{"id":7010,"date":"2020-08-14T12:43:58","date_gmt":"2020-08-14T10:43:58","guid":{"rendered":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/?p=7010"},"modified":"2020-08-14T12:45:02","modified_gmt":"2020-08-14T10:45:02","slug":"electric-vehicle-3","status":"publish","type":"post","link":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/2020\/08\/14\/electric-vehicle-3\/","title":{"rendered":"The ISO standard for electric-vehicle \u201cPlug-and-Charge\u201d faces security concerns"},"content":{"rendered":"<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\"><em>The ISO 15118-2 standard provided a Plug-and-Charge method for EVs, but aspects remain surrounding the convenience feature\u2019s security protocols.<\/em> (BMW) <\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\">The dispute is about how digital security certificates are exchanged between automakers, chargepoint facilitators and mobility operators. <\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\">In 2010, a joint working group of the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) started contemplating how the equipment used by two goliath industries, automotive and electric utilities, would \u201ctalk.\u201d The resulting standard was ISO 15118, entitled \u201cRoad Vehicles \u2013 Vehicle to Grid Communication Interface.\u201d It provides the protocols for secure communications that signal charging stations to send current to an electric vehicle (EV).<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\">By 2014, the so-called \u201cDash 2\u201d section of 15118 was released. ISO 15518-2 prescribed a method for automakers, charging-station manufacturers and charging network operators to offer the so-called Plug-and-Charge feature. The idea is for EV drivers to roll up to a charging station and strictly by plugging in have the vehicle automatically begin charging. At the same time, financial transactions to pay for the electricity seamlessly and securely occur in the cloud \u2013 no credit cards or RFID membership cards required.<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\">Tesla\u2019s closed and proprietary Supercharger network has offered this feature to its users since 2012. Plug-and-Charge, as outlined by ISO 15118, is designed for all players. Six years later, ISO 15118-2\u2019s Plug and Charge system has not yet been implemented by any automaker. Several companies \u2013 including Audi, Porsche and Ford \u2013 are expected to introduce Plug-and-Charge to EV customers in the next year.<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\"><img class=\"mfp-img aligncenter\" src=\"https:\/\/www.sae.org\/binaries\/content\/gallery\/cm\/articles\/news\/2020\/08\/iso-ev_chargepoint-diagram.jpg\" \/><\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\"><strong>Like SSL for electric cars<\/strong><\/span><br \/>\n<span style=\"color: #0000ff;\">Some industry players complain that aspects of ISO 15118-2\u2019s technologies \u2013 established in 2014 \u2013 need to be updated (for example, the standard\u2019s interchange format is EXI, a binary XML, instead of JSON). But the stumbling block is not the technology employed for communications between the EV and charger. That\u2019s primarily handled by the HomePlug Green PHY powerline communications device, which is integral to the Combined Charging System (CCS) used by most EVs and chargers today.<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\">The dispute is about how security certificates are exchanged between entities, including automakers, chargepoint operators (CPOs) and so-called mobility operators (MOs). There are disagreements about the appropriate role for each business entity, which is mostly outside the scope of ISO 15118.<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\">The abridged version of standard\u2019s methodology is that secure transactions would be made using communications not identical but similar to client-server exchanges on the web employing Transport Layer Security (TLS) and Public Key Infrastructure (PKI). In this case, the client is the vehicle and the charging station is the server. The vehicle itself replaces the driver\u2019s use of an RFID card or mobile app. A few more details:<\/span><\/p>\n<ul style=\"text-align: justify;\">\n<li><span style=\"color: #0000ff;\">A unique identifier is assigned to each vehicle<\/span><\/li>\n<li><span style=\"color: #0000ff;\">The EV\u2019s owner establishes a relationship with a Mobility Operator (MO). The MO also is known as an e-mobility service provider (EMSP)<\/span><\/li>\n<li><span style=\"color: #0000ff;\">The MO issues a digital \u201ccontract certificate,\u201d which it received from a \u201ccertificate authority.\u201d The contract certificate is tied to an owner account<\/span><\/li>\n<li><span style=\"color: #0000ff;\">When the EV is connected to a charging station, the contract certificate (stored on the vehicle and containing the digitally signed authentication token, as well as driver identification and billing info) is transmitted to the charging station<\/span><\/li>\n<li><span style=\"color: #0000ff;\">The CPO, which operates the charging network and its stations, electronically verifies the contract with MO<\/span><\/li>\n<li><span style=\"color: #0000ff;\">When the CPO confirms that it will get paid according to pricing and other terms established by the CPO, the charging session begins<\/span><\/li>\n<li><span style=\"color: #0000ff;\">The MO invoices the owner, debits their account and handles all the backend processes and contracts, including paying the CPO\u2019s cost for delivering the charging service<\/span><\/li>\n<li><span style=\"color: #0000ff;\"><img class=\"mfp-img aligncenter\" src=\"https:\/\/www.sae.org\/binaries\/content\/gallery\/cm\/articles\/news\/2020\/08\/iso-ev_v2g-clarity-diagram.jpg\" \/><\/span><\/li>\n<\/ul>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\"><strong>Spotlight on the \u201ccertificate authority\u201d<\/strong><\/span><br \/>\n<span style=\"color: #0000ff;\">ChargePoint, the Campbell, Calif. company that serves as both a CPO and mobility operator, created a stir in May 2019, when it co-published a white paper entitled, \u201cPractical Considerations for Implementation and Scaling ISO 15118 into a Secure EV Charging Ecosystem.\u201d The paper \u2013 co-authored by DigiCert, a digital security company and EonTi, a trust management consulting company \u2013 gave rock-bottom scores to how ISO 15118-2 handles security certificates.<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\">Eric Sidle, senior vice-president of engineering at ChargePoint, said, \u201cThe way 15118 was written is very biased toward a small group of organizations that hand out and control those certificates. With 15118, a higher-level mobility operator is injected into the system.\u201d He asserts that the certificate authority \u2013 the new entity that he says is inserted into the process \u2013 can control pricing , even though it\u2019s a middleman. Sidle also questions 15118\u2019s various security protocols, which he believes are prone to man-in-the-middle attacks.<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\">The industry\u2019s most established certificate authority for EV charging is Hubject GmbH, the Berlin-based IT platform. Hubject is a joint venture of the BMW Group, Bosch, Daimler, EnBW, innogy, Siemens and the Volkswagen Group. Marc M\u00fcltin, one of the co-authors of ISO 15118, acknowledged that the standard\u2019s backend processing procedure \u201ccan be quite complicated.\u201d That led him in 2016 to launch V2G Clarity, a consulting company helping organizations implement the standard. His views represent V2G Clarity Ltd., which also offers software services to implement ISO 15118.<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\">M\u00fcltin said that Hubject is simultaneously a certificate authority and the operator of the platform that connects all the players. \u201cHubject operates what is called the V2G Root CA,\u201d said M\u00fcltin. \u201cThere is a top-level trust anchor defined in 15118 and that is the V2G Root CA. The V2G Root CA certificate needs to be installed in an electric vehicle to enable secure communication between the car and a charging station.\u201d M\u00fcltin explained that Hubject is the \u201conly operator\u201d of the V2G Root CA and the \u201conly provider of a Plug-and-Charge ecosystem.\u201d<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\"><strong>Concerns about independence<\/strong><\/span><br \/>\n<span style=\"color: #0000ff;\">Hubject earns revenue by charging setup and annual fees to automakers and CPOs to use its platform \u2013 as well as for testing services, consulting and certificate management. To enable Plug-and-Charge, automakers, including competitors to the German car companies backing Hubject, are required to install Hubject\u2019s digital security certificates in their vehicle\u2019s charging-system software.<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\">While Volkswagen, for example, might see Hubject as a trusted partner, that might not be the case for other automakers. M\u00fcltin acknowledged that \u201cstakeholders say Hubject is not independent enough.\u201d But he said he believes all the players in the \u201cPlug-and-Charge ecosystem should be thankful for them\u201d for setting up its platform. Hubject GmbH was founded in 2012.<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\">\u201cOur V2G Root is installed in the EV\u2019s communication controller,\u201d confirmed Barton Sidles, Hubject\u2019s senior director of corporate and business development. \u201cThis is the same location that contains the vehicle identification and stores the OEM\u2019s provisioning certificate.\u201d<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\">Ford Motor Co. will soon introduce its all-electric Mustang Mach-E SUV, followed by electric versions of the company\u2019s other popular models. Scott Turik, an EV charging-standards analyst at Ford, has been working with ISO 15118 since 2014. He says Ford supports the standard because its technical and communications protocols enable the fundamental communication between the EV and the charging station.<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\">\u201cWe\u2019ll do our best obviously to meet all the requirements, but we developed a different method to deliver data files \u2013 and specifically the certificates and private keys \u2013 to our vehicle, what is written into the standard,\u201d said Turik. \u201cOur cybersecurity team didn\u2019t like the way the standard was doing it, so we had to kind of go outside of the standard in order to ensure a higher level of security for customers.\u201d<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\">Turik explained that Ford will use a \u201cknown secure method that involves our telematics system.\u201d He added, \u201cWe don\u2019t go through those intermediary parties. We do it directly to our vehicle.\u201d As Ford\u2019s approach demonstrates, car companies and CPOs can implement ISO 15118\u2019s core technology stack but elect to handle digital security in a more direct fashion.<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\"><strong>Additional research in progress<\/strong><\/span><br \/>\n<span style=\"color: #0000ff;\">In December 2019, SAE International announced plans to form an industry-led pre-competitive research project to strengthen the Plug-and-Charge security outlined in ISO 15118 and CHAdeMO 2.0 protocols. \u201cThere are operational and governance issues that, quite frankly, I don\u2019t think are germane to a standard. We need to decouple security from EV charging,\u201d said Tim Weisenberger, SAE project manager for emerging technologies standards. He noted that the SAE research project now underway will take about a year to develop an improved PKI platform and another year for testing.<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\">M\u00fcltin, the co-author of ISO 15118, said he believes it\u2019s \u201ca good idea to bring everyone to the table to openly and fairly discuss how to make the system super secure.\u201d But he worried, \u201cI hope they don\u2019t try to reinvent the wheel and all the work we have already done.\u201d\u202fM\u00fcltin disagrees with ChargePoint\u2019s assertions that ISO 15118 doesn\u2019t provide adequate security. \u201cI would like to see a profound analysis that says where exactly there is a security weakness, taking into account what we have written in our application guide. No one has done that so far.\u201d<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\">The next meeting of the ISO 15118 joined working group is scheduled for November 2020. The group&#8217;s current focus is a new document entitled ISO 15118-20, as well as an update of 15118-2 and 15118-4. &#8220;Major enhancements to the existing AC and DC charging process are the support of inductive charging and Wi-Fi communication, reverse power flow and automatic connecting devices, meaning charging via robots,&#8221; said Dirk Gro\u00dfmann, the\u202fISO15118 convener.\u202fGro\u00dfmann serves as senior manager of off-board electronics for charging infrastructure at Vector Informatik, a company providing networking tools for electronic systems based in Stuttgart, Germany.<\/span><\/p>\n<p style=\"text-align: justify;\"><span style=\"color: #0000ff;\">&#8220;The handling of security certificates is not a feature of the standard, even though some parties try to argue this,\u201d said Gro\u00dfmann. \u201cThe focus of ISO 15118 is the communication between the vehicle and the charging station. The way certificates are created or maintained on the backend is not in the scope of the document.&#8221;<\/span><\/p>\n<p>&nbsp;<\/p>\n<p>By\u00a0<span class=\"nx-article-author\"> Bradley Berman<br \/>\n<\/span><\/p>\n<p><span class=\"posted-by\">Source: <a href=\"https:\/\/www.sae.org\" target=\"_blank\" rel=\"noopener noreferrer\">https:\/\/www.sae.org<\/a><\/span><\/p>\n<h3 style=\"text-align: center;\"><a href=\"https:\/\/advancedfleetmanagementconsulting.com\/eng\/consultancy\/\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>CUT COTS OF THE FLEET WITH OUR AUDIT PROGRAM<\/strong><\/a><\/h3>\n<p><a href=\"https:\/\/advancedfleetmanagementconsulting.com\/eng\/consultancy\/\"><img loading=\"lazy\" class=\"aligncenter wp-image-5377\" src=\"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-content\/uploads\/sites\/3\/2020\/04\/nueva-ley-auditoria.jpg\" sizes=\"(max-width: 858px) 100vw, 858px\" srcset=\"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-content\/uploads\/sites\/3\/2020\/04\/nueva-ley-auditoria.jpg 2000w, https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-content\/uploads\/sites\/3\/2020\/04\/nueva-ley-auditoria-300x200.jpg 300w, https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-content\/uploads\/sites\/3\/2020\/04\/nueva-ley-auditoria-1024x682.jpg 1024w\" alt=\"\" width=\"858\" height=\"572\" \/><\/a><\/p>\n<p style=\"text-align: justify;\">The audit is a key tool to know the overall status and provide the analysis, the assessment, the advice, the suggestions and the actions to take in order to cut costs and increase the efficiency and efficacy of the fleet. We propose the following fleet management audit.<\/p>\n<h3 style=\"text-align: center;\"><a href=\"https:\/\/advancedfleetmanagementconsulting.com\/eng\/consultancy\/\" target=\"_blank\" rel=\"noopener noreferrer\"><strong>FLEET MANAGEMENT AUDIT<\/strong><\/a><\/h3>\n","protected":false},"excerpt":{"rendered":"<p>The ISO 15118-2 standard provided a Plug-and-Charge method for EVs, but aspects remain surrounding the convenience feature\u2019s security protocols. (BMW) The dispute is about how digital security certificates are exchanged between automakers, chargepoint facilitators and mobility operators. In 2010, a joint working group of the International Organization for Standardization (ISO) and the International Electrotechnical Commission&#8230;<\/p>\n","protected":false},"author":3,"featured_media":7011,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[18],"tags":[230],"_links":{"self":[{"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/posts\/7010"}],"collection":[{"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/comments?post=7010"}],"version-history":[{"count":2,"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/posts\/7010\/revisions"}],"predecessor-version":[{"id":7013,"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/posts\/7010\/revisions\/7013"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/media\/7011"}],"wp:attachment":[{"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/media?parent=7010"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/categories?post=7010"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/advancedfleetmanagementconsulting.com\/eng\/wp-json\/wp\/v2\/tags?post=7010"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}