Category: KNOWLEDGE

Behind every charging station and electric vehicle sits a small computer running firmware. If this foundation is weak, even the best software security can be bypassed.

Electric vehicles, charging stations and grid equipment all rely on embedded electronics and firmware. These components are often physically accessible, run for many years and are difficult to update, which makes them an attractive target for attackers. With the EU Cyber Resilience Act now in force, security by design is becoming a legal obligation. This article explains the main risks and how PrEVent will develop guidelines for cyber-resilient hardware and firmware.

When we think about cyberattacks on electric mobility, we often imagine remote attacks on backend platforms or communication protocols. Yet many attacks start much closer to the device itself: in the microcontroller of a charging station, the firmware of an on-board charger or the electronic control units (ECUs) of a vehicle.

Hardware and firmware form the root of trust of any connected device. If an attacker can read the memory of a chip, modify its firmware or extract its cryptographic keys, the security mechanisms built on top of it, such as encrypted communication or certificate-based authentication, can lose their value.

Why are e-mobility devices exposed?

Several characteristics make e-mobility equipment particularly exposed. Public charging stations are installed in car parks and on streets, where anyone can access them physically, sometimes for hours and without supervision. Vehicles and charging stations also have long lifetimes, often more than ten years, during which new vulnerabilities will inevitably be discovered.

In addition, these devices are built from many components supplied by different manufacturers: microcontrollers, communication modules, third-party software libraries and operating systems. A single weak component in this supply chain can compromise the security of the whole product.

Typical weaknesses

Security assessments of embedded devices regularly reveal similar issues. Debug and maintenance interfaces (such as JTAG, SWD or serial consoles) are sometimes left open on production devices, giving direct access to memory or to a command shell. Firmware may be stored without encryption or loaded without verifying its authenticity, which allows an attacker to read it, analyse it and replace it with a modified version.

Other frequent findings include cryptographic keys or passwords hardcoded in the firmware and shared across all devices, firmware update mechanisms without signature verification or rollback protection, and outdated open-source components with publicly known vulnerabilities. More advanced techniques, such as side-channel analysis or fault injection, can even target well-designed chips if they are not properly protected.

A compromised charging station is not only a problem for its owner. It can be used to attack connected vehicles, steal charging credentials, disturb the backend or, at scale, affect the stability of the power grid.

From best practice to legal obligation

Until recently, hardware and firmware security was mostly a matter of good practice. But this is changing. On the vehicle side, UNECE Regulations No. 155 and 156 [1][2] already require manufacturers to manage cybersecurity risks and software updates over the whole vehicle lifecycle, supported by the ISO/SAE 21434 engineering standard [3].

For other connected products, including charging equipment, the EU Cyber Resilience Act (CRA) [4] introduces mandatory essential cybersecurity requirements for products with digital elements. Products must be designed to be secure by default, protect the integrity of their software and data, limit their attack surface, receive security updates and be supported by a vulnerability handling process throughout their lifetime. Reporting obligations apply from September 2026 and the main requirements from December 2027.

Standards such as IEC 62443-4-2 [5] and ETSI EN 303 645 [6], as well as guidelines like NIST SP 800-193 on platform firmware resiliency [7], provide useful building blocks. However, they were not written specifically for the e-mobility ecosystem, and manufacturers still lack a common, practical reference covering EVs, charging stations and grid-connected equipment together.

What does “cyber-resilient” mean?

A cyber-resilient device does not only try to prevent attacks. It is designed to protect its critical functions, detect when something goes wrong and recover to a trusted state. In practice, this relies on a few key principles: a secure boot chain that only runs authentic firmware, secure storage of keys in dedicated hardware, locked debug interfaces, authenticated and robust update mechanisms, and the ability to fall back to a known good firmware version after a failure or an attack.

PrEVent’s approach

Within the PrEVent project [8], UTAC leads a dedicated task on cyber-resilient hardware and firmware in e-mobility. The work has two main objectives.

First, the task will develop harmonised guidelines and a supporting methodology for designing cyber-resilient hardware for EVs, charging stations and grid-connected infrastructure. Starting from the CRA requirements and hardware-level threat scenarios, the guidelines will translate regulatory expectations into concrete security-by-design principles, cross-referenced with existing standards, together with methods to verify conformity. Legal partners will ensure that the guidelines remain aligned with the evolving regulatory framework.

Second, the task will develop an analysis module to evaluate the robustness and security of firmware deployed in e-mobility devices. This will help manufacturers and testers identify weaknesses earlier, before devices reach the field. The results will then be validated in the project use cases and secure test bed activities.

Conclusion

Hardware and firmware are the foundation on which the security of the whole e-mobility ecosystem is built. As regulations make security by design mandatory, manufacturers need clear and practical guidance. By combining regulatory analysis, testing expertise and firmware analysis tools, PrEVent aims to contribute to a common European approach for secure and resilient e-mobility devices, supporting future certification schemes.

Author: Maxime BONNET (UTAC)

References

[1] United Nations Economic Commission for Europe (UNECE). (2021). UN Regulation No. 155 – Uniform provisions concerning the approval of vehicles with regards to cyber security and cyber security management system. Geneva: UNECE.

[2] United Nations Economic Commission for Europe (UNECE). (2021). UN Regulation No. 156 – Uniform provisions concerning the approval of vehicles with regards to software update and software update management system. Geneva: UNECE.

[3] ISO/SAE. (2021). Road vehicles — Cybersecurity engineering. ISO/SAE 21434:2021. Geneva: International Organization for Standardization.

[4] European Parliament and Council of the European Union. (2024). Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). Official Journal of the European Union. Available at: https://eur-lex.europa.eu/eli/reg/2024/2847/oj

[5] International Electrotechnical Commission (IEC). (2019). Security for industrial automation and control systems – Part 4-2: Technical security requirements for IACS components. IEC 62443-4-2:2019. Geneva: IEC.

[6] European Telecommunications Standards Institute (ETSI). (2020). Cyber Security for Consumer Internet of Things: Baseline Requirements. ETSI EN 303 645 V2.1.1. Sophia Antipolis: ETSI.

[7] Regenscheid, A. (2018). Platform Firmware Resiliency Guidelines. NIST Special Publication 800-193. Gaithersburg: National Institute of Standards and Technology. Available at: https://doi.org/10.6028/NIST.SP.800-193

[8] PrEVent Project. (2026). Preventing and detecting cyber threats in the electric mobility ecosystem. Available at: https://www.preventproject.info

Links

https://www.preventproject.info

https://www.utac.com

https://eur-lex.europa.eu/eli/reg/2024/2847/oj

Keywords

PrEVent, e-mobility, cybersecurity, hardware security, firmware security, cyber resilience, Cyber Resilience Act, security by design, secure boot, charging station, electric vehicle, ISO/SAE 21434, UNECE R155

Quantum computing is expected to reshape the future of cybersecurity. Discover why Public Key Infrastructures (PKIs) are becoming a strategic challenge for electric vehicle charging and how the PrEvent project is exploring post-quantum solutions for tomorrow’s mobility ecosystem.

Digital certificates are the foundation of trust in the electric vehicle charging ecosystem, enabling secure communications and services such as Plug & Charge. However, the emergence of quantum computing raises new challenges for the cryptographic algorithms used by today’s Public Key Infrastructures (PKIs). More specifically, quantum computing mainly threatens the asymmetric cryptographic algorithms that underpin today’s PKIs, digital signatures and key establishment mechanisms. Current PKIs largely rely on RSA and Elliptic Curve Cryptography (ECC), which are expected to become vulnerable in the presence of sufficiently powerful quantum computers. This article explains the role of PKIs in ISO 15118, the risks posed by quantum technologies, and how the PrEvent project is evaluating a post-quantum PKI to help prepare future standards and deployments.

Why are digital certificates essential?

Digital certificates (X.509) [4], commonly used with the TLS protocol [3], are one of the fundamental building blocks of secure digital communications. They are used not only for web browsing, but also to secure communications between software components, such as EVSE-to-CSMS connections or backend-to-backend communications.

They provide several essential security functions:

• Authenticating the identity of a server to a client (e.g. HTTPS websites).
• Authenticating the identity of a client to a server through mutual authentication.
• Ensuring the authenticity and integrity of messages or documents through digital signatures.
• Establishing encrypted communication channels using TLS.

Trust in these certificates relies on a Public Key Infrastructure (PKI). This trust model is based on a chain of trust involving Certification Authorities (CAs and Sub-CAs), which issue and manage certificates, and ultimately on each certificate holder’s ability to prove possession of the private key associated with its certificate. In current deployments, these certificates typically rely on RSA or ECC-based public key cryptography.

The role of certificates in the EV charging ecosystem

Digital certificates play a central role in the electric vehicle charging ecosystem. They are used to authenticate the different actors involved and to secure communications between charging infrastructure components.

They are a key element of the ISO 15118 communication protocol, which defines the communication between electric vehicles and charging stations.

During the establishment of the TLS session, ISO 15118-2 [2] relies on charging station authentication, while ISO 15118-20 [2] introduces mutual TLS authentication between the vehicle and the charging station.

Certificates are also at the heart of the Plug & Charge (PnC) use case. In this scenario, the vehicle stores a Contract Certificate representing the customer’s mobility contract with its eMobility Service Provider (eMSP). This certificate allows the charging infrastructure to authenticate the mobility contract, automatically authorise the charging session without requiring an RFID card or mobile application, and associate the charging transaction with the contract that will be billed.

Why is certificate security critical?

Compromising a PKI or one of its trusted actors represents a major cybersecurity incident because it undermines the trust placed in all certificates issued by that infrastructure.

Depending on the scope of the compromise, the consequences may include:

• Impersonation of a mobility contract, enabling fraudulent charging sessions.
• Unauthorised interactions with V2G ecosystem actors, potentially affecting energy management processes.
• The need to replace or renew thousands—or even millions—of certificates following the compromise of a CA or Sub-CA.
• Long-term confidentiality risks if encrypted communications are intercepted today and decrypted in the future using quantum computers, a scenario commonly referred to as “Harvest Now, Decrypt Later”.

Why should we prepare for the quantum era?

Today’s public key cryptography relies on mathematical problems that are considered computationally infeasible to solve using classical computers.

The emergence of sufficiently powerful quantum computers could challenge this assumption by making widely used asymmetric cryptographic algorithms vulnerable. For example, RSA and Elliptic Curve Cryptography (ECC), which are currently the foundation of most PKIs and TLS deployments, are expected to become vulnerable to quantum attacks.

Although this threat is not yet immediate, operators of critical infrastructures must anticipate this evolution to ensure the long-term security of their systems. Migrating towards post-quantum cryptography is therefore becoming an important strategic objective. Examples of standardised post-quantum algorithms include ML-KEM (formerly CRYSTALS-Kyber) [6] for key establishment and ML-DSA (formerly CRYSTALS-Dilithium) [7] for digital signatures, although the specific algorithms adopted will depend on future standards and deployment requirements.

The PrEvent post-quantum PKI experiment

The PrEvent [5] project aims to strengthen cybersecurity across the electromobility ecosystem by developing and evaluating innovative solutions capable of preventing, detecting, and mitigating cyberattacks.

Within this framework, the consortium is conducting an experimental deployment of a post-quantum PKI.

This work combines the complementary expertise of:

• Gireve, operator of the ISO 15118-2 PKI and future operator of the ISO 15118-20 PKI.
• Vicomtech, a research and technology centre with expertise in post-quantum cryptography.

The objective is to deploy an experimental PKI based on the ISO 15118-20 trust model, where certificates are signed using post-quantum cryptographic algorithms selected and integrated with Vicomtech’s support.

Possible candidate algorithms may include standardised digital signature schemes such as ML-DSA, although alternative post-quantum signature algorithms may also be considered depending on the project objectives and future standardisation efforts.

This experimental PKI will be evaluated in three successive stages:

• within Gireve’s laboratories;
• on UTAC’s testing platforms;
• under real operating conditions at the pilot site in Ljubljana, Slovenia.

Beyond validating the functionality of the experimental PKI, the experimentation may also provide valuable insights into practical aspects such as certificate size, computational overhead, interoperability and deployment considerations associated with post-quantum cryptography.

Scope and future work

This experiment is not intended to provide a fully compliant implementation of an ISO 15118-20 PKI. The current version of the standard specifies cryptographic algorithms that do not yet include post-quantum mechanisms.

However, the results of this work will provide valuable technical feedback regarding the feasibility of integrating post-quantum cryptography into the ISO 15118 ecosystem and may contribute to future discussions within the ISO working groups responsible for the evolution of the standard.

It should also be noted that this experiment focuses on the PKI and certificate infrastructure. Achieving end-to-end quantum-resistant communications will also require the migration of TLS cryptographic mechanisms—particularly key exchange and digital signature algorithms—to post-quantum alternatives.

Current standardisation efforts within the IETF are also exploring the integration of post-quantum and hybrid cryptographic mechanisms into TLS, enabling a gradual migration while preserving interoperability with existing deployments. Similarly, the transition towards post-quantum PKIs is expected to be progressive, requiring interoperability between classical and post-quantum cryptographic mechanisms during the migration period.

Author: Thomas Fousse (Gireve)

References

[1] International Organisation for Standardisation (ISO). (2014). Road vehicles — Vehicle to grid communication interface — Part 2: Network and application protocol requirements. ISO 15118-2:2014. Geneva: International Organisation for Standardisation.

[2] International Organisation for Standardisation (ISO). (2022). Road vehicles — Vehicle to grid communication interface — Part 20: 2nd generation network layer and application layer requirements. ISO 15118-20:2022. Geneva: International Organisation for Standardisation.

[3] Rescorla, E. (2018). The Transport Layer Security (TLS) Protocol Version 1.3. RFC 8446. Internet Engineering Task Force (IETF). Available at: https://datatracker.ietf.org/doc/rfc8446/

[4] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., Housley, R. and Polk, W. (2008). Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile. RFC 5280. Internet Engineering Task Force (IETF). Available at: https://datatracker.ietf.org/doc/rfc5280/

[5] PrEvent Project. (2024). Preventing and detecting cyber threats in the electric mobility ecosystem. Available at : https://www.preventproject.info/

[6] National Institute of Standards and Technology (NIST). (2024). FIPS 203 – Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM). Available at: https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.203.pdf

[7] National Institute of Standards and Technology (NIST). (2024). FIPS 204 – Module-Lattice-Based Digital Signature Standard (ML-DSA). Available at: https://nvlpubs.nist.gov/nistpubs/fips/nist.fips.204.pdf

Keywords

PrEvent, Post-Quantum Cryptography, Public Key Infrastructure (PKI), Digital Certificates, Cybersecurity, Electric Vehicle, ISO 15118, Plug & Charge (PnC), Vehicle-to-Grid (V2G), TLS Security, Quantum-Resistant, Gireve, Vicomtech, ML-KEM, ML-DSA, Quantum-safe PKI, Post-Quantum TLS

This article provides an overview of Engineering’s role in the PrEVent Project and its contributions to strengthening cybersecurity in the e-mobility ecosystem.

As e-mobility systems become more connected and complex, cybersecurity is essential for their safe and reliable deployment. The PrEVent Project addresses these challenges by developing solutions across the ecosystem. Engineering Ingegneria Informatica S.p.A., a leading Digital Transformation company with more than 40 years of experience and a strong international presence, participates as Technical Coordinator, supporting alignment and consistency across technical activities.

The transition towards electrified and connected mobility is reshaping the way transport systems operate. Vehicles, charging infrastructure, backend platforms, and energy systems are increasingly interconnected, creating new opportunities while also expanding the potential attack surface.

The PrEVent Project addresses this challenge by developing solutions that cover the full cybersecurity lifecycle, from prevention to validation. Within this context, Engineering contributes to both methodological and technical activities, while also ensuring consistency across the different components developed within the project.

Engineering also leads Work Package 2 (WP2), focusing on prevention and preparation measures. These activities aim to strengthen the resilience of e-mobility systems through structured risk assessment, threat modelling, and the definition of practical security guidelines.

Cyber risk assessment and TARA methodology

A key contribution of Engineering within PrEVent is the definition of a Threat Analysis and Risk Assessment (TARA) methodology.

This approach provides a structured way to identify threats, evaluate risks, and define mitigation strategies. It builds on recognised standards such as ISO 21434 and ISO 15118, ensuring alignment with existing best practices [1][2].

An important aspect of this methodology is its adaptability. It is tailored to the specific characteristics of the project pilots, allowing it to reflect real operational conditions rather than remaining purely theoretical.

PreRisk tool

To support risk analysis activities, Engineering will contribute to developing the PreRisk tool.

PreRisk is designed as a modular and interactive solution that supports stakeholders in understanding and managing cybersecurity risks across the e-mobility ecosystem. In particular, it enables:

• identification of relevant assets
• analysis of threats and vulnerabilities
• evaluation of cybersecurity and privacy risks
• prioritisation of mitigation actions

By structuring these steps, the tool helps translate risk analysis into more practical and actionable decision-making processes.

Anomaly detection and monitoring

In addition to preventive approaches, Engineering contributes to detection and monitoring capabilities within the project.

These solutions focus on identifying abnormal behaviours and potential security threats during system operation. By combining intrusion detection mechanisms with data analysis techniques, they support improved visibility of system behaviour and enable earlier identification of potential issues.

System integration and validation

Another important area of work is system integration and validation.

Given the multi-partner nature of the project, ensuring that all components work together as expected is essential. Engineering contributes to integrating the different solutions and supports testing activities carried out in pilot environments.

These validation activities help assess how the developed solutions perform in realistic scenarios and provide valuable feedback for further refinement.

Conclusion

The PrEVent Project contributes to addressing cybersecurity challenges in increasingly connected e-mobility systems by combining methodologies, tools, and validation activities.

In this context, Engineering supports both technical coordination and the development of key components such as the TARA methodology, the PreRisk tool, and monitoring capabilities. By bridging methodological approaches with operational solutions, these contributions help enable more secure, reliable, and scalable e-mobility systems.

Author: Jessica Testa (ENG)

References

[1] ISO/SAE (2021). Road vehicles — Cybersecurity engineering (ISO/SAE 21434:2021). International Organization for Standardization.

[2] ISO/IEC (2019–2022). Road vehicles — Vehicle to grid communication interface (ISO 15118). International Organization for Standardization

Links

https://www.eng.it

https://www.preventproject.info

Keywords

e-mobility, cybersecurity, PrEVent project, TARA methodology, PreRisk, anomaly detection, intrusion detection, system integration, risk assessment, cyber resilience, EV ecosystem