Evsefuzz tool improves security testing of ev charging protocols
EVSEFuzz : A Tool for Automated Testing of Protocol Implementations
Cryptography and Security
Summary
Electric vehicle charging stations communicate using special protocols, but these communications can have security problems. The authors created EVSEFuzz, a tool that automatically sends both correct and incorrect messages to charging equipment to find security flaws. This tool uses Python packages to understand the message formats, which helps it test many different implementations. EVSEFuzz has found real vulnerabilities in different charging systems, showing it can improve the safety of electric vehicle networks.
What this means in practice
- •For ev charging network operators: Automatically test their charging equipment for security flaws by generating diverse protocol messages, making their networks safer.
- •For iot device developers: Check security of protocol implementations in internet-connected devices using datatype-aware automated fuzz testing inspired by EVSEFuzz.
Authors
Soham Gumaste, Michael Khan, Roland Varriale, Rigel Gjomemo
Abstract
The rapid adoption and development of electric vehicle (EV) networks has required the expansive deployment of EV charging infrastructure (EVCI) which relies on communication protocols such as the open charge point protocol (OCPP) to coordinate data transfer between charging network operators and the EV supply equipment. In this paper, we present EVSEFuzz, a tool for automatically building fuzzers to test the security of protocol implementations. To achieve this we make a novel use of Python datatype validation packages and tools to ``understand'' datatypes and message structures and generate both compliant and non-compliant messages. To date, EVSEFuzz has been tested successfully with several open and closed-source implementations and has found several vulnerabilities leading to the publication of two CVEs.