Zero-Knowledge Proofs to Confirm Software Execution Versions

A well-accepted practice for cybersecurity is the continuous scanning and patching of software. However, while software versions stored on a device may be accurate, software can remain vulnerable when executing in memory. As widely reported, including as recently as December 2023 by the National Security Agency (NSA)1, memory vulnerabilities can make up as much as 70% of cybersecurity issues. Although memory issues are understood to be a significant issue, there are relatively few cybersecurity measures to safeguard against memory tampering in a consistent manner. VIA proposes to address the memory vulnerability issue in electric vehicle charging infrastructure (EVCI) through the use of a zero-knowledge proof (ZKP), that itself is both memory safe and quantum resistant. Specifically, VIA proposes to create a quantum resistant ZKP based on a zero-knowledge succinct transparent argument of knowledge (zk-STARK) implementation. Unaddressed memory vulnerability issues result in a high likelihood of high-impact cyber attacks that will result in a significant risk of grid instability. For this Phase I effort, VIA will focus on three technical objectives: ZKP Development - VIA will work with Idaho National Laboratory (INL), a recognized leader in the field of EVCI research and testing, to ensure the ZKP results are rigorously evaluated. ZKP Deployability - VIA will work with an EV charging station already on VIAĺs premises, the EV equipment manufacturer, and Hitachi Energyĺs mobility division to test deployability (i.e., that the initial software check system can be run on EVCI equipment). ZKP Speed - VIAĺs experience with the Department of Defense continuous verification methods suggest checks be run as 24/7. With this benchmark, the ZKP software must be efficient to run quickly enough to complete several times per day.