SEARCH · Search NASA

Results for “Cyber vulnerabilities”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2

All sources NASA NTRS DOE OSTI

DOE OSTI2021

Cybersecurity for Electric Vehicle Fast-Charging Infrastructure

The integration of electric vehicles (EVs) into electric grid operations can potentially leave the grid vulnerable to cyberattacks from both legacy and new equipment and protocols, including extreme fast-charging infrastructure. This paper introduces a co-simulation platform to perform cyber vulnerability analysis of EV charging infrastructure and its dependencies on communications and control systems. Grid impact scenarios through linkages to power system simulation tools such as OpenDSS and vehicle infrastructure-specific attack paths are discussed. An adaptive platform that assists with predicting and solving evolving cybersecurity challenges is demonstrated with a cyber-energy emulation that accelerates the analysis of cyberattacks and system behavior.

47 OTHER INSTRUMENTATION↗

DOE OSTI2021

Cybersecurity for Electric Vehicle Fast-Charging Infrastructure: Preprint

47 OTHER INSTRUMENTATION↗

DOE OSTI2021

Cybersecurity for Fast Charging EV Infrastructure

ADVANCED PROPULSION SYSTEMS,POWER TRANSMISSION AND↗

DOE OSTI2024

Large-Scale Hydrogen Storage Cyber Risk Assessment

Hydrogen storage systems may become more widely deployed throughout the country, and so it is possible that individual and interconnected systems will be exposed to cyber-attacks. These events can cause physical and financial harm to employees, people in the vicinity of the facility, and the company that owns the facility. The two main ways bad actors may access information or control from a hydrogen storage facility are through information technology and operations technology devices, the former of which refers to data and information from networked devices and the latter of which refers to onsite controls for the physical system. Both types of entryways into the system should be considered when companies conduct cyber risk assessments and when regulators develop or revise relevant codes and standards. This report analyzes cybersecurity risks associated with a generic hydrogen storage system by outlining the system's purpose and the importance of its cybersecurity. The hydrogen storage system architecture and communication protocols are provided to understand potential cyber vulnerabilities. Later, an event tree analysis is performed on hydrogen operation to identify system weaknesses by outlining potential attack scenarios. This report also identifies critical cyber assets related to different hydrogen operations followed by an examination of potential threats, and the impact of cyber assets on those operational assets.

08 HYDROGEN↗

DOE OSTI2024

Large-Scale Hydrogen Storage Cyber Risk Assessment

Hydrogen storage systems are becoming more widely deployed throughout the country, and as their presence continues to grow, it is possible that individual and interconnected systems will be exposed to cyber-attacks. These events can cause physical and financial harm to employees, people in the vicinity, and to the company that owns the facility. The two main mechanisms malicious actors may access information or control from a hydrogen storage facility are through information technology and operations technology devices, the former of which refers to data and information from networked devices and the latter of which refers to onsite controls for the physical system. Both types of entryways into the system should be considered when facility managers conduct cyber risk assessments and when regulators develop or revise relevant codes and standards. This report analyzes cybersecurity risks applicable to a wide variety of hydrogen storage systems by outlining the system's purpose and the importance of its cybersecurity. The hydrogen storage system architecture and communication protocols are provided to understand potential cyber vulnerabilities. Later, an event tree analysis is performed on hydrogen operation to identify system weaknesses by outlining potential attack scenarios. This report also identifies critical cyber assets related to different hydrogen operations followed by an examination of potential threats, and the impact of cyber assets on those operational assets.

08 HYDROGEN↗

DOE OSTI2022

Detection of Cyber Attacks in Grid-tied PV Systems Using Dynamic Watermarking

This paper presents of an active detection scheme for detecting cyber attacks on sensors controlling a grid-tied PV systems. Several cyber vulnerabilities in Grid tied PV Systems are discussed. The defense mechanism introduces a private (secret) watermarking signal into the control inputs of the grid-tied inverter system. This will enable the detection of any malicious manipulation of sensor measurements. Based on the measured data, two statistical tests are conducted to identify anomalies in the system using the presence of the watermarking signal. It shown that when a sensor data is compromised and/or replaced by a pre-recorded healthy signal, both test 1 and 2 exhibit high values indicating a possible malicious activity. The robustness of the proposed algorithm is tested and validated with several attack scenarios on a grid tied PV system. Select results from an experimental setup are discussed.

Ibrahim, Hasan↗

DOE OSTI2020

Recommended Functionalities for Improving Cybersecurity of Distributed Energy Resources

The current electric grid is transitioning through increasing penetration of distributed energy resources (DERs), which include intermittent renewable generation resources on the distribution side. Both the monitoring and control of DERs require extensive data-exchange and communication networks. These networks lead to cyber vulnerabilities and risks of new kinds of cyberattacks that may be extremely destructive for power system operations. Although current standards, such as IEEE Std. 1547-2018, do not discuss cybersecurity measures for DERs, cybersecurity controls should be developed for securing DER systems at the device level, communications level, and applications level. This paper discusses the current industry's best practices related to DER cybersecurity and proposes recommended functionalities for improving the cybersecurity posture of DERs, specifically at the device/distribution level. These practical recommendations have been discussed and verified with the industry through a DER cybersecurity working group.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2025

Optimal Mitigation Planning For Adversarial Scenarios

We propose a generalized framework which performs an optimal partitioning of a limited budget into various organizational sectors in order to improve the cybersecurity of a smart device or component in the Cyber Physical Energy System (CPS). The framework identifies the adversarial threats and possible attack sequences which can be performed to exploit cyber vulnerabilities of the component. Thereafter, we formulate an Mixed Integer Linear Programming (MILP) optimization problem which aims to evaluate the optimal budget partitions in order to minimize the number of highly likely attack sequences. Though we provide results for using the framework in CPES, the proposed methodology can be extended for multiple domains with a set of known adversarial and mitigation actions.

Purohit, Sumit [Pacific Northwest National Laborat↗

DOE OSTI2022

Strengthening the Security of Operational Technology: Understanding Contemporary Bill of Materials

The evolution of cyber-physical infrastructure has made its security more challenging. The last few years have witnessed a convergence of hardware and software segments in various domains, including operational technology (OT) which is responsible for carrying out critical tasks such as monitoring and controlling power grids, nuclear plants, transportation, and emergency services. Both hardware and software encapsulate numerous open source and proprietary subcomponents, making it crucial for end-users to understand the composition of the products they are using. For example, wind turbines incorporate thousands of lines of code (software) used for the turbine's design, planning, operation, and analytics in addition to the numerous hardware subcomponents that construct it. Due to the highly complex nature of software and hardware, knowledge of the components and subcomponents is required to mitigate cyber vulnerabilities and defend against cyberattacks. There has also been a transformation from a traditional linear supply chain into a global, dynamic, diverse, and interconnected system. The digitization of the supply chain makes it easier to find and exploit vulnerabilities. Critical infrastructures (e.g., power grids, oil, natural gas, water, and wastewater) rely on OT to function, and if the OT is compromised, equipment damage and potential interruption of services could result. A significant security measure to protect OT systems from disruption is to develop a supply chain bill of materials (BoM) corresponding to the software and hardware used in OT, along with attestations amongst vendors and asset owners. A supply chain BoM is a proactive way to understand the inherent vulnerabilities in the system and mitigate them in advance of being exploited. BoMs bolster the trust placed in the digital infrastructure and enhance software supply chain security by sustaining the management of component obsolescence and compliance, along with the seclusion of unsafe segments of a specific product. Adopting BoM tools is becoming increasingly important across various government sectors, as evidenced by the recent U.S. executive order on cybersecurity (NIST 2021). This paper aims to classify BoMs based on structure, functionality, component type, and architecture. The work also discusses case studies to further highlight the benefits of BoMs. In addition, it identifies missing pieces in existing BoM implementations so that future research may identify bounds on where it could expect to make improvements and directly enable researchers to identify promising areas for exploration. Further, the authors provide valuable recommendations to tool developers, researchers, and standardizing organizations (policymakers), additionally benefitting critical infrastructure owners and government executives. This aids in paving a path for future work, thereby, providing suggestions to determine a tool for consumers that best suit their needs.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2021

Evaluation of Apex Alpha with LabWare-LIMS Data Reduction for Alpha Analyses

Savannah River Site's Environmental Bioassay Laboratory is migrating its laboratory information management system (LIMS) from SQL-LIMS to Oracle Labware-LIMS (LW-LIMS) systems to align with the Department of Energy's cyber security policies. Concurrently with the LIMS upgrade, the current VMS based Alpha Measurement System (AMS) software is being replaced with Apex Alpha software to reduce other cyber vulnerabilities, streamline procedural production aspects of data handling, and improve outdated reduction processes to align the program with requirements outlined in ANSI N13.30. The primary technical changes which are being implemented are: - Reagent contributions are added in data reduction, - Moving average background equivalent activity are used for gross signal corrections, - Measured uncertainty of both are included in the decision level and propagated uncertainty, - Tracer levels are increased for precision and accuracy improvements, and - Reports are modified for compliance.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗

DOE OSTI2024

The HyRIGHT Project: 700 bar Hydrogen Refueling Interface for Gaseous Heavy-Duty Trucks

Heavy duty truck fueling places additional constraints on the station. The HyRIGHT project was developed to evaluate a subset of key areas around precooling, communications, and safety risks that aims to:  Utilize a dynamic model that includes the relevant station components and vehicle to develop an optimized precooling strategy based on initial precooling status, real time communications that can support fueling protocol development.  Perform a techno economic cost assessment (TEA) related to effects of precooling including station storage and efficiency effects.  Develop a Cyber Vulnerability assessment and framework for refueling of HD vehicles with station communications.  Disseminate the results in support of the HD fueling protocol development to the relevant standards development organizations.

JAMES, Charles W.↗

DOE OSTI2022

Cybersecurity Standards for Photovoltaic Operations

Solar energy plays an important role in securing a more resilient, cyber-secure electrical grid in Pennsylvania. Solar's ability to be widely "distributed" on residential and large roofs, marginal lands, and many other locations across Pennsylvania - as opposed to being centralized - offers a strong option for addressing the myriad of potential disruptions that can occur to the grid's infrastructure. And when combined with energy storage, local energy needs can be met immediately without having to wait on the delivery of an off-site fuel source. As more and more distributed solar electricity generation is brought online, researchers, technology developers, solar developers and grid operators are paying close attention to the potential for solar to enhance grid cybersecurity. Although nobody may know when, where, or how the next cyberattack will take place, there are security measures, technical solutions, and management practices that are being implemented across the industry to protect against network control issues and grid operations. Everyone participating in the solar value chain stands to gain from a coordinated, iterative approach to protect against cyber vulnerabilities and build deeper resilience into the architecture of our grid.

cybersecurity↗

DOE OSTI2024

Cybersecurity for the Operational Technology Environment (CyOTE) (Final Technical Report)

Electric grids have historically been susceptible to both physical attacks and environmental hazards but the implementation of smart grids, remote management, and self-healing networks, has now made the grid vulnerable to cyber attacks. To address risks introduced by routable connectivity, utilities must establish dynamic solutions to identify, protect, detect, respond to, and recover from cyber security threats and vulnerabilities. In response to the evolving threat landscape U.S. Department of Energy-Office of Cybersecurity, Energy Security, and Emergency Response (DOE CESER) initiated the Cybersecurity for the OT Environment (CyOTE) pilot program, a U.S. Department of Energy (DOE) effort designed to leverage U.S. intelligence capabilities to prevent, detect, or mitigate a cyber attack on utility operational technology (OT) networks. As part of the CyOTE pilot, The Southern Company (Southern Company or Southern) researched, evaluated and deployed emerging Commercial off the Shelf (COTS) technologies and cyber security monitoring architectures to provide previously unrealized network visibility and situational awareness through deep packet inspection and data analytics. This Final Scientific/Technical Report documents the objectives, methodology, lessons learned, and results of Southern Company’s participation in the CyOTE pilot from December 2018 to September 2023.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2020

Distributed Detection of Malicious Attacks on Consensus Algorithms with Applications in Power Networks

Consensus-based distributed algorithms are well suited for coordination among agents in a cyber-physical system. These distributed schemes, however, suffer from their vulnerability to cyber attacks that are aimed at manipulating data and control ow. In this article, we present a novel distributed method for detecting the presence of such intrusions for a distributed multi-agent system following ratio consensus. We employ a Max-Min protocol to develop low cost, easy to implement detection strategies where each participating node detects the intrusion independently, eliminating the need for a trusted certifying agent in the network. The effectiveness of the detection method is demonstrated by numerical simulations on a 1000 node network to demonstrate the efficacy and simplicity of implementation.

27 ARPA - Advanced Research Projects Agency-Energy↗

DOE OSTI2025

Generative Vulnerability Assessment for Cyber-Physical Systems

Cyber-physical systems (CPS) are highly susceptible to malicious attacks due to their complex dynamics and interconnectivity. A comprehensive understanding of their vulnerabilities is essential for designing effective resilience measures. This paper presents a data-driven attack generative system for evaluating the vulnerability of CPS. The proposed approach formulates the vulnerability assessment problem as determining the feasibility of a specific attack set based on two boundary functions that represent the effectiveness and stealthiness of attacks. The attack generative model is trained using a custom loss function, with two universal approximators designed to learn the effectiveness and stealthiness functions simultaneously. Theoretical results for successful generation and asymptotic convergence of the resulting training algorithm are given. As a result, the proposed approach is evaluated via numerical simulation of an IEEE 14-bus system and gas pipeline systems, demonstrating its viability in learning how to attack nonlinear CPS and identify potential vulnerabilities.

Computer systems organization↗

DOE OSTI2021

Cyber-Informed Engineering Case Study of an Integrated Hydrogen Generation Plant

Strategies for securing digital instrumentation and control (I&C) systems within the nuclear industry are provided by multiple standards and guidance documents. However, since selection and use of security controls outlined in these documents are frequently only considered during or after installation, there are often limitations on their use, such as technological constraints related to design or operation. Furthermore, alternative controls intended to provide the same or similar security countermeasure as the primary control may also be infeasible at these stages, leaving the I&C system vulnerable to cyber-attacks. The limitations associated with ‘bolting on’ security controls late in the systems engineering lifecycle can be reduced by integrating Cyber-Informed Engineering (CIE) into the process. This paper evaluates the use of CIE during the high-level design stage of a hydrogen generation project where heat and electricity are provided by a nuclear power plant. Applying CIE to this project highlighted potential cyber vulnerabilities of the initial design, leading to recommendations for process flow and I&C system design modifications to reduce, and at times eliminate, the risk from both deliberate and unintentional cyber incidents.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DOE OSTI2023

Moving-horizon false data injection attack design against cyber–physical systems

Systematic attack design is essential to understanding the vulnerabilities of cyber–physical systems (CPSs), to better design for resiliency. In particular, false data injection attacks (FDIAs) are well-known and have been shown to be capable of bypassing bad data detection (BDD) while causing targeted biases in resulting state estimates. However, their effectiveness against moving horizon estimators (MHE) is not well understood. In fact, this paper shows that conventional FDIAs are generally ineffective against MHE. One of the main reasons is that the moving window renders the static FDIA recursively infeasible. Here, this paper proposes a new attack methodology, moving-horizon FDIA (MH-FDIA), by considering both the performance of historical attacks and the current system’s status. Theoretical guarantees for successful attack generation and recursive feasibility are given. Numerical simulations on the IEEE-14 bus system further validate the theoretical claims and show that the proposed MH-FDIA outperforms state-of-the-art counterparts in both stealthiness and effectiveness. In addition, an experiment on a path-tracking control system of an autonomous vehicle shows the feasibility of the MH-FDIA in real-world nonlinear systems.

42 ENGINEERING↗

DOE OSTI2022

Achieving American Leadership in Cybersecurity and Digital Components Factsheet

The Biden Administration’s efforts to meet 100% clean electricity by 2035 and net-zero greenhouse gas emissions by 2050 has created opportunities to rebuild American supply chains create new jobs, strengthen community engagement, and spur U.S. economic growth. DOE’s strategy for success in the transition to a clean energy economy hinges on building and maintaining technology supply chains that are advanced, secure, and resilient to cyber threats. As the energy sector grows increasingly globalized, complex, and digitized, the supply chain for digital components of energy systems – including software, virtual platforms and services, and data – is facing greater threats. Nearly all digital components of U.S. energy sector systems are vulnerable to cyber supply chain instability, stemming from a variety of causes and shared among a broad set of interdependent stakeholders. Overall, supply chain risks for digital components in energy sector systems will continue to evolve and likely increase as these systems are increasingly interconnected, digitized, and remotely operated.

CCE↗