Search NASA⌕ Search

Engineering topics

Hamlet, Jason

Publications and source records attributed to Hamlet, Jason.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

Secure authentication using recurrent neural networks

A computer-implemented method of user authentication is provided. The method comprises combining, by a computer system, a user recurrent neural network with a system recurrent neural network to form a unique combined recurrent neural network. The user recurrent neural network is configured to generate a unique user key, and the system recurrent neural network is configured to generate a system key. The computer system inputs a predetermined input into the combined recurrent neural network, and the combined recurrent neural network generates a unique combined key from the input, wherein the combined key differs from both the user key and system key. The computer system then associates the combined key with a unique access authorization to authenticate a user.

Aimone, James Bradley↗
DOE OSTI2021

Artificial Diversity and Defense Security (ADDSec)

Artificial Diversity and Defense Security (ADDSec) machine learning algorithms are used to classify and cluster threats so that an appropriate response can be initiated as a mitigation strategy. The package includes an ensemble of machine learning algorithms such as Support Vector Machines, naïve bayes, logistic regression, and random forest that evolve with the data to recognize anomalous behavior at the host and network levels. Inputs into the machine learning algorithms include end host system calls, system utilization, packet captures, and syslog messages. The machine learning algorithms can be retrained based on user defined intervals or on the number of packets received. ADDSEC's threat responses include Internet Protocol (IP) Address randomization, application port number randomization, and application library randomization. The IP randomization implementation is built on top of a Software Defined Networking (SDN) framework. The SDN controller installs flows on each of the SDN switches with randomized source and destination IP addresses. The application port numbers are randomized using iptables. The application library randomization is created with a LLVM compiler. All randomization schemes are transparent to the endpoints on the network. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525. SAND2021-3379 O

Cox, RebeccaE.↗
DOE OSTI2021

Integrated circuit authentication from a die material measurement

The various technologies presented herein relate to measuring a signal generated by a die-based test circuit incorporated into an IC and utilizing the measured signal to authenticate the IC. The signal can be based upon a sensor response generated by the test circuit fabricated into the die, wherein the sensor response is based upon a property of the die material. The signal can be compared with a reference value obtained from one or more test circuit(s) respectively located on one or more reference dies, wherein the reference dies are respectively cut from different wafers, and the location at which the reference dies were cut is known. If the measured signal matches the reference value, the die is deemed to be from the same cut location as the dies from which the reference value was obtained. If the measured signal does not match the reference value, the die is not authenticated.

Zortman, William A.↗
DOE OSTI2020

Randomization of dangling nodes in a digital circuit design to mitigate hardware trojans

Described herein are various technologies pertaining to randomizing logic associated with dangling nodes in a digital circuit design. A dangling node is an input to or output from a logic gate in the digital circuit design that is identified as not impacting a desired output of the digital circuit design. Randomizing the logic associated with a dangling node can include deleting a logic gate, adding a logic gate, replacing a logic gate with another logic gate, etc. Randomizing the logic associated with the dangling node prevents hardware trojans that may have been inserted into the circuit design from being implemented in a circuit that is generated based upon the design.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

System for authenticating an additively manufactured object

A method for authenticating an additively manufactured (AM) object is disclosed herein. A computing device obtains a measurement that is indicative of a stochastic distribution of dopant incorporated into the AM object. The computing device generates authentication data for the AM object based upon the measurement, and authenticates the AM object based upon the authentication data.

36 MATERIALS SCIENCE↗
DOE OSTI2020

Dynamic signature generation from keystroke dynamics

Described herein are various technologies pertaining to extracting cryptographic keys from user behavioral biometrics, specifically keystroke dynamics. Such cryptographic keys can be used for, among other things, user authentication throughout computer sessions. Keystroke dynamics are timing data indicating when keys were pressed and when they were released.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

Authenticating a printed circuit board

A computing module is described herein, wherein the computing module is configured to perform acts including generating a digital signature for a printed circuit board (PCB), wherein the digital signature is based upon a sensor signal generated by a sensor that is electrically coupled to at least one of a trace of the PCB or an electrical component of the PCB. The acts further include determining that the PCB is authentic and is free of tampering based upon the digital signature. The acts additionally include outputting an indication that the PCB is authentic and is free of tampering responsive to determining that the PCB is authentic and is free of tampering.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2019

Integrated circuit authentication from a die material measurement

The various technologies presented herein relate to measuring a signal generated by a die-based test circuit incorporated into an IC, and utilizing the measured signal to authenticate the IC. The signal can be based upon a sensor response generated by the test circuit fabricated into the die, wherein the sensor response is based upon a property of the die material. The signal can be compared with a reference value obtained from one or more test circuit(s) respectively located on one or more reference dies, wherein the reference dies are respectively cut from different wafers, and the location at which the reference dies were cut is known. If the measured signal matches the reference value, the die is deemed to be from the same cut location as the dies from which the reference value was obtained. If the measured signal does not match the reference value, the die is not authenticated.

47 OTHER INSTRUMENTATION↗
DOE OSTI2019

Backplane filtering and firewalls

Described herein are various technologies for providing active mitigation of cyber-attacks against industrial and other control systems. A filtering device is connected to a backplane of a control system and receives communications from various modules of the control system. The filter device analyzes the received communications and determines whether they are genuine and permissible communications for the control system. Validated signals are output to a communications bus of the control system by the filter device, while impermissible communications are blocked. The filter device can be interposed between the modules of the control system and the backplane, or the filter device can be included as a component of a control system backplane.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2019

Field programmable gate array bitstream verification

Described herein are various technologies pertaining to confirming an integrity of a FPGA. A verifier circuit is placed into an FPGA bitstream to enable external verification of the FPGA configuration in real time without requiring readout of the FPGA configuration itself. Number generators are utilized to generate a key which is shared between the FPGA and an external verification component (VC). The key is utilized to configure an initial state of sequence registers respectively located on both the FPGA and the VC. When the FPGA is operating with an approved configuration, output from the sequence registers at the FPGA and the VC are the same.

38 RADIATION CHEMISTRY, RADIOCHEMISTRY, AND NUCLEA↗
DOE OSTI2019

Circuit that includes a physically unclonable function

Described herein are various technologies pertaining to authentication of integrated circuits by using external factors to affect or modify an output of a physically unclonable function (PUF) circuit. In an example, the output of the PUF circuit in response to a challenge signal can be sensitive to changes in environmental factors. In another example, the output of the PUF circuit can be sensitive to user-selectable configuration parameters of the PUF circuit. In yet another example, the output of the PUF circuit can be modified by additional circuitry external to the PUF circuit based upon one or more selectable or configurable inputs. A PUF-based device authentication system that uses external factors as authentication inputs to affect a challenge response of the device authentication system can enhance authentication capabilities by permitting multi-factor authentication.

42 ENGINEERING↗
DOE OSTI2019

Repeatable masking of sensitive data

The various technologies presented herein relate to enabling a value generated based upon a physical unclonable function (PUF) response to be available as needed, while also preventing exposure of the PUF to a malicious entity. A masked PUF response can be generated based upon applying a function to a combination of the PUF response and a data file (e.g., a bitstream), and the masked PUF response is forwarded to a requesting entity, rather than the PUF response. Hence, the PUF is masked from any entity requiring access to the PUF. The PUF can be located in a FPGA, wherein the data file is a bitstream pertinent to one or more configurable logic blocks included in the FPGA. A first masked PUF response generated with a first data file can have a different value to a second masked PUF response generated with a second data file.

Hamlet, Jason↗
DOE OSTI2018

Framework and methodology for supply chain lifecycle analytics

The various technologies presented herein relate to pertaining to identifying and mitigating risks and attacks on a supply chain. A computer-implemented representation of a supply chain is generated comprising nodes (locations) and edges (objects, information). Risk to attack and different attack vectors can be defined for the various nodes and edges, and further, based upon the risks and attacks, (difficulty, consequence) pairs can be determined. One or more mitigations can be generated to increase a difficulty of attack and/or reduce consequence of an attack. The one or more mitigations can be constrained, e.g., by cost, time, etc., to facilitate determination of how feasible a respective mitigation is to implement with regard to finances available, duration to implement, etc. A context-free grammar can be utilized to identify one or more attacks in the supply chain. Further, the risks can undergo a ranking to enable mitigation priority to be determined.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2018

Data to hardware binding with physical unclonable functions

The various technologies presented herein relate to binding data (e.g., software) to hardware, wherein the hardware is to utilize the data. The generated binding can be utilized to detect whether at least one of the hardware or the data has been modified between an initial moment (enrollment) and a later moment (authentication). During enrollment, an enrollment value is generated that includes a signature of the data, a first response from a PUF located on the hardware, and a code word. During authentication, a second response from the PUF is utilized to authenticate any of the content in the enrollment value, and based upon the authentication, a determination can be made regarding whether the hardware and/or the data have been modified. If modification is detected then a mitigating operation can be performed, e.g., the hardware is prevented from utilizing the data. If no modification is detected, the data can be utilized.

97 MATHEMATICS AND COMPUTING↗