Search NASA⌕ Search

SEARCH · Search NASA

Results for “Computer authentication”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4
All sourcesNASA NTRSDOE OSTI
DOE OSTI2019

Spatio-Temporal Characterization of Synchrophasor Data Against Spoofing Attacks in Smart Grids

“Source ID Mix” has emerged as a new type of highly deceiving attack which can alter the source information of synchrophasor data measured by multiple phasor measurement units, thereby paralyzing many wide-area measurement systems applications. To address such sophisticated cyber attacks, we have exploited the spatio-temporal characteristics of synchrophasor data for authenticating measurements’ source information. Specifically, the source authentication is performed when the measurements are subjected to three types of spoofing attacks. Some practical difficulties in applying the proposed method on real-time authentication caused by insufficient measurement data have also been solved. Experimental results with real synchrophasor measurements have validated the effectiveness of the proposed method in detecting such complicated data spoofing and improving power systems’ cyber security.

24 POWER TRANSMISSION AND DISTRIBUTION↗
NASA NTRS1994

Advanced information processing system: Hosting of advanced guidance, navigation and control algorithms on AIPS using ASTER

This program demonstrated the integration of a number of technologies that can increase the availability and reliability of launch vehicles while lowering costs. Availability is increased with an advanced guidance algorithm that adapts trajectories in real-time. Reliability is increased with fault-tolerant computers and communication protocols. Costs are reduced by automatically generating code and documentation. This program was realized through the cooperative efforts of academia, industry, and government. The NASA-LaRC coordinated the effort, while Draper performed the integration. Georgia Institute of Technology supplied a weak Hamiltonian finite element method for optimal control problems. Martin Marietta used MATLAB to apply this method to a launch vehicle (FENOC). Draper supplied the fault-tolerant computing and software automation technology. The fault-tolerant technology includes sequential and parallel fault-tolerant processors (FTP & FTPP) and authentication protocols (AP) for communication. Fault-tolerant technology was incrementally incorporated. Development culminated with a heterogeneous network of workstations and fault-tolerant computers using AP. Draper's software automation system, ASTER, was used to specify a static guidance system based on FENOC, navigation, flight control (GN&C), models, and the interface to a user interface for mission control. ASTER generated Ada code for GN&C and C code for models. An algebraic transform engine (ATE) was developed to automatically translate MATLAB scripts into ASTER.

Brenner, Richard↗
NASA NTRS1998

Practical Computer Security through Cryptography

The core protocols upon which the Internet was built are insecure. Weak authentication and the lack of low level encryption services introduce vulnerabilities that propagate upwards in the network stack. Using statistics based on CERT/CC Internet security incident reports, the relative likelihood of attacks via these vulnerabilities is analyzed. The primary conclusion is that the standard UNIX BSD-based authentication system is by far the most commonly exploited weakness. Encryption of Sensitive password data and the adoption of cryptographically-based authentication protocols can greatly reduce these vulnerabilities. Basic cryptographic terminology and techniques are presented, with attention focused on the ways in which technology such as encryption and digital signatures can be used to protect against the most commonly exploited vulnerabilities. A survey of contemporary security software demonstrates that tools based on cryptographic techniques, such as Kerberos, ssh, and PGP, are readily available and effectively close many of the most serious security holes. Nine practical recommendations for improving security are described.

McNab, David↗
DOE OSTI2017

Information barrier experimental: Toward a trusted and open-source computing platform for nuclear warhead verification

Trusted measurement systems are critical for the verification of future arms-control treaties that involve confirming the authenticity of nuclear warheads on the basis of their radiation signatures. Several research efforts have produced prototype systems, but their designs are typically not published in detail, making it difficult to enable trust in these devices. The Information Barrier Experimental (IBX) is a new prototype built around the Red Pitaya computing platform using passive gamma spectroscopy. It is the first such platform designed to help a broad research community study vulnerabilities and define the required specifications for a common, trusted inspection system. It is low-cost, simple to assemble, and enables comprehensive hardware and software authentication studies. The device follows a digital data acquisition approach, which significantly reduces the number of components between scintillator and spectrum output. Finally, measurements demonstrate that this approach is technically feasible and produces excellent measurement results.

97 MATHEMATICS AND COMPUTING↗
NASA NTRS1994

Literacity: A multimedia adult literacy package combining NASA technology, recursive ID theory, and authentic instruction theory

An important part of NASA's mission involves the secondary application of its technologies in the public and private sectors. One current application under development is LiteraCity, a simulation-based instructional package for adults who do not have functional reading skills. Using fuzzy logic routines and other technologies developed by NASA's Information Systems Directorate and hypermedia sound, graphics, and animation technologies the project attempts to overcome the limited impact of adult literacy assessment and instruction by involving the adult in an interactive simulation of real-life literacy activities. The project uses a recursive instructional development model and authentic instruction theory. This paper describes one component of a project to design, develop, and produce a series of computer-based, multimedia instructional packages. The packages are being developed for use in adult literacy programs, particularly in correctional education centers. They use the concepts of authentic instruction and authentic assessment to guide development. All the packages to be developed are instructional simulations. The first is a simulation of 'finding a friend a job.'

Willis, Jerry↗
DOE OSTI2025

Deployment and Evaluation of SciStream on OLCF's Advanced Computing Ecosystem (ACE)

The growing demand for real-time analysis, experimental steering, and decision-making in scientific workflows has created a need for tightly coupled integrations between experimental facilities and high-performance computing (HPC) systems. The Department of Energy’s Integrated Research Infrastructure (IRI) initiative highlights data streaming as a key capability for enabling memory-to-memory data transfers, bypassing the limitations of traditional store-and-forward models. SciStream is a toolkit developed by researchers at Argonne National Laboratory (ANL) to support such streaming by addressing cross-domain security, delegated authentication, and application transparency. We deployed and evaluated SciStream on the Oak Ridge Leadership Computing Facility’s (OLCF) Advanced Computing Ecosystem (ACE) infrastructure, leveraging the Olivine OpenShift cluster and its high-bandwidth Data Streaming Nodes (DSNs) as gateway nodes. Our evaluation included synthetic streaming workloads derived from IRI science workflows, a streaming simulator, and integration with RabbitMQ to handle low-level messaging. This report documents the deployment process, performance evaluation, and challenges encountered, along with opportunities for future improvements.

97 MATHEMATICS AND COMPUTING↗
NASA NTRS2003

Cardea: Providing Support for Dynamic Resource Access in a Distributed Computing Environment

The environment framing the modem authorization process span domains of administration, relies on many different authentication sources, and manages complex attributes as part of the authorization process. Cardea facilitates dynamic access control within this environment as a central function of an inter-operable authorization framework. The system departs from the traditional authorization model by separating the authentication and authorization processes, distributing the responsibility for authorization data and allowing collaborating domains to retain control over their implementation mechanisms. Critical features of the system architecture and its handling of the authorization process differentiate the system from existing authorization components by addressing common needs not adequately addressed by existing systems. Continuing system research seeks to enhance the implementation of the current authorization model employed in Cardea, increase the robustness of current features, further the framework for establishing trust and promote interoperability with existing security mechanisms.

Lepro, Rebekah↗
DOE OSTI2017

rvGAHP: push-based job submission using reverse SSH connections. In: WORKS '17 Proceedings of the 12th Workshop on Workflows in Support of Large-Scale Science, Article No. 3

Computational science researchers running large-scale scientific workflow applications often want to run their workflows on the largest available compute systems to improve time to solution. Workflow tools used in distributed, heterogeneous, high performance computing environments typically rely on either a push-based or a pull-based approach for resource provisioning from these compute systems. However, many large clusters have moved to two-factor authentication for job submission, making traditional automated push-based job submission impossible. On the other hand, pull-based approaches such as pilot jobs may lead to increased complexity and a reduction in node-hour efficiency. In this paper, we describe a new, efficient approach based on HTCondor-G called reverse GAHP (rvGAHP) that allows us to push jobs using reverse SSH submissions with better efficiency than pull-based methods. We successfully used this approach to perform a large probabilistic seismic hazard analysis study using SCEC's CyberShake workflow in March 2017 on the Titan Cray XK7 hybrid system at Oak Ridge National Laboratory.

Callaghan, Scott↗
DOE OSTI2022

An initial investigation of accuracy required for the identification of small molecules in complex samples using quantum chemical calculated NMR chemical shifts

The majority of primary and secondary metabolites in nature have yet to be identified, representing a major challenge for metabolomics studies that currently require reference libraries from analyses of authentic compounds. Using currently available analytical methods, complete chemical characterization of metabolomes is infeasible for both technical and economic reasons. For example, unambiguous identification of metabolites is limited by the availability of authentic chemical standards, which, for the majority of molecules, do not exist. Computationally predicted or calculated data are a viable solution to expand the currently limited metabolite reference libraries, if such methods are shown to be sufficiently accurate. For example, determining nuclear magnetic resonance (NMR) spectroscopy spectra in silico has shown promise in the identification and delineation of metabolite structures. Many researchers have been taking advantage of density functional theory (DFT), a computationally inexpensive yet reputable method for the prediction of carbon and proton NMR spectra of metabolites. However, such methods are expected to have some error in predicted 13 >C and 1 H NMR spectra with respect to experimentally measured values. This leads us to the question–what accuracy is required in predicted 13 C and 1 H NMR chemical shifts for confident metabolite identification? Using the set of 11,716 small molecules found in the Human Metabolome Database (HMDB), we simulated both experimental and theoretical NMR chemical shift databases. We investigated the level of accuracy required for identification of metabolites in simulated pure and impure samples by matching predicted chemical shifts to experimental data. We found 90% or more of molecules in simulated pure samples can be successfully identified when errors of 1 H and 13 C chemical shifts in water are below 0.6 and 7.1 ppm, respectively, and below 0.5 and 4.6 ppm in chloroform solvation, respectively. In simulated complex mixtures, as the complexity of the mixture increased, greater accuracy of the calculated chemical shifts was required, as expected. However, if the number of molecules in the mixture is known, e.g., when NMR is combined with MS and sample complexity is low, the likelihood of confident molecular identification increased by 90%.

37 INORGANIC, ORGANIC, PHYSICAL, AND ANALYTICAL CH↗
DOE OSTI2023

Evaluating Named Data Networking for Industrial Control System [Slides]

Current proposed work is: See if the inherent security that comes with Named Networking (NDN) can be applied to Industrial Control Systems; and, Every packet is required to be cryptographically signed which makes every single piece of data communicated in the system secure and authenticated.

42 ENGINEERING↗
DOE OSTI2017

Secure Sensor Platform Software Utilities v.2.0

The SSP Software package allows a user to connect to a CoCIM via a Personality Programmer and: Reset the firmware of the CoCIM using the SSP Personality Programmer. The changes that can be made include things such as: Recovering from a tamper event; Resetting the initialization date and message counter; Change configuration values of the CoCIM using the SSP Seal Configuration or the RMSA Configuration File Editor programs. Configuration values that can be set will depend on what version of the CoCIM firmware is being used, but can include: The IP address of the translator with which this CoCIM (or RMSA) communicates; The number of attempts the CoCIM (or RMSA) will attempt to contact the translator; The primary CoCIM (or RMSA) channel; The secondary CoCIM (or RMSA) channel; Locations of files containing CoCIM (or RMSA) encryption keys SSPSerialDataDumper downloads a CoCIM’s stored messages to a computer connected to the CoCIM via a serial cable; SSPLogAnalyzer decrypts and authenticates messages that have been downloaded using the Serial Data Dumper program and then displays the messages values.

Hymel, Ross↗
NASA NTRS1993

A multimedia adult literacy program: Combining NASA technology, instructional design theory, and authentic literacy concepts

For a number of years, the Software Technology Branch of the Information Systems Directorate has been involved in the application of cutting edge hardware and software technologies to instructional tasks related to NASA projects. The branch has developed intelligent computer aided training shells, instructional applications of virtual reality and multimedia, and computer-based instructional packages that use fuzzy logic for both instructional and diagnostic decision making. One outcome of the work on space-related technology-supported instruction has been the creation of a significant pool of human talent in the branch with current expertise on the cutting edges of instructional technologies. When the human talent is combined with advanced technologies for graphics, sound, video, CD-ROM, and high speed computing, the result is a powerful research and development group that both contributes to the applied foundations of instructional technology and creates effective instructional packages that take advantage of a range of advanced technologies. Several branch projects are currently underway that combine NASA-developed expertise to significant instructional problems in public education. The branch, for example, has developed intelligent computer aided software to help high school students learn physics and staff are currently working on a project to produce educational software for young children with language deficits. This report deals with another project, the adult literacy tutor. Unfortunately, while there are a number of computer-based instructional packages available for adult literacy instruction, most of them are based on the same instructional models that failed these students when they were in school. The teacher-centered, discrete skill and drill-oriented, instructional strategies, even when they are supported by color computer graphics and animation, that form the foundation for most of the computer-based literacy packages currently on the market may not be the most effective or most desirable way to use computer technology in literacy programs. This project is developing a series of instructional packages that are based on a different instructional model - authentic instruction. The instructional development model used to create these packages is also different. Instead of using the traditional five stage linear, sequential model based on behavioral learning theory, the project uses the recursive, reflective design and development model (R2D2) that is based on cognitive learning theory, particularly the social constructivism of Vygotsky, and an epistemology based on critical theory. Using alternative instructional and instructional development theories, the result of the summer faculty fellowship is LiteraCity, a multimedia adult literacy instructional package that is a simulation of finding and applying for a job. The program, which is about 120 megabytes, is distributed on CD-ROM.

Willis, Jerry W.↗
DOE OSTI2019

Authentication Protocol for ICS without Encryption

Industrial control systems (ICS) describes the different types of control systems and associated instrumentation, which includes the devices, systems, networks, and controls used to operate and/or automate industrial processes. Depending on the industry, each ICS functions differently and are built to electronically manage tasks efficiently. Historically, industrial plants have included networking, and changes have been made over time without consideration for security. Many ICS devices currently have inadequate security features. Adding encryption in ICS is undesirable because many of the new detection method involves deep packet inspection. Therefore, we propose to develop a method of providing authentication between devices without encrypting the data. This testbed design will allow rapid development and experimentation with Cyber Physical Systems. Modbus connects to a supervisory computer with a Remote Terminal Unit (RTU) in Supervisory Control and Data Acquisition (SCADA) systems. Our project seeks to enhance security in the ICS environment by adding device authentication to the lower levels of the plant floor. This approach was selected as it allows verification of the sender of data from level 1/level 0 devices up to supervisory systems. This addition is desirable as it adds enhanced verification to the integrity of system data without obscuring (via encryption) the data being transmitted across the network. This is important because many ICS systems are real time critical (decryption adds to latency) and many other good security options require deep packet inspection (which encryption completely defeats). To accomplish this, a proof of concept of adding an authentication scheme was designed and will be tested with a common ICS protocol. The setup includes a single serial cable connecting the serial ports on two devices, a Master and a Minion. Authentication will occur in the following methods: - Data layer involving Transport Layer Security/Secure Socket Layer (TLS/SSL); - TCP/IP route implementation; - Key exchange algorithm; - Raspberry Pi programming for authentication. A portion of the setup includes adding Raspberry Pi into the system as the device is handling the authentication for the network traffic. Modbus is the chosen ICS protocol. It is used to transmit signals from instrumentation and control devices back to a main controller or data gathering system. Typically, the device identity is assumed but not verified. For verifying device identity, we constructed a digital signature architecture with TLS. A novel adaptation of this is to use only the digital signature that is provided and not the encryption capability. This allows ICS traffic to flow unobscured while still providing verification for the integrity of the data. Verification of this process will involve adding additional I/O level network devices with spoofed IP addresses and detecting the authenticated versus unauthenticated traffic. Our TLS implementation will have encryption disabled but should still allow for digital signing of data. This will enable our system to distinguish between real end devices and spoofed end devices. This experiment is presently building the test setup. It is focusing on a small setting to identify authenticated and unauthenticated devices on the network. This should allow for scaling to a larger network size after the initial proof of concept. One concern with this scheme is a certificate deployment has a large scale key management. Network size will thus increase the key management task for security. In addition, we believe that further research should be done on exploring the use of this method to defeat man-in-the-middle attacks.

42 ENGINEERING↗
DOE OSTI2020

ART Front End v1

Enhances accessibility of the Automated Recommendation Tool (ART), by adding on a graphical user interface, user authentication, and by exposing a REST API. Enables authenticated remote users and applications to interface with ART and to leverage remote computing resources to perform runs.

Forrer, Mark↗
NASA NTRS1979

Object migration and authentication

The paper presents a mechanism permitting a type manager to fabricate a migrated object representation which can be entrusted to other subsystems or transmitted outside of the control of a local computer system. The migrated object representation is signed by the type manager in such a way that the type manager's signature cannot be forged and the manager is able to authenticate its own signature. Subsequently, the type manager can retrieve the migrated representation and validate its contents before reconstructing the object in its original representation. This facility allows type managers to authenticate the contents of off-line or network storage and solves problems stemming from the hierarchical structure of the system itself.

Gligor, V. D.↗
DOE OSTI2023

Clean Energy Cybersecurity Accelerator Cohort 1: Authentication and Authorization

In the 2023 National Cybersecurity Strategy, the Biden-Harris Administration defines the need for a "defensible, resilient digital ecosystem where it is costlier to attack systems than defend them." The strategy cites the Clean Energy Cybersecurity Accelerator (CECA) as an exemplary effort to bolster the security and resilience of clean energy generation. These efforts help "secure the clean energy grid of the future and [generate] security best practices that extend to other critical infrastructure sectors" and promise broad and far-reaching impacts to bridge the capabilities of private industry and the needs of energy production. Cohort 1 of CECA launched in the fall of 2022 with a focus on solutions that provide strong authentication and authorization for industrial control systems to mitigate attacks on the energy grid. Authentication and authorization verify that the identity (authentication) and permissions (authorization) of a user or device are aligned with their assigned roles. Weaknesses in either can have serious repercussions. To assess the strength of Cohort 1's solutions, CECA devised threat scenarios grounded in historical precedents: the CECA team reviewed exploits from real-world case studies of state-sponsored actors to match the assessment's attack paths and targets. Cohort 1 results provided the energy industry, product vendors, and related agencies valuable insights into the efficacy and applicability of solutions in common system configurations under realistic threat scenarios. The results of the assessment highlight points for interrogation and improvement in subsequent technology iterations. CECA's evaluations are part of an ongoing conversation and collaboration to bolster U.S. cyber resilience against adversaries today and in the future.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2020

A holistic cyber-physical security protocol for authenticating the provenance and integrity of structural health monitoring imagery data

Modern infrastructure systems, such as bridges, dams, power generation stations, and buildings increasingly have an intrinsic cyber-physical nature to them. Infrastructure now commonly, includes actuators, network connections, sensors, control systems, and computational resources. It is of increasing concern that modern infrastructure is vulnerable to cyber-attacks that can damage both the cyber and physical nature of the infrastructure. To date, the physical and cyber health of infrastructure has been considered separately. However, the increasing concerns associated with the cyber-physical security of infrastructure coupled with the emergence of 5G networks made using components that are not universally considered trustworthy, and the emergence of techniques for creating deepfakes and adversarial examples suggests the time has come to begin considering cyber health and structural health with a more holistic approach. In this work, a protocol is developed for ensuring the imagery data captured by a structural health monitoring system can be unambiguously attributed to legitimate sensors associated with the structural health monitoring system. A computer vision approach based on the idea of mutual information is then presented to detect damage in an image. This work presents the protocol for authenticating the provenance of imager data and demonstrates that this protocol does not have overly adverse effects when used with the mutual information-based technique for detecting damage in the resulting imagery data.

Jung, HweeKwon↗