Search NASA⌕ Search

SEARCH · Search NASA

Results for “Linux Security”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

24 records · Page 2
All sourcesNASA NTRSDOE OSTI
DOE OSTI2022

Next generation experimental data access at NSLS-II

The NSLS-II network and computing infrastructure has been significantly updated recently. The re-IP process in 2020-2021 enabled the NSLS-II network to be routable to the rest of the BNL campus. Then, standardization of the operating systems and deployment procedures helped to deliver a consistent environment to workstations and servers used by all NSLS-II beamlines. In particular, the RedHat Enterprise Linux 8 was deployed to 700+ machines using the RedHat Satellite infrastructure management product, and all critical services (IOCs, databases, etc.) were migrated to the new OS. NFS users’ home directories are consistent across all of the machines, which eliminates the need for the individual configuration of the user environment on each host. The standard suite of software packages is available to the beamline staff and users, which includes the system packages (deployed via RPM) as well as the conda environments for data acquisition and analysis. Security measures were implemented to comply with the industry standards, which include multi-factor authentication (using Duo), secure screen lock for the beamline machines, and advanced access control to the experimental data that is stored in shared central storage available on all hosts. These major enhancements facilitated sharing the experimental data (currently for a number of selected beamlines, with a plan to extend it to the whole facility in the nearest future) with the users via an externally facing JupyterHub instance. The beamlines keep using the Bluesky data acquisition framework to orchestrate their experiments, and the new infrastructure enabled them to use a next-generation data access library called tiled.

36 MATERIALS SCIENCE↗
DOE OSTI2022

Userspace Squash Filesystem for Launching Linux Containers on HPC Systems [Thesis]

The demand for user defined software stacks (UDSS) has been increasing in the high-performance computing (HPC) community. Container technology has become popular due to the flexibility and isolation it provides to HPC users. Container images must be available to all nodes involved for use in HPC and can be distributed to compute nodes in a variety of ways. A common method for container image distribution is to simply copy the container image to memory on each compute node, which can be time consuming at scale, and uses valuable memory on each node. The kernel mounted squash filesystem (squashfs) has proven fast and efficient for this task but requires root-level access. This paper will show a user space mounted squashfs is an efficient and secure solution for container image distribution.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2017

Resilient and Robust High Performance Computing Platforms for Scientific Computing Integrity

As technology advances, computer systems are subject to increasingly sophisticated cyber-attacks that compromise both their security and integrity. High performance computing platforms used in commercial and scientific applications involving sensitive, or even classified data, are frequently targeted by powerful adversaries. This situation is made worse by a lack of fundamental security solutions that both perform efficiently and are effective at preventing threats. Current security solutions fail to address the threat landscape and ensure the integrity of sensitive data. As challenges rise, both private and public sectors will require robust technologies to protect its computing infrastructure. The research outcomes from this project try to address all these challenges. For example, we present LAZARUS, a novel technique to harden kernel Address Space Layout Randomization (KASLR) against paging-based side-channel attacks. In particular, our scheme allows for fine-grained protection of the virtual memory mappings that implement the randomization. We demonstrate the effectiveness of our approach by hardening a recent Linux kernel with LAZARUS, mitigating all of the previously presented side-channel attacks on KASLR. Our extensive evaluation shows that LAZARUS incurs only 0.943% overhead for standard benchmarks, and is therefore highly practical. We also introduced HA2lloc, a hardware-assisted allocator that is capable of leveraging an extended memory management unit to detect memory errors in the heap. We also perform testing using HA2lloc in a simulation environment and find that the approach is capable of preventing common memory vulnerabilities.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

Integration of the Kromek D3S Detector and Spot Robot For Secondary Inspections

Inspecting vehicles and containers for the presence of nuclear material is a challenging task for border control and security. When performed manually by inspectors, this task also has an associated risk of exposing the inspectors to unknown radiation. With the advent of agile, easy-to-program, quadruped robots like the Boston Dynamics Spot, automation of secondary inspection can improve the efficiency of the inspection process and alleviates the radiation risks to inspectors. In this project, Brookhaven National Laboratory and the University of Massachussetts at Lowell explored how to automate a simple secondary inspection mission. The Spot robot comes with its own software development kit (SDK) that allows clients/users to write custom code in the Python programming language to control the robot. Spot also has a payload computer called Spot-CORE, which runs the Ubuntu Linux operating system and allows users to integrate external sensors, such as a radiation detector, with Spot. In this study, the Kromek D3S detector has been integrated with Spot via the Spot-CORE, allowing Spot to capture gamma spectra and neutron counts for a specified acquisition period. Two custom routines, search and confirmation, have been developed and executed in this specified order. The search routine directs Spot to go around the nearest obstacle, e.g., vehicle and container, in a preset distance and step to collect gamma and neutron gross counts with the D3S detector. The radiation data and the robot location corresponding to each step are stored and fed to the confirmation routine at the end of the search. The confirmation routine then navigates Spot to the locations of the highest gamma or neutron counts to perform a long, e.g., one minute, measurement, and gives the operators the signature gamma spectra and neutron counts at the hotspots. This paper presents a detailed description of this automated system along with results of the preliminary tests in identifying the location and signature of a 137Cs radiation source in a vehicle.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
DOE OSTI2018

Criticality Evaluation of Low Density Product Oxides for Air Transport for the ES-3100 Package

This document presents the criticality safety evaluation of the Y-12 National Security Complex (Y-12) Model ES-3100 package for the addition of lower bulk density limits for HEU product oxides transported by air. The current authorized oxide density range for air transport is 2.0 to 6.54 g/cm 3 . The analysis in this report looks at lower densities, specifically in the range of 1.0 to 2.0 g/cm 3 . For reasons presented in this report, it was decided to present the entire range of oxide densities (1.0 to 6.54 g/cm 3 ) as a series of sub-ranges. The lowest density in each range was evaluated. Thus calculations were performed for the following oxide densities: 5.0 g/cm 3 , 4.0 g/cm 3 , 3.0 g/cm 3 , 2.0 g/cm 3 , 1.5 g/cm 3 and 1.0 g/cm 3 . Calculations presented herein were performed using a third generation computing platform; the Microway Parallel Linux Cluster ENGHPC workstation using the Monte Carlo Criticality Safety Analysis Sequence (CSAS5) criticality code sequence and 238-group ENDF/B-VII cross-section library of Standardized Computer Analysis for Licensing Evaluation (SCALE) 6.1.3 (ORNL/TM-2005/39, SCALE: A Comprehensive Modeling and Simulation Suite for Nuclear Safety Analysis and Design).

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
DOE OSTI2019

Addendum to the REBUS Users Guide: REBUS-PC (V.1.5)

The Department of Energy (DOE) National Nuclear Security Administration (NNSA) Material Management and Minimization (M3) Reactor Conversion Program uses the REBUS-PC computer code to provide reactor physics and core design information such as neutron flux distributions in space, energy, and time, and to track isotopic changes in fuel and neutron absorbers with burnup. REBUS-PC has evolved from the original REBUS code, which was created starting in the 1960’s to study large liquid metal cooled fast reactors. In particular, additional outputs were added to improve user convenience and some inputs were modified to improve the functionality of the software. REBUS and REBUS-PC both model the external cycle, and are very general codes with 1D, 2D, and 3D neutronics capabilities, and with complete fuel shuffling capabilities. REBUS remains an extremely efficient reactor analysis tool for use in fast reactor systems, and so development has continued at Argonne National Laboratory (ANL) to this day for non-thermal reactor applications. While retaining the efficient computational engine of REBUS, REBUS-PC has evolved to its present status with continuous development since 1999. REBUS-PC has numerous changes and enhancements directed toward the needs of the thermal reactor analyst using Windows or Linux-based computational platforms.

11 NUCLEAR FUEL CYCLE AND FUEL MATERIALS↗