Cloud Controlled EV Charging - A Threat to the Power Grid and a Countermeasure

Electric Vehicle (EV) manufacturers operate cloud infrastructures that can control the charging operations of connected EVs. An attacker gaining control over an EV manufacturer’s cloud could perform load-altering attacks (LAAs) on the power grid by simultaneously sending charging commands to the connected EVs. This implies that the clouds of large EV manufacturers are effectively single points of failure to the power grid. This work presents an analysis of the technical implementation of the communication from the EV manufacturer smartphone app to the manufacturer cloud. Based on this analysis, we propose a change to the currently used communication concept: the use of end-to-end integrity protection to reduce the impact of a malicious cloud whilst keeping the impact on user experience to a minimum. Our results indicate that none of the EVs analyzed uses a communication architecture that provides protection in case of a compromised cloud. Through the end-to-end integrity protection scheme, we demonstrate that there is a countermeasure that EV manufacturers can adopt.