Moving target defense protects electric vehicle charging networks from cyberattacks
Moving Target Defense in SDN-enabled EV Charging Network
Cryptography and SecurityComputer Science and Game TheoryNetworking and Internet Architecture
Summary
Electric vehicle charging sites are becoming vulnerable to cyberattacks that quietly disrupt service by overwhelming the network controls. The authors propose a defense method called CS-SHIELD that changes the virtual IP addresses of charging devices to confuse attackers and protect the network. Their tests show this method keeps charging stations running smoothly during attacks with almost no delay during normal use. This shuffling approach makes attackers' prior knowledge useless, helping keep electric vehicle charging reliable and secure.
What this means in practice
- •For network security teams: Protect electric vehicle charging station networks from stealthy denial-of-service attacks by implementing dynamic IP address reassignment methods.
- •For smart grid operators: Maintain availability of electric vehicle charging infrastructure by deploying moving target defense mechanisms that quickly detect and respond to disruptive cyber threats.
Authors
Roland Plaka, Mikael Asplund, Simin Nadjm-Tehran
Abstract
Software-Defined Networking (SDN) is emerging as a promis- ing technology for EV Charging infrastructure (EVCI) since it enables flexible, programmable control of EVCI networks, yet its security gain to EVCI remains underexplored. SDN-enabled EVCI faces an increas- ing number of cyber threats arising from the convergence of IT and OT components; in particular, low-rate Denial-of-Service (DoS) attacks. Ear- lier works identify a trend toward low-rate attacks in OT networks that may exhaust SDN switch flow tables and which can result in disabling the entire charging sites without triggering volume-based defenses. In this paper, we propose CS-SHIELD, a Moving Target Defense mecha- nism for SDN-enabled EVCI communication. We showcase the imple- mentation of the proposed mechanism that detects malicious flow table rules via cross-layer identity verification and responds by reassigning virtual IP addresses to all active chargers. Experiments on an emulated SDN testbed with a real charging protocol implementation demonstrate that CS-SHIELD maintains full site availability under attack, responds quickly, adds only a negligible delay under normal conditions. The reas- signing (shuffle) approach at each reaction makes the earlier reconnais- sance knowledge by the attacker rendered worthless.