Securing Electric Vehicle Charging Stations: A Critical Analysis of Authentication Vulnerabilities

Charging stations are essential for accelerating the adoption of electric vehicles, reducing emissions, enhancing energy security, promoting economic growth, and facilitating the transition to a cleaner and more sustainable transportation system. Authentication of electric vehicle drivers at charging stations is crucial to prevent unauthorized access, protect user data, and secure payment transactions associated with charging operations. Researchers and practitioners lack an overview of vulnerabilities concerning the authentication of electric vehicle drivers. While others have previously surveyed the domain, no one has provided a clear framework so far. In this paper, we focus on analyzing threats to authentication use cases of the Open Charge Point Protocol (OCPP). We conducted a literature review to survey threats to the authentication of electric vehicle drivers and grounded it in established terminology of threat modeling (STRIDE). Furthermore, we demonstrated the practicality of our framework by conducting simulations of a user spoofing attack on an industrial charging station implementing the latest version of OCPP. The paper's contribution lies in presenting a comprehensive framework of cybersecurity vulnerabilities, specifically focusing on the authentication of electric vehicle drivers at charging stations. This framework empowers requirements engineers to derive cybersecurity requirements and thus establish a security-by-design development process for OCPP-enabled products.