ChargeLink Native
DEP docs ↗Developed byDEVlink

Security and Production Deployment

ChargeLink Native is designed for laboratory and bench networks. Its management API (gRPC) listens on loopback only and requires a new 256-bit access token on every call. It has no TLS transport, and the protocol listeners have no access control of their own, so the deployment still provides the network security boundary. This page lists the controls a production workstation needs.

Network exposure

ListenerDefaultBuilt-in securityRule
gRPC Integration API127.0.0.1:50051bearer token, new at every start (<state-root>\api-token, owner and SYSTEM only); plaintext HTTP/2Loopback only: a non-loopback --listen is refused. No TLS transport, so remote access is not offered; do not proxy or tunnel the port. The token does not protect against the ChargeLink account or an administrator.
EVSE listener:: UDP 15118, TCP 50118optional/mandatory TLS per protocolFirewall rules scoped to the bench adapter and fe80::/10; the bench network is isolated from the corporate network.

Report suspected vulnerabilities to security@devlink.se; do not open a public issue. Our coordinated vulnerability disclosure policy at https://devlink.se/security/ explains what to include and how we respond. Security updates are free of charge for every licence type and are published as advisories at https://devlink.se/security/. The SBOM (CycloneDX) and the OSV report ship in the package's licenses\ and manifest\ folders. Never add a firewall allow rule for 50051 on a shared network. The VeriStand bench needs only the EVSE/EVCC link-local rules and the ICMPv6 diagnostics rule of its setup guide.

Credentials and keys

  • Store licenses, private keys, PFX files and trust anchors under restricted ACLs: 
    icacls C:\ChargeLinkData\pki      /inheritance:r /grant:r 'Administrators:(OI)(CI)F' 'SYSTEM:(OI)(CI)F' '<OPERATOR>:(OI)(CI)R'
icacls C:\ChargeLinkData\licenses /inheritance:r /grant:r 'Administrators:(OI)(CI)F' 'SYSTEM:(OI)(CI)F' '<OPERATOR>:(OI)(CI)R'
  • Pass PFX passwords only through --tls-pfx-password-env; never on the command line, in scripts or in profile files.
  • Use production-issued certificates that follow ISO 15118-20 Annex B and keep engineering fixtures (tls-material-init) out of production benches.
  • Private keys are never exported by the redaction policy; do not copy them into support material by hand.

Evidence handling

  • Artifact roots on an access-controlled volume; separate raw and redacted evidence; retention defined per class.
  • Run artifacts redact and review before any external transfer; record transfers.
  • Treat "signed" verdict manifests as SHA-256 integrity seals, not as cryptographic signatures; external signing is a release-process step outside the product.
  • Session artifacts record certificate paths; check that those paths do not reveal confidential project names before sharing.

Accounts and processes

  • Run daily operation as a dedicated non-administrator operator account; use administrator rights only for the workspace installer and firewall changes.
  • The gRPC server and the VeriStand owner host run as foreground processes; if you supervise them with a scheduled task or a service wrapper, run them under the operator account with the explicit runtime and artifact roots.
  • The workspace installation under ProgramData is treated as immutable configuration; change it only through the installer and the delivered tools.

Integrity of the installation

  • Verify the package ZIP hash and record the binary hash (Get-FileHash chargelink.exe) at installation and after every upgrade.
  • Keep Windows, NI VeriStand, .NET and drivers on the versions listed in the Release and Version Matrix; do not mix NI assemblies across releases.
  • Keep the workstation clock synchronised (TLS validity, evidence timestamps).

Enterprise controls

The gRPC EnterpriseService provides deterministic reference implementations of editions, RBAC, service identities, sealed-secret metadata, a tamper-evident audit chain, remote-agent inventory and signed update manifests. They prove the management-plane contracts and can be integrated with your systems, but their reference cryptography is not a substitute for an operating-system key store, HSM, enterprise PKI or a security certification. Authorization decisions from EvaluateAuthorization are not enforced on other RPCs.

HomeTop