4月初，眾多電動汽車行業專家聚集在美國國家可再生能源實驗室（NREL），共同評估提升電動汽車和充電基礎設施之間的連接安全的新方法。隨著越來越多的電動汽車進入市場并接入電網，潛在的網絡漏洞可能暴露出來，因此車輛安全問題越來越受到行業的重視。得到本次合作活動支持的是由國際自動機工程師學會（SAE International）牽頭的一個為期兩年的項目，該項目旨在動員汽車行業廣泛參與電動汽車充電領域的競爭前研究和技術原型設計，以加強電動汽車的網絡安全性。
該活動在NREL位于科羅拉多州戈爾登的能源系統整合中心（Energy Systems Integration Facility）舉辦，旨在評估保護車輛與充電站連接的PKI應用。PKI是一種加密交換信息并認證設備可信授權的方法。盡管PKI已為許多行業所采用，但不同公司的電動汽車和充電站之間的認證尚未普及，在電動汽車充電生態系統中也并不成熟。
NREL曾研究過與電動汽車互聯相關的漏洞，并評估了減少漏洞所需采取的策略。本次活動進一步展示了PKI如何提高實現充電所需的通信安全。成功保護這些通信有助于防止金融詐騙，并保護司機、車輛、制造商和充電網絡運營商免受其他網絡攻擊。
福特汽車、Rivian、殼牌全球解決方案和ChargePoint等公司將電動汽車和充電基礎設施帶到活動現場，參加首次測試。項目團隊使用了一個由Eonti設計并通過Digicert證書實現的PKI系統，為PKI加強的充電連接建立基本系統功能。一旦基本功能得到證實，NREL和相關方就可以開始規劃未來的工作，指導項目團隊實施一個保護充電基礎設施的防御性系統。
項目負責人Tony Markel表示：“NREL利用獨特的電力系統、網絡設施和專業知識，幫助這些團隊在真實工作條件下評估電動交通系統的網絡安全性。此外，該項目也是一個將行業資源和政府的評估資源結合起來的好機會。”
產品團隊使用有效與無效的PKI完成了數十次測試，以確保系統能夠正確捕獲和識別正確和錯誤的行為。在后續測試中，研究人員計劃擴大參與測試的公司數量以及測試案例的種類，以提升測試對電動汽車充電行業的影響。測試案例中將包括針對電動汽車連接的對抗性演習，按照“黑客大賽”的模式，全面確定PKI實施策略的網絡安全性能。
人們對PKI用于電動汽車充電的關注始于一項行業評估，該評估讓人們看到了改進當前電動汽車網絡安全標準的機會。SAE正在組織國際電動汽車充電行業、公共機構和研究機構，協作提高交通和能源行業之間的關鍵連接的整體安全性。本次項目的目標正是實現一種無關現有充電平臺、全球汽車行業通用的PKI實施方法。
SAE的PKI合作研究項目（CRP）旨在聯合行業合作伙伴，共同開展針對行業問題的競爭前解決方案研究。其中，NREL項目致力于設計一個安全、可信賴、可擴展、可互操作的包容性全球電動汽車充電行業PKI平臺，并對其進行測試。
SAE International期待更多機構參與這一關鍵項目。未來的活動包括證實PKI電動汽車充電應用的可擴展性、確保PKI在產品之間的兼容性、以及共享研究結果以改進標準等。
進一步了解NREL的電網車輛整合網絡安全研究和其他可持續交通和出行舉措，
請訪問：http://saeintl.cn/evgc
The project uses PKI to help protect the connection between EVs and charging stations.
Members of the electric vehicle industry gathered at the National Renewable Energy Laboratory (NREL) in early April to evaluate enhanced cybersecurity for the connections between EVs and charging infrastructure. As more EVs enter the market and connect to the electrical grid, potentially exposing cyber vulnerabilities, vehicle security is drawing increased interest. The collaborative event supports a two-year project led by SAE International to strengthen EV cybersecurity through wide industry engagement on pre-competitive research and technology prototyping in the EV charging space.
The event, held at NREL’s Golden, Colorado Energy Systems Integration Facility, was organized to evaluate the application of public key infrastructure (PKI) – a method for encrypting information exchange and certifying the trusted authenticity of devices – to help protect the connection between vehicles and charging stations. Although PKI had been adopted for many industries, this kind of authentication between different companies’ electric vehicles and charging stations is not commonplace nor has it matured in the EV charging ecosystem.
NREL has previously studied the vulnerabilities associated with EV interconnections and has evaluated strategies to mitigate those vulnerabilities. The event went a step further into showing how PKI could improve security of communications required to enable charge sessions to take place. Successfully securing these communications would help protect against financial fraud and defend drivers, vehicles, manufacturers, and charge network operators from other cyber intrusions.
Participants including Ford Motor Co., Rivian, Shell Global Solutions and ChargePoint brought EVs and charging infrastructure to this initial test event. The teams used a PKI system designed by Eonti and implemented with Digicert to focus on establishing primary system functionality for the PKI-strengthened charging connection. Once basic functions have been demonstrated, the participants and NREL can begin planning for future efforts that will guide the team to implement a defensible system for protecting charging infrastructure in the field.
“NREL has assembled unique power systems, cyber facilities and insights to assist these teams to assess the cybersecurity of electrified transportation systems under real operating conditions and this project is a great opportunity to marry industry expertise and government evaluation resources,” said Tony Markel, project lead at NREL.
The product teams completed dozens of tests, using valid and invalid PKI implementations to ensure systems are robust enough to correctly capture and identify accurate and faulty behaviors. In follow-on tests, researchers intend to expand the number of companies involved and the test cases performed to widen the impact of testing on the EV charging sector. The test cases will include adversarial drills against EV connections in the spirit of a hack-fest to confirm the full cyber strength of a PKI implementation strategy.
The interest in PKI for EV charging follows an industry assessment that found opportunities for improvement in current standards pertaining to EV cybersecurity. SAE is organizing the international EV charging sector, as well as public and research entities, to collaboratively increase overall security in this critical connection between the mobility and energy industries. The project is intended to deliver an operational PKI method agnostic to the charging platform that is available to industry worldwide.
SAE’s PKI Cooperative Research Projects (CRP) are joint ventures with industry partners that perform targeted, pre-competitive research to develop solutions – by industry for industry. The NREL project encompasses the designing and testing of an inclusive, worldwide EV charging industry PKI platform that is secure, trusted, scalable, interoperable, and extensible.
SAE International is seeking to expand the network of participating entities to join this critical project. Future activities include proving the scalability of PKI for EV charging, ensuring its compatibility across products, and sharing results to influence standards. Learn more about NREL’s cybersecurity for grid-vehicle integration research and other sustainable transportation and mobility initiatives: https://www.nrel.gov/transportation/electric-vehicle-grid-cybersecurity.html.
Tim Weisenberger is SAE Program Manager of Emerging Technologies; tim.weisenberger@sae.org
Rivian的工程師Sarah Hipel（左）和Gabriel Lopez在NREL測試中插入R1T。（NREL）