulnerabilities and analysis outputs to higher-level quality and security characteristics.The model aggregates raw CVE counts into increasingly abstract concepts based on ISO/IEC standards.
  • A. Quality Modeling for Software Components in the EVSE: HSQA is domain-agnostic and customizable, allowing diverse EVSE software components and tool outputs to be integrated with minimal effort.Different languages can use different static-analysis tools while their results remain compatible with the HSQA model.
  • A. Quality Modeling for Software Components in the EVSE: HSQA evaluates diverse EVSE software components contemporaneously, enabling assessment of the EVSE’s overall quality and security posture as a system.
  • A. Quality Modeling for Software Components in the EVSE: Integrated EVSE assessment merges software quality standards with cybersecurity research, standards, and best practices through HSQA.
  • A. Quality Modeling for Software Components in the EVSE: The paper positions HSQA as an excellent approach for assessing EVSE software and improving its quality and security posture.

B. Counterarguments

The paper acknowledges independent secure-by-design practices but argues that HSQA provides a holistic framework for integrating their outputs across abstraction levels. This supports scalable assessment for both developers and executives.

  • B. Counterarguments: Secure-by-design practices include memory-safe languages, vulnerability disclosures, SAST/DAST, and code review, but these approaches are independent.
  • B. Counterarguments: HSQA can incorporate CVEs, CWEs, code review, and SAST/DAST outputs to score software quality and security holistically.
  • B. Counterarguments: HSQA offers a practical and scalable way to integrate security information at multiple abstraction levels for developers and the C-Suite.

IV. QUALITY & SECURITY CHARACTERISTICS FOR EVSE

The proposed EVSE quality model integrates ISO/IEC 25010:2023 with cybersecurity characteristics and best practices. This provides a structured basis for assessing software quality and security.

  • IV. QUALITY & SECURITY CHARACTERISTICS FOR EVSE: The first HSQA pillar is the ISO/IEC 25010:2023 software product quality model.
  • IV. QUALITY & SECURITY CHARACTERISTICS FOR EVSE: ISO/IEC 25010:2023 specifies nine high-level characteristics for software quality assessment, including functional suitability, performance efficiency, compatibility, interaction capability, reliability, security, and maintainability.

B. Pillar II: Cybersecurity Best Practices for EVSE

The paper adopts cybersecurity best practices and STRIDE properties as EVSE software characteristics. It further identifies sub-characteristics covering design, communications, resilience, operations, assurance, lifecycle, governance, and operator interactions.

  • B. Pillar II: Cybersecurity Best Practices for EVSE: Current EVSE cybersecurity best practices draw on expert interviews, ENCS requirements, and cybersecurity reports for medium- and heavy-duty EVs.
  • B. Pillar II: Cybersecurity Best Practices for EVSE: The paper uses STRIDE properties as EVSE software characteristics, including authenticity, integrity, non-repudiation, confidentiality, availability, and authorization.
  • B. Pillar II: Cybersecurity Best Practices for EVSE: Additional EVSE sub-characteristics include design, cryptography, communication, hardening, resiliency, secure operation, logging, assurance, lifecycle and governance, and operator communications.

dustrial Automation and Control Systems, and Power Delivery Electronics

The paper combines cybersecurity standards for road vehicles, industrial control systems, and power delivery electronics to define EVSE-relevant security characteristics. STRIDE, the CIA Triad, and IEEE 1547-3 requirements support a parsimonious mapping from threats to HSQA characteristics.

  • Road vehicles: STRIDE is selected because it enables parsimony and simplifies mapping threat scenarios to high-level security characteristics.The paper uses STRIDE instead of EVITA, TVRA, and PASTA.
  • Industrial automation and control systems: ISA/IEC 62443 aligns industrial automation security with the confidentiality, integrity, and availability triad.The paper adopts the CIA Triad as the relevant high-level characteristics.
  • Power delivery electronics: IEEE 1547-3 combines multiple cybersecurity resources and lists security requirements applicable to EVSE.The paper operationalizes these requirements as HSQA characteristics, including cryptography beyond the CIA Triad.
  • Power delivery electronics: Table III organizes security frameworks, high-level characteristics, sub-characteristics, and definitions from ISO/SAE 21434, ISA/IEC 62443, and IEEE 1547-3.This organization supports integrating the standards into the EVSE HSQA model.

V. DEVELOPING HSQA MODELS FROM QUALITY & SECURITY CHARACTERISTICS

The authors operationalize HSQA for EVSE by selecting quality and security characteristics and aggregating static-analysis outputs. The main challenge is ensuring that the selected characteristics and available tools adequately represent this new, complex domain.

  • Model development: The EVSE HSQA models operationalize quality and security characteristics as HSQA aspects and sub-characteristics as product factors.The models extend the HSQA meta-model for EVSE software.
  • Model development: Selecting the right EVSE characteristics and sub-characteristics is expected to require refinement because EVSE is new, complex, and connected to multiple critical infrastructures.The authors identify this refinement as their greatest challenge.
  • Tooling and validity: HSQA models can aggregate only characteristics measurable through the outputs of static analysis tools.The current work targets both source and compiled EVSE code.
  • Tooling and validity: Limited availability of EVSE-specific static-analysis tools threatens the internal and content validity of HSQA outputs.The authors therefore use SonarQube for source code and CVE Binary Tool for compiled code.

VI. DISCUSSION

The discussion presents HSQA as an integrated approach for evaluating EVSE software quality and security across vulnerabilities, attack vectors, and the software lifecycle. It emphasizes internal software robustness rather than only external grid or operational performance.

  • HSQA contribution: HSQA models incorporate EVSE threat-model findings and assess vulnerability identification, risk, and interdependencies throughout the software development lifecycle.The models provide a foundation for deployable evaluation of EVSE software.
  • Integrated quality and security: Integrating software quality and cybersecurity characteristics treats them as interrelated and directly measures attack vectors in a vulnerable EVCI digital surface.The paper argues that this integration enhances EVSE security posture.
  • Novelty: HSQA evaluates internal EVSE software integrity and robustness, unlike traditional evaluations focused on external impacts and operational performance.This provides a holistic assessment of interdependent cyber-physical software systems.
  • Conclusion: The authors position HSQA as a secure-by-design, comprehensive, and parsimonious approach for improving EVSE quality and security.They frame the approach as a solution to the expanding EVSE attack surface.
Loading 2609.10502v1…