Hardware-accelerated CAN security for electric vehicle charging stations

Abstract

The rapid expansion of electric vehicle (EV) charging infrastructure has increased the need for secure and reliable embedded control systems, particularly as charging stations operate simultaneously at the grid edge and the network edge. While modern EV charging stations depend on the Controller Area Network (CAN) bus to coordinate safety-critical power-electronics functions, this interface lacks authentication and is vulnerable to spoofing, malformed messages, and unsafe command injection. To address these risks, this thesis presents the design and implementation of a secure, man-in-the-middle hardware accelerator CAN monitor intended for integration with the power-electronics controller in EV charging stations. The accelerator performs real-time validation of CAN identifiers and enforces hardware-accelerated limit checking for voltage, current, and power, ensuring that only authorized and physically safe commands reach the power stage. By offloading these checks into a dedicated hardware module, the system provides deterministic, low-latency protection that is resistant to firmware tampering and software-based attacks. Experimental evaluation demonstrates that the accelerator introduces negligible communication overhead while reliably detecting spoofed, malformed, or out-of-range CAN messages. The results show that embedding a dedicated security and safety co-processor within the EVCS architecture can significantly enhance resilience against CAN-borne cyberattacks and operational faults, contributing to safer and more robust charging infrastructure.