启用SDN的电动汽车充电网络中的移动目标防御

中文摘要 AI 辅助

软件定义网络（SDN）作为电动汽车充电基础设施（EVCI）的灵活可编程控制技术正逐渐兴起，但其对EVCI的安全增益仍未得到充分探索。启用SDN的EVCI面临着IT与OT组件融合带来的日益增多的网络威胁，尤其是低速率拒绝服务（DoS）攻击。早期研究指出OT网络中存在低速率攻击趋势，这类攻击可能耗尽SDN交换机的流表，导致整个充电站瘫痪，且不会触发基于流量的防御机制。本文提出CS-SHIELD，一种针对启用SDN的EVCI通信的移动目标防御机制。我们展示了该机制的实现：通过跨层身份验证检测恶意流表规则，并通过为所有活跃充电器重新分配虚拟IP地址做出响应。在带有真实充电协议实现的仿真SDN测试台上进行的实验表明，CS-SHIELD在攻击下保持站点完全可用，响应迅速，在正常条件下仅增加可忽略的延迟。每次响应时的重新分配（洗牌）方法使攻击者先前的侦察知识变得毫无价值。

英文摘要

Software-Defined Networking (SDN) is emerging as a promis- ing technology for EV Charging infrastructure (EVCI) since it enables flexible, programmable control of EVCI networks, yet its security gain to EVCI remains underexplored. SDN-enabled EVCI faces an increas- ing number of cyber threats arising from the convergence of IT and OT components; in particular, low-rate Denial-of-Service (DoS) attacks. Ear- lier works identify a trend toward low-rate attacks in OT networks that may exhaust SDN switch flow tables and which can result in disabling the entire charging sites without triggering volume-based defenses. In this paper, we propose CS-SHIELD, a Moving Target Defense mecha- nism for SDN-enabled EVCI communication. We showcase the imple- mentation of the proposed mechanism that detects malicious flow table rules via cross-layer identity verification and responds by reassigning virtual IP addresses to all active chargers. Experiments on an emulated SDN testbed with a real charging protocol implementation demonstrate that CS-SHIELD maintains full site availability under attack, responds quickly, adds only a negligible delay under normal conditions. The reas- signing (shuffle) approach at each reaction makes the earlier reconnais- sance knowledge by the attacker rendered worthless.

发表机构

• Linköping University（林雪平大学）

机构由 AI 辅助整理，请以论文原文为准。