A quantitative framework for physical cybersecurity in public EVSE systems

Public Electric Vehicle Supply Equipment (EVSE) is increasingly exposed to physical cyberattacks due to its open, unattended, and hardware-accessible deployment in critical infrastructure. Despite growing connectivity, there is a lack of structured and quantitative methodologies to assess the risks arising from physical manipulations targeting components such as power supplies, USB ports, and RFID readers.

This study introduces HO-PHYSICS (Holistic Physical Cybersecurity Systematics), a novel framework designed to identify, model, and quantitatively evaluate physical cyber threats in public EVSE environments. The framework consists of three integrated components: (1) Hybrid Threat Structuring (HTS) for modeling attack trees with physical and logical nodes, (2) Attack Potential Evaluation (APE) for multi-criteria risk scoring, and (3) Simulative System Stress Testing (S3T) based on dynamic MATLAB/Simulink simulations.

To validate the framework, three representative attack scenarios are examined: PSU manipulation, RFID spoofing, and USB-based sabotage. The corresponding APE scores range from 23 to 30 (out of 50), indicating high feasibility and low detectability. Time-based simulations confirm critical system risks and enable a structured derivation of mitigation strategies.

The developed framework bridges a methodological gap between normative security standards and operational risk analysis. It offers a transferable tool for researchers, infrastructure operators, and regulators to assess and improve physical cybersecurity in EVSE systems.