SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
NREL's advanced distribution management system (ADMS) research helps utilities meet customer expectations of reliability, power quality, renewable energy use, data security, and resilience to natural disasters and other threats.
Updated healthcare cybersecurity with a focus in patient data security, system interoperability, and medical device vulnerability mitigation
This small experimental report evaluates a variation of Retrieval Augmented Generation (RAG), called Self-RAG. This method uses a generative language model that incorporates retrieved facts into its generation and is explicitly trained to be able to determine whether retrieved information is enough to answer the input query, with a user-defined threshold for confidence. We performed an experiment using data from the publicly available CISA Common Security Advisory Framework (CSAF) repository (https://github.com/cisagov/CSAF) as the database of facts to be used in retrieval. Qualitative results from the experiment demonstrate that the Self-RAG method has some ability to provide reasonable answers to queries that are in the dataset and will often ignore irrelevant information when asked outside of domain questions (e.g., general facts). In settings with deliberately confusing questions (the question is within domain, but asks about a fabricated advisory), it was able to refuse 40% of the time without further adjustments to the original framework. While this performance is not sufficient for current practical use, further improvements to data formatting, disambiguating results, and leveraging threshold values could improve performance significantly. However, evaluating this will require more extensive evaluations on larger datasets and potentially better models.
The research has 2 thrusts: 1. new data architectures and tech-transfer-ready prototype tools that use write optimized data structures (WODS) to track real-world events, provide value to analysts, and support our cyber missions; and 2. algorithm research to address infinite streams of data, including expiration and sustainability.
This document describes the security and administration features of the Universal Utility Data Exchange project.
A critical component of the Universal Utility Data Exchange (UUDEX) approach is the integrated security contained within its processing. This document describes how that security is designed and expected to be implemented by UUDEX Implementations (U-Implementations), including the UUDEX Server (U-Server) and UUDEX Clients (U-Clients). The UUDEX security hierarchy consists of three levels: 1. The UUDEX Instance (U-Instance) itself, which sits at the top of the hierarchy and contains the U-Server, the UUDEX Identity Authority (U-Identity Authority), and the UUDEX Administrator (U-Administrator) functions; 2. A group of one or more UUDEX Participants (U-Participants) that present “organizations” that participate in the U-Instance and contains the UUDEX Administrator Participant (U-U-Administrator Participant) function; 3. A group of one or more UUDEX Endpoints (U-Endpoints) that represent the individual UUDEX Publish Clients (U-Publish Client) responsible for supplying data to the U-Instance that is consumed by UUDEX Subscriber Clients (U-Subscriber Clients). U-Endpoints can be either autonomous devices that publish and subscribe data such as data exchange servers found in supervisory control and data acquisition and energy management systems, or they can be tied to users of applications that, for example, submit DOE OE-417 disturbance reports. U-Participants and U-Endpoints can be organized into UUDEX Groups (U-Groups). Any number of U-Participants or U-Endpoints can be members of a U-Group. A given U-Participant or U-Endpoint can be a member of multiple U-Groups, but a U-Group cannot contain other U-Groups. For example, a U-Group could be created to contain all U-Participant Transmission Operators within the purview of a Reliability Coordinator, and another U-Group could be created to contain all U-Participant Generator Operators within the purview of a Reliability Coordinator. U-Participants that are both Transmission Operators and Generator Operators would be members of both U-Groups. U-Participants, U-Endpoints, and U-Groups are used in the access control structures to provide access to individual UUDEX Subjects (U-Subjects). U-Groups are created by the U-Administrator and are managed by the U-Administrator or the designated U-Group Managers. U-Endpoints can be assigned UUDEX Roles (U-Roles) that can be used to further restrict access. U-Roles are assigned to individual U-Endpoints. For example, a U-Role of “Security Analyst” could be used to restrict which U-Endpoints can publish or subscribe security incident reports and vulnerability notifications, while a U-Role of “Transmission Planner” can be used to restrict which U-Endpoints can publish power system model updates. U-Role definitions are created by the U-Administrator, but the U-Roles are assigned to U-Endpoints by their respective UUDEX Participant Administrators (U-Participant Administrator). Because all information required to make security decisions is either included within the U-Endpoint’s X.509 digital certificate or stored in a datastore on the U-Server, all security decisions are performed and enforced within the U-Server. This reduces the complexity of the U-Client code and minimizes the chance for compromise of the integrity of the UUDEX security features.
The Modular Security Apparatus for Managing Distributed Cryptography for Command-and-Control Messages on Operational Technology Networks (Module-OT) is a flexible and lightweight solution for grid-edge devices focusing on end-to-end security. It is a bump- in- the-wire solution acting as a secure conduit for data between devices or systems across a network. It improves the cybersecurity posture of DER systems by providing authentication, authorization, and data integrity to secure DER communications. Additionally, it performs key management, provides data security through whitelisting Internet Protocol addresses and ports, blocks unauthorized connections, controls user access, and allows serial or Ethernet connections for added flexibility. The core software is portable to various Linux-based operating systems and is developed to be customized by the developer and researcher communities. Module-OT has been validated in the lab, has been demonstrated at a 500-KW PV-plus-storage site, and has been proven ready to secure operational technology devices. Its core functionality meets current standards, including validation procedures of the NIST Cryptographic Algorithm Validation Program (CAVP) and the Federal Information Processing Standard (FIPS 140-2). Because of its capability to provide an accessible and affordable option for stepping up security across modern energy systems, Module-OT can serve as an effective technological option to standardize cybersecurity moving forward.
The Nuclear Security Enterprise, managed by the National Nuclear Security Administration - a semiautonomous agency within the Department of Energy - has been associated with numerous assessments with respect to the estimating, management capabilities, and practices pertaining to nuclear weapon modernization efforts. This report identifies challenges in estimating and analyzing the Nuclear Security Enterprise through an analysis of analogous timeframe conditions utilizing two types of nuclear weapon data - (1) a measure of effort and (2) a function of time. The analysis of analogous timeframe conditions that utilizes only two types of nuclear weapon data yields four summary observations that estimators and analysts of the Nuclear Security Enterprise will find useful.
The Space Data Link Security (SDLS) Protocol is a Consultative Committee for Space Data Systems (CCSDS) standard which extends the known Data Link protocols to secure data being sent over a space link by providing confidentiality and integrity services. This plan outlines the approach by National Aeronautics Space Administration (NASA) in performing testing of the SDLS protocol using a prototype based on an existing NASA missions simulator.
Write-optimized data structures (WODS), offer the potential to keep up with cyberstream event rates and give sub-second query response for key items like IP addresses. These data structures organize logs as the events are observed. To work in a real-world environment and not fill up the disk, WODS must efficiently expire older events. As the basis for our research into organizing security monitoring data, we implemented a tool, called Diventi, to index IP addresses in connection logs using RocksDB (a write-optimized LSM tree). In this work, we extended Diventi to automatically expire data as part of the data structures’ normal operations. We guarantee that Diventi always tracks the N most recent events and tracks no more than N + k events for a parameter k < N, while ensuring the index is opportunistically pruned. To test Diventi at scale in a controlled environment, we used anonymized traces of IP communications collected at SuperComputing 2019. We synthetically extended the 2.4 billion connection events to 100 billion events. We tested Diventi vs. Elasticsearch, a common log indexing tool. In our test environment, Elasticsearch saw an ingestion rate of at best 37,000 events/s while Diventi sustained ingestion rates greater than 171,000 events/s. Our query response times were as much as 100 times faster, typically answering queries in under 80 ms. Furthermore, we saw no noticeable degradation in Diventi from expiration. We have deployed Diventi for many months where it has performed well and supported new security analysis capabilities.
This report presents groundwater and leachate sample results from the Area 5 Radioactive Waste Management Site (RWMS) at the Nevada National Security Site in Nye County, Nevada. Since 1993, groundwater samples have been collected and static water levels have been measured from the aquifer immediately below the Area 5 RWMS. The data are evaluated for evidence of effects on the aquifer related to the Area 5 RWMS. Leachate from the Cell 18 lined mixed waste cell has been sampled since 2011, and leachate from the Cell 25 lined mixed waste cell was first sampled in 2019 after it began receiving waste in August 2018. Leachate data are analyzed for hazardous contaminants to determine appropriate leachate handling and disposal. This report includes five years of data from 2015 through 2019.
This report presents groundwater and leachate sample results from the Area 5 Radioactive Waste Management Site (RWMS) at the Nevada National Security Site in Nye County, Nevada. Since 1993, groundwater samples have been collected and static groundwater depths have been measured from the aquifer immediately below the Area 5 RWMS. The data are evaluated for evidence of effects on the aquifer related to the Area 5 RWMS. Leachate from the Cell 18 lined mixed waste cell has been sampled since 2011, and leachate from the Cell 25 lined mixed waste cell was first sampled in 2019 after it began receiving waste in August 2018. Leachate data are analyzed for hazardous contaminants to determine appropriate leachate handling and disposal. This report includes five years of data from 2016 through 2020.
This report is a compilation of the groundwater sampling results from the Area 5 Radioactive Waste Management Site (RWMS) at the Nevada National Security Site, Nye County, Nevada. Groundwater samples from the aquifer immediately below the Area 5 RWMS have been collected and analyzed and static water levels have been measured in this aquifer since 1993. This report updates these data to include the 2015 results. Analysis results for leachate contaminants collected from the mixed-waste cell at the Area 5 RWMS (Cell 18) are also included.
This report is a compilation of the groundwater and waste cell leachate sampling results from the Area 5 Radioactive Waste Management Site (RWMS) at the Nevada National Security Site, Nye County, Nevada. Groundwater samples from the aquifer immediately below the Area 5 RWMS have been collected and analyzed and static water levels have been measured in this aquifer since 1993. These groundwater data are evaluated for evidence of effects on the aquifer related to the Area 5 RWMS. Leachate from one lined mixed waste cell at the Area 5 RWMS (Cell 18) has been sampled since the cell opened in 2011. These leachate data are analyzed for hazardous contaminants to determine appropriate leachate handling and disposal. A second lined mixed waste cell at the Area 5 RWMS (Cell 25) began receiving waste in August 2018, but no leachate samples were collected or analyzed during 2018. This report includes data from 2014 through 2018 but focuses on the 2018 data. During 2018, groundwater samples were collected and static water levels were measured at three wells surrounding the Area 5 RWMS. Groundwater samples were collected at wells UE5PW-1, UE5PW-2, and UE5PW-3 on March 6 and August 14, 2018. Static water levels were measured at each of these wells on March 5, June 4, August 13, and October 25, 2018. Groundwater monitoring at the Area 5 RWMS complies with Title 40 Code of Federal Regulations (CFR) Part 264.97, General ground-water monitoring requirements , and 40 CFR 264.98, Detection monitoring program. Groundwater samples were analyzed for indicators of contamination (pH, specific conductance [SC], total organic carbon, total organic halides, and tritium) and, beginning in 2017, toxicity characteristic metals (arsenic, barium, cadmium, chromium, lead, mercury, selenium, and silver). General water chemistry parameters (calcium, iron, magnesium, manganese, potassium, sodium, sulfate, chloride, fluoride, bicarbonate, and silicate) were also measured. Results from samples collected in 2018 are within the limits for each parameter established by the Nevada Division of Environmental Protection in Resource Conservation and Recovery Act (RCRA) Permit NEV HW0101, Revision 6. Data from the shallow aquifer indicate there has been no measurable impact to the uppermost aquifer from the Area 5 RWMS, and there were no significant changes in measured groundwater parameters compared to previous years. Leachate from lined mixed waste Cell 18 drains into a sump and is pumped into an above ground tank. Samples are collected from the tank when the leachate volume approaches the 3,000-gallon tank capacity. During 2018, leachate samples were collected on March 1, 2018 and August 1, 2018. All leachate analysis results are below the regulatory levels for toxicity characteristic contaminants (40 CFR 261.24) and below the investigation levels for polychlorinated biphenyls (PCBs), tritium, pH, and SC specified in RCRA Permit NEV HW0101, Revision 6. No quantifiable PCB levels were detected in any leachate sample. Based on the leachate analysis results, RCRA Permit NEV HW0101 allowed all leachate collected from Cell 18 to be pumped from the collection tank and used for dust control at Cell 18.
This document is intended for distributed energy resource vendors, utilities, certification labs, and government organizations. The document provides cases that can be used to test the cybersecurity posture of the data and communication of distributed energy resources.
The National Renewable Energy Laboratory (NREL) has deep experience developing secure, national data repositories, which it augments with analysis, technology and market expertise, high-performance computing, and innovative data visualization. By adapting the architecture of existing mobility databases (i.e., Fleet DNA, the Transportation Secure Data Center, the National Fuel Cell Technology Evaluation Center), NREL can build a powerful aviation data clearinghouse - Flight DNA - that helps stakeholders navigate the web of pitfalls and possibilities generated by new aviation technologies.
The Global Change Master Directory (GCMD) has been one of the best known Earth science and global change data discovery online resources throughout its extended operational history. The growing popularity of the system since its introduction on the World Wide Web in 1994 has created an environment where resolving issues of scalability, security, and interoperability have been critical to providing the best available service to the users and partners of the GCMD. Innovative approaches developed at the GCMD in these areas will be presented with a focus on how they relate to current and future GO-ESSP community needs.
A system and method for the secure storage and transmission of data is provided. A data aggregate device can be configured to receive secure data from a data source, such as a sensor, and encrypt the secure data using a suitable encryption technique, such as a shared private key technique, a public key encryption technique, a Diffie-Hellman key exchange technique, or other suitable encryption technique. The encrypted secure data can be provided from the data aggregate device to different remote devices over a plurality of segregated or isolated data paths. Each of the isolated data paths can include an optoisolator that is configured to provide one-way transmission of the encrypted secure data from the data aggregate device over the isolated data path. External data can be received through a secure data filter which, by validating the external data, allows for key exchange and other various adjustments from an external source.