Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What I mean by public device?

E.g. in Germany we have small stations to charge cars powered by electricity. This stations are small towers with a flap. Behind the flap are plugs to connect the tower with your car.

enter image description here

Process of charging:

To utilize the tower we use a smartphone app. The user can browse through a number of loading towers located in the country. By pushing a single button the flap opens and reveals the plugs.

Security issues:

The problem is that anybody even people 100 miles away can use the app to trigger the flaps. So there may be people who abuse the this service.

How can we secure such a public service against abuse? I thought about one thing:

  • Allow only 3 actions in e.g. 2 hours

Any other ideas?

share|improve this question

closed as too broad by Eric G, Mark, Gilles, Adnan, Xander Jul 28 at 12:30

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs.If this question can be reworded to fit the rules in the help center, please edit the question.

4  
Out of interest, what can you do if you don't have a smartphone that can download and run apps? –  Pharap Jul 27 at 6:46
3  
That's not very user friendly for people without smartphones. Remind me not to use an electric car in Germany if that's the only available recharging option. –  Pharap Jul 27 at 10:17
3  
Provide the user with some sort of key-card or chip-and-pin card that they can use to unlock the station. As for paying, machines have been capable of correctly accepting payment in exchange for a service for a very long time. –  Pharap Jul 27 at 10:23
1  
@artworkad if the user is registered and has to pay for the electricity if he triggers the flap to open, why would he open a random flap anywhere? This brings him no benefit and only costs money! –  Josef Jul 27 at 11:41
3  
That's one cool denial of service attack. Go ahead, open the flap for me, and let me pull out the cable and charge my car, which will be billed on your account. Look, what does it matter if I can't open the flap when it's already open, and you'll pay for the electricity that I take out :) –  Damon Jul 27 at 23:16

9 Answers 9

up vote 40 down vote accepted

Stick a little button on the tower itself, which also has to be pressed in order to open the flap.

enter image description here Plate #1 from my pending patent application.

share|improve this answer
2  
+1 for the idea, and another one for the drawing, if I could. –  Jost Jul 26 at 20:20
28  
+1: Your diagram really helped me visualize the tough concept. –  Keavon Jul 27 at 5:33
    
This would however still be a problem identifying who used the tower: although an unlikely circumstance, say 2 users triggers each other's tower (on purpose or not) then pressed the button. Or even a random guy walking around and pressing the button. Who used which tower? –  gravgun Jul 27 at 14:52
    
If the user has a smartphone and that is a requirement, why not use a GPS? –  Kroltan Jul 27 at 16:27
1  
@Vi. You'd have to ask the OP (artworkad シ), but I assumed that the smartphone handles authentication. That is, not every random person walking down the street is allowed to use the towers, only those who have the smartphone app. –  Istvan Chung Jul 28 at 0:22

Add a keypad to your stations.

When the user uses the app, you send them a random code (using an encrypted connection, of course) which needs to be typed into the pad within a few minutes to open it .

To make the system more user-friendly, you could alternatively allow the app to transmit the code via Bluethooth or NFC. But you should not rely on this, because not every mobile device supports these.

share|improve this answer
    
This looks the simpler and most effective solution to me. –  lserni Jul 27 at 21:43

As a user, I find your process rather hostile. I have a regular phone, I have a tablet. I don't always drag them around with me. So I guess I will be avoiding your service.

What I do use is Esso's SpeedPass. RF keychain dongle that lives on my ignition key. As I have to remove the key to open the gas cap it's hugely convenient, also weatherproof and nearly indestructible. The interaction time is about 5 seconds.

If you are looking for a software solution to fit your present infrastructure, my opinion is your infrastructure is fundamentally flawed, thus no good solution exists.

On the plus side, RFID hardware is really cheap.

share|improve this answer
    
On the other hand, I would hate carrying a dongle (or any extra clutter) around, but I have a smart phone with me at all times. Having a choice is good, being forced into carrying something that's convenient for someone not so much. –  domen Jul 28 at 7:47
    
Also, in a bind Tesla cars double as a smartphone. Not sure about other manufacturers. –  Simon Richter Jul 28 at 9:46
    
You could always just use the RFID's that people carry with them instead... London Transport for example now/will use contactless payments in place of cash fares. Even if you didn't make a charge you could still read the card details. –  James Snell Jul 28 at 11:15

The owner of the app requesting a flap open is logged, and any subsequent damages are debted to him/her [option: unless immediately reported and investigated].

That ought to provide a strong incentive for people to

  • never open a power flap that is out of your sight
  • always dutifully close the flap as soon as possible
  • keep the app secure.

Also, it would be probably useful to display the QR-code of a station tower next the station itself. I mean, here I am in front of Baumgarten 17 power station, do I really have to run a georeferenced search to access the power station controls? I'm not advocating going to Bluetooth, but a QR-code looks like an efficient identifier for most models of phones.

User friendliness, security by design etc.

It is probably possible to build on the above concept to ensure locality and user friendliness. Now I am advocating going Bluetooth (or short-range WiFi) all the way by adding e.g. an Arduino board or BlueFlea or Gumstix inside the recharge station.

The app communicates with the Bluetooth node or Wi-Fi open access point (which has no available open Internet routing). If it finds one, it knows it is the recharging station's, and the recharging station will only accept "Open the flap" commands from its DHCP-assigned downlink IPs.

At this point, no QR-code is necessary anymore.

It is still possible for a prankster to open all the flaps of a recharging station from behind the bushes fifty feet away, and leave them open to be vandalized. In that case, I guess the logs from the AP might be enough to file criminal charges.

An addition to Philipp's solution

According to which, you have added a keypad to the recharging station. Now: - the user with a smartphone can use the app and receive the unlock code via HTTPS. - an user without a smartphone (but with a common phone) can send a SMS detailing the station s/he wants unlocked, and receive back a SMS with the unlock code. I.e. you have now a second workflow which needs no app.

share|improve this answer
3  
Security by making behavior rules and disciplining anyone who breaks them is not very customer-friendly. A "Follow the rules or we sue you!" clause in the EULA would be a pretty big red flag for me. It would be both more reliable and better for customer relations when insecure behavior would just be made impossible by design. –  Philipp Jul 26 at 19:08
1  
+1 for the QR code. –  Keavon Jul 27 at 5:34
    
I've tried to address @Philipp 's concerns. I don't think the requirement is anything that would need to go in an EULA, but maybe insecure behaviour can be made, if not impossible, at least less likely. –  lserni Jul 27 at 21:33

As I mention in comments I don't really know what bad outcome(s) you're trying to prevent, but:

  • An option in the app to close the flap (and cease charging, if there's already a car plugged in) would help protect the user against accidentally opening a different tower from the one they intended (or opening a tower by finger-fumbling the single button when they were just trying to browse around) and paying for the charge of the next lucky person to arrive at that tower.

  • You could experiment with applying this option automatically if the user exits the app, or if no car is plugged in for a certain time after opening the flap, but you'd have to understand the amount of variety in your users' workflows. It might seem reasonable to set it to one minute, since plugging in a car is easy, but maybe some users prefer to do the phone thing to open the flap, then get out of the car into the rain, fish the charge lead out of the car, and plug both ends. This might take more than the one minute that seemed ample. And it might seem reasonable that the user can keep the app open until they're done plugging stuff in, but users only have a finite number of hands, and might need one more than you expected for other purposes ;-)

  • Additionally, closing any flap the user already has open at the point they open a flap (or perhaps more user-friendly, forcing them to confirm to close it if they try to open another), would protect the system against a user mischievously or accidentally leaving flaps open all over the country.

  • You can't use a smartphone app to prove that a malicious user genuinely is present, because they can make their phone lie to your app about its location. However, you can use the app to "prove" that a co-operating user is in the right location. So, the app could check that the phone is close to the tower before opening the flap. This would protect the user against certain kins of abuse or accident, but would not protect the system against abuse by a determined user.

This will inconvenience a few users, along the lines of "I left my phone at home, and needed to charge my car, so I called my phone. My spouse picked up, and I asked them to open the tower I need. Why did you stop this working, and how do I get my phone and my car into the same place at the same time given that my car battery is flat?". However, since it's for the user's protection and not that of the system, it doesn't have to be a block, it could just trigger an additional confirmation ("that tower is nowhere near you, are you sure you want to proceed?").

The only thing that distinguishes this case of a forgotten phone from abuse, is that the owner actually has the car and plans to charge it, so:

  • If you can add something to the car, then you could perhaps use the tower to detect that the right "something" is near the tower before opening the flap. Probably bluetooth has enough range, and that RF is open to use without special license etc. This might not defend against determined users, who perhaps could sit comfortably in their home with their phone while an accomplice carries their "something" around the country. I can't tell whether you would consider this a flaw.

Edit, the threat you mentioned above suggests a particular scenario:

A mischievous user (by which I mean someone who wants to mess with the system, but isn't extracting money from it) tries to interfere with people opening flaps. So he sends an "open flap" message just as they're sending one of their own, or he spams the system with "open flap" messages, or whatever. This results in an innocent user doing one of two things:

  • knowingly or unknowingly charges their car on the malicious user's account
  • feels unable to charge their car, since it keeps opening on the malicious user's account.

The first thing might seem harmless, but leads to two problems:

  • the malicious user disables the charge part way through (assuming my other measures above exist), leaving the innocent user to return to an uncharged car.
  • the malicious user successfully disputes the bill (in point of fact they didn't receive the charge they paid for, so they might get away with just proving they weren't in the area), and you've performed a charge that nobody pays for.

Unless you can establish that only one user is genuinely close to the tower you cannot automatically adjudicate between the innocent and the malicious user, however you can:

  • Put a button on the tower to close the flap for re-use, which gives the innocent user a slight advantage in the battle to open it on their account.
  • Track when users are engaged in "flap wars", including when someone presses the button on them, so that you can investigate their patterns of use and apply usage limits or ban them if necessary.
  • Confirm in the app when a car is charging on their account, and when an "open flap" attempt fails due to the flap being opened by another account, so that the innocent user at least knows what is going on.
  • Forget that the smartphone happens to be online, and require an NFC tap on the tower to open it. Of course this further limits what phones the app will work on. You might like to provide cards for those whose phones won't do it, but then again the system has already decided to use phones rather than cards, so maybe there's a reason it won't do that. This re-opens the "I left my phone at home" scenario, so for emergencies you might allow users a very limited number of flap-openings without a tap.

Be aware also that the abuser needn't be 100 miles away. They could interfere with the innocent user while actually present. In fact they could be standing right near the tower using their phone, enjoying the confused look on the innocent users' faces as the tower fails to operate properly. Hopefully, however, they can't be close enough to tap their card/phone without the innocent user realizing what they're doing. Naturally you can't hope for your system to stop a malicious user who is willing to actually stand at the tower taking obvious actions to stop innocent users from accessing it -- that's a matter for the police...

share|improve this answer
    
+1 very comprehensive, thank you! –  artworkad シ Jul 27 at 12:57

Through the app you could

  • implement location services to determine if in fact the user is next to the station.
  • use a blutooth mechanism to allow the flap to open from the phone
  • have a qr code as mentioned before which the user must scan to open
share|improve this answer
3  
Location services are not secure. A rooted Android phone can give an App any location it wanst. –  Christian Jul 26 at 17:35
    
It does not even need to be rooted, a regular android phone can spoof the location. These are just general guidelines to get started. –  Jay Lamay Jul 26 at 18:21
    
and GPS itself can be trivially spoofed with a £10 piece of kit plugged into your cigarette lighter socket –  Lightness Races in Orbit Jul 27 at 17:41
    
A static QR code does not change. It can be looked up once and used for abuse. –  artworkad シ Jul 28 at 7:19
    
A QR on a small display on the charging station could be changed regularly (or supplied on demand). –  James Snell Jul 28 at 11:07

To utilize the tower we use a smartphone app. The user can browse through a number of loading towers located in the country. By pushing a single button the flap opens and reveals the plugs.

Use the phone location services. Only show stations that are in a certain range of the phone. This is also more user friendly as your station selection is going to be much easier when you actually want to charge.

If there is actual vandalism (as opposed to curious users that just try out a button on their phone), you could also:

  • print/paint a short random number on each station (it needs to be obvious when you're sitting in front of it, but random so you can't guess it)
  • ask users to confirm the station (type the number in their app) to open it

Bonus points if you only ask them to confirm the number for stations they haven't been to yet.

share|improve this answer

I would simply use bluetooth to connect to the tower and disable control for all other users around while the phone is connected.

Almost every smartphone or tablet today has bluetooth. +User wouldn't need 3G. He could just drive to the station and open it using bluetooth.

share|improve this answer
1  
Easy to DoS: make a device connect there again and again and block the service for legitimate users. –  Vi. Jul 27 at 23:27
    
Let's add a button, that would disconnect everyone connected. –  user2486570 Jul 28 at 14:48

Why is this even a problem?

Simply display to the user: "If you open a tower you are liable for any damage to the equipment until it is closed"

Just implement an option to close an accidentally opened flap, so you can sue the user and he can't bail out by claiming it was an accident.

and if you're billing anything for the service, you could also apply a "service-charge" if you open a tower and don't use it.

Details for Germany: Wenn jemand die Klappe öffnet ohne dass er dabei ist, ist das entweder Vorsatz oder grob fahrlässig, was Schadensersatzansprüche abdecken müsste.

share|improve this answer
    
If they're really concerned about damages, they should have just added a camera to the station. That'll protect the user and the station, and cuts down the complexity of having to have a separate app to charge a car. –  Lie Ryan Jul 28 at 11:11
    
But cameras are expensive, need maintanance, personel and special permits to install in germany (which you might not get at all on public property) ;-) –  Falco Jul 28 at 11:32
    
Banks manage to put camera in ATMs. Also, maintenance isn't an issue, the charging station needs maintenance even with no camera anyway. –  Lie Ryan Jul 28 at 11:36

Not the answer you're looking for? Browse other questions tagged or ask your own question.