EV charging security basics: OCPP, ISO 15118 and Plug and Charge

Two protocols matter for charging security. OCPP connects chargers to a central management system, and ISO 15118 connects the car to the charger. ISO 15118 mandates TLS for Plug and Charge and describes a public key infrastructure for certificates. Each link is a place where identity must be proven.

OCPP: charger to back end

The Open Charge Point Protocol is an application layer standard linking chargers with a central management system. The Open Charge Alliance, a Dutch non-profit, develops it, and it is free to download. Its main purpose is a shared interface that reduces vendor lock-in and supports central monitoring and load control.

Versions in the reference timeline: 1.5 in 2012, 1.6 in 2015, and 2.0 in 2018, a comprehensive overhaul not backward compatible with earlier versions. Certification of 2.0.1 began in 2023, and version 2.1 was released in January 2025, adding distributed energy resource control and vehicle-to-grid capabilities while staying backward compatible with 2.0.1.

The reference says OCPP defines an end-to-end security architecture with guidelines against server hijacking, eavesdropping and device impersonation. It does not say when specific features were added, so check the specification for the profile you deploy.

ISO 15118: car to charger

ISO 15118 defines a vehicle-to-grid communication interface for bidirectional charging. It covers secure communication, smart charging and Plug and Charge.

With Plug and Charge, the driver plugs in and the car identifies and authorizes itself, with no card or app. The car and station establish identity by exchanging public key certificates. Per the reference, TLS is mandatory for Plug and Charge, and the standard describes a V2G public key infrastructure to support it.

An alternative called Autocharge identifies the car by its MAC address. Critics consider it less secure because it lacks a certificate chain, and one carmaker later moved to variable MAC addresses, which stopped Autocharge working on its cars.

Why identity is the central problem

A charger exchanges money, energy and data. Each side needs to know who it is talking to.

• The back end needs to know a real charger is calling, not an impersonator.
• The charger needs to know that a car is who it claims, so the right account is billed.
• The driver needs to know the charger is not a hostile device.

Certificates give a better answer than a MAC address because they can be checked against a chain of trust and revoked.

Operator checklist

1. Enable the strongest security profile your chargers and back end both support, and test that downgrade is impossible.
2. Keep charger management interfaces off the public internet where possible.
3. Plan certificate lifecycle: issuance, renewal, revocation.
4. Update charger firmware on a schedule, and know which version each site runs.
5. Segment chargers from the rest of the corporate network.

The 2025 Pwn2Own Automotive results are a reminder that chargers are targets, with several models exploited during the contest. See the related post on that event.

Safeguard's dependency scanning and SBOM generation can cover back end and app software you build. It does not assess charger hardware or the protocols themselves.

Quick check

Sources

• Open Charge Point Protocol (Wikipedia)
• ISO 15118 (Wikipedia)
• Pwn2Own Automotive 2025 final results (Zero Day Initiative)

Last reviewed: 19 October 2026.