Search NASA⌕ Search

Engineering topics

Saleem, Danish

Publications and source records attributed to Saleem, Danish.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

RESCue Model (RESCue Experiment and Model) [SWR-24-84]

The Renewable Energy and Storage Cybersecurity Research (RESCue) project is a collaborative effort aimed at securing the rapidly growing deployment of transmission-connected hybrid renewable energy systems, consisting of a combination of wind, solar, and/or energy storage equipment, against escalating cyber threats. This project brings together major original equipment manufacturers (OEMs) of wind, solar, and energy storage, along with major asset owners and DOE National Laboratories, to collectively identify cyber threats, assess risks, and develop robust cybersecurity strategies and solutions. The development of hybrid reference architectures has provided comprehensive blueprints for the secure design and integration of hybrid renewable energy systems, accounting for their unique characteristics and interdependencies. Additionally, NREL has created a cyber-resilient design framework that integrates cybersecurity considerations from the start of the system lifecycle, ensuring security is "baked in" from the initial design phase. The research thrusts for the project included (i) development of hybrid reference architectures and (ii) a cyber-resilient design framework for hybrid energy systems. The reference architectures has provided comprehensive blueprints for the secure design and integration of hybrid renewable energy systems, accounting for their unique characteristics and interdependencies. Additionally, NREL has created a cyber-resilient design framework that integrates cybersecurity considerations from the start of the system lifecycle, ensuring security is "baked in" from the initial design phase. A demonstration experiment was developed for one of the architectures using NREL's Cyber Range resources. This experiment configuration, deployable using open-source tools, is provided here in this repository. Additional models were developed for the wind and solar architectures as well, however the configurations for only the Energy Storage scenario are provided here: https://www.nrel.gov/docs/fy24osti/89921.pdf

Hasandka, Adarsh↗
DOE OSTI2024

Renewable Energy and Storage Cybersecurity Research (RESCue) Pilot Final Report

The Renewable Energy and Storage Cybersecurity Research (RESCue) project is a collaborative effort aimed at securing the rapidly growing deployment of distributed energy resources (DERs) and transmission-connected hybrid renewable energy systems against escalating cyber threats. This project brings together major original equipment manufacturers (OEMs) of wind, solar, and energy storage, along with major asset owners and DOE National Laboratories, to collectively identify cyber threats, assess risks, and develop robust cybersecurity strategies and solutions. This publication the final report for the first year of the project.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2024

Securing Solar for the Grid (S2G)

The first slide deck provides an overview of the goals and objectives of the DOE Grid Modernization Initiative's Project entitled "Assessment and Coordination of DER Cybersecurity Standards." It covers the project's ongoing efforts to create a library of standards related to the cybersecurity of DER. The presentation will review the progress of this effort to-date and solicit feedback from participants on future directions. The second slide deck summarizes NREL's accomplishments for last three years under S2G project in a 10-12 min presentation.

clean energy↗
DOE OSTI2024

Assessment and Coordination of DER Cybersecurity Standards

Distributed energy resources (DERs) are becoming increasingly important to the electric grid, including solar energy systems. However, DERs also introduce new cybersecurity risks, including those posed by cloud computing. Standards harmonization is essential for ensuring that DERs are secure and can be safely integrated into the grid. This panel will discuss cyber standards harmonization for solar security. The panel will feature experts from the S2G Program, National Labs and Industry.

14 SOLAR ENERGY↗
DOE OSTI2023

DER Digital Supply Chain Gap Analysis

Solar photovoltaic (PV) cybersecurity is a growing field of research. As deployments of solar PV have increased, cyber risk has also increased. Utility solar PV installations, however, are not required to comply with the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) plan unless they meet a minimum generation threshold of 75 MW. Individual residential-scale solar PV deployments will not meet that generation threshold and are therefore excluded from the NERC CIP requirements. With most solar installations less than 75 MW, solar PV has been deployed with minimal oversight and highly variable cybersecurity maturity. The resources that comprise the digital supply chain can include software, code, data, and other digital components. But as clean energy technologies advance, cybersecurity threats and vulnerabilities continue to evolve and grow in sophistication. Supply chain cybersecurity represents a critical area for ensuring safe operations as the U.S. moves toward a clean energy future.

cybersecurity↗
DOE OSTI2023

Cybersecurity Guidance for Distributed Energy Resource Management Systems (DERMS)

As part of the Securing Solar for the Grid (S2G): Cybersecurity for Solar Systems workshop at RE + in Las Vegas, Nevada, NREL researchers discuss an ongoing effort to develop cybersecurity guidance for vendors and operators of distributed energy resource management systems (DERMS). This guide will prioritize cybersecurity best practices that can be testing and developed for a potential future standard. This presentation will highlight NREL's ongoing work in this area and future areas of research.

cyber↗
DOE OSTI2023

Supply Chain Cybersecurity Recommendations for Solar Photovoltaics

Solar photovoltaic (PV) cybersecurity is a growing field of research. As deployments of solar PV has increased, cyber risk has also increased. However, utility solar PV installations are not required to comply with North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) unless they meet a minimum generation threshold of 75 Megawatts (MW). Individual residential scale solar PV deployments will not meet that generation threshold and are therefore excluded from NERC CIP requirements. With most solar installations below 75MW, solar PV has been deployed with minimal oversight and highly variable cybersecurity maturity. The resources that make up the digital supply chain can include software, code, data, as well as other digital components. However as clean energy technology advances, cybersecurity threats and vulnerabilities continue to evolve and grow in sophistication. Solar PV faces a unique challenge in which it can be deployed in residential buildings and purchased by a consumer directly. This makes the supply chain of PV a unique challenge, where responsible parties for cybersecurity vary widely depending on the type of solar PV being deployed. Supply chain cybersecurity for solar PV represents a critical area for ensuring safe operations as the U.S. moves towards a clean energy future.

14 SOLAR ENERGY↗
DOE OSTI2023

Gap Analysis of Supply Chain Cybersecurity for Distributed Energy Resources

A supply chain is the combination of the ecosystem of resources needed to design, manufacture, and distribute a product. In the context of supply chain cybersecurity, the resources that directly influence this ecosystem include software, data, and/or other digital components. Compromised equipment or software in the supply chain may lead to attacks such as financial loss; denial of service; a breach of confidential or proprietary information from a company, its customers, or its suppliers; ransomware that denies operation of automated equipment for payment; and malicious control actions that could damage equipment and endanger personnel. Currently 60.8% of US energy comes from fossil fuels, 18.9% comes from nuclear energy, and the last 20.1% comes from renewable sources. Federal Energy Regulatory Commission order FERC 2222 and Executive Order 14017 on America's Supply Chains are important milestones for safely expanding generation from renewable energy and achieving the goal of a decarbonized U.S. energy sector by 2035. This report analyzes gaps and opportunities in the supply chain currently available to the renewable energy sector, to help stakeholders formulate a coordinated response.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Module-OT: A Turnkey Solution for Securing Energy Systems

The Modular Security Apparatus for Managing Distributed Cryptography for Command-and-Control Messages on Operational Technology Networks (Module-OT) is a flexible and lightweight solution for grid-edge devices focusing on end-to-end security. It is a bump- in- the-wire solution acting as a secure conduit for data between devices or systems across a network. It improves the cybersecurity posture of DER systems by providing authentication, authorization, and data integrity to secure DER communications. Additionally, it performs key management, provides data security through whitelisting Internet Protocol addresses and ports, blocks unauthorized connections, controls user access, and allows serial or Ethernet connections for added flexibility. The core software is portable to various Linux-based operating systems and is developed to be customized by the developer and researcher communities. Module-OT has been validated in the lab, has been demonstrated at a 500-KW PV-plus-storage site, and has been proven ready to secure operational technology devices. Its core functionality meets current standards, including validation procedures of the NIST Cryptographic Algorithm Validation Program (CAVP) and the Federal Information Processing Standard (FIPS 140-2). Because of its capability to provide an accessible and affordable option for stepping up security across modern energy systems, Module-OT can serve as an effective technological option to standardize cybersecurity moving forward.

cryptography↗
DOE OSTI2022

Modular Security Apparatus for Managing Distributed Cryptography for Command-and-Control Messages on Operational Technology Networks (Module-OT)

Module-OT is a bump- in- the- wire solution acting as a secure conduit for data between devices or systems across a network. Using the latest in open-source cryptographic libraries, all defined communications undergo authentication, authorization, and encryption. The core system can be easily installed through industry standard processes, and the use of popular open-source packages allows for it to be customizable customized by the developer community or deployed in unique embedded environments.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Cybersecurity of DER Systems: Cybersecurity Training for State Commissions

NARUC regularly hosts multi-day cybersecurity training events for commissioners and their staff to gain knowledge of IT/OT technologies, understand the spectrum of state and federal approaches to cybersecurity, and explore cybersecurity cost recovery challenges and innovative solutions to address them. About 300 commissioners and staffers typically register for these virtual events.

cybersecurity cost recovery↗
DOE OSTI2022

Cybersecurity Certification Standard for Distributed Energy and Inverter Based Resources

NREL and UL co-presented on their joint effort to develop a cybersecurity certification standard for distributed energy resources (DERs) at a meeting of the Cybersecurity Advisory Team for State Solar (CATSS). The advisory team is hosted by NASEO & NARUC. The presentation outlined the benefits of a cybersecurity certification standard, the outcomes of previous initiatives, how this effort reflects the evolving electric grid, and the role of state energy offices. UL explained their role as a trusted third party with expertise to lead this effort and the process from Outline of Investigation (OOI) to a certification standard.

BPS↗
DOE OSTI2022

Distributed Energy Resource Cybersecurity Standards Development [Final Report]

Currently, the solar industry is operating with little application-specific guidance on how to protect and defend their systems from cyberattacks. This 3-year Department of Energy (DOE) Solar Energy Technologies Office-funded project helped advance the distributed energy resource (DER) cybersecurity state-of-the-art by (a) bolstering industry awareness of cybersecurity concepts, risks, and solutions through a webinar series and (b) developing recommendations for DER cybersecurity standards to improve the security performance of DER products and networks. Drafting DER standards is a lengthy, consensus-based process requiring effective leadership and stakeholder participation. This project was designed to reduce standard and guide writing times by creating well-researched recommendations that could act as a starting place for national and international standards development organizations. Working within the SunSpec/Sandia DER Cybersecurity Workgroup, the team produced guidance for DER cybersecurity certification, communication protocol standards, network architecture s, access control, and patching. The team also led subgroups within the IEEE P 1547.3 Guide for Cybersecurity of Distributed Energy Resources Interconnected with Electric Power Systems committee and pushed a draft to ballot in October 2021.

14 SOLAR ENERGY↗
DOE OSTI2021

Cybersecurity Certification Recommendations for Interconnected Grid Edge Devices and Inverter Based Resources

Escalating deployment of PV and grid-edge devices on the distribution grid has increased the sustainability and efficiency of the electric grid. However, the increasing number of distributed energy resources (DERs) deployed creates a heightened cyber-physical interdependency on the distribution grid and thus creates more vectors for cyber-attacks to exploit through information and communication technology (ICT) systems and networks. For example, control signal packets can be modified, intercepted, or corrupted due to vulnerabilities in communication protocols used by microgrid controllers and grid edge devices for power control. Therefore, to mitigate and prevent cyber-attacks on grid edge devices and the inverter-based resources connected to the distribution grid, the U.S. Department of Solar Energy Technologies Office (SETO) awarded funding to the National Renewable Energy Laboratory and Sandia National Laboratory (SNL) to research, develop, and harmonize cybersecurity standards for Photovoltaic (PV) systems and for other kinds of DERs. To help develop a standard for DER cybersecurity, NREL established certification recommendations and test cases, in consensus with the solar industry and UL, for ensuring intrinsic design security for DERs. These recommendations were developed to bolster the cybersecure functionalities such as TLS, MAC, CRL, session resumption/renegotiation, and password, system, and service security management within the DER devices. The proposed test cases verify authentication, authorization, confidentiality, and data integrity for data and communications of DERs that use Transmission Control Protocol/Internet Protocol (TCP/IP). They were also developed to protect DER communications from eavesdropping, replay, man-in-the-middle, denial of service (DoS), spoofing through security certificates, least-privilege violation, and brute-force credentials. This report, which has been validated and reviewed by UL, expands upon those test cases to provide DER cybersecurity certification recommendations which increase DER resiliency and help to mitigate cyber-attacks. UL's collaboration with NREL and approval of this document will accelerate the adoption of a UL standard for DER cybersecurity.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2021

Cybersecurity in Photovoltaic Plant Operations

This paper provides practical information for PV plant operators regarding cybersecurity. Plans to integrate photovoltaic generation into utility systems requires that cybersecurity be considered in every aspect- from customer data to business information to plant monitoring and control operations. This paper describes the types of threats encountered in operation of PV plants; challenges faced by photovoltaic plant operators in implementing cybersecurity; cybersecurity standards that apply to photovoltaic plant operations; cybersecurity response plans and recommended best practices to ensure photovoltaic plant cybersecurity.

14 SOLAR ENERGY↗
DOE OSTI2021

ModuleOT

ModuleOT is an open hardware security platform which provides all features necessary for securing remote energy resources. The platform consists of a physical bump in-the wire device which runs a custom-built application built with Go and Python and leverages AES-NI Instruction set available on modern hardware for cryptographic acceleration. By combining these features, ModuleOT acts as an all-in-one low-cost solution to enable cryptographically secured communications to any critical remote servers or devices. Because the software application has been built using Golang, this source can be easily compiled for different hardware platforms. The module is designed to provide the following core features: (1) encrypted communications across an untrusted network, (2) certificate-based authentication with secure storage, (3) hardware cryptographic acceleration, (4) IP-based whitelisting, (5) local firewall management, and (6) legacy (RS485) device support.

Hasandka, Adarsh↗