Search NASA⌕ Search

SEARCH · Search NASA

Results for “Computer authentication”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4
All sourcesNASA NTRSDOE OSTI
DOE OSTI2017

Secure Sensor Platform Software Utilities v.2.0

The SSP Software package allows a user to connect to a CoCIM via a Personality Programmer and: Reset the firmware of the CoCIM using the SSP Personality Programmer. The changes that can be made include things such as: Recovering from a tamper event; Resetting the initialization date and message counter; Change configuration values of the CoCIM using the SSP Seal Configuration or the RMSA Configuration File Editor programs. Configuration values that can be set will depend on what version of the CoCIM firmware is being used, but can include: The IP address of the translator with which this CoCIM (or RMSA) communicates; The number of attempts the CoCIM (or RMSA) will attempt to contact the translator; The primary CoCIM (or RMSA) channel; The secondary CoCIM (or RMSA) channel; Locations of files containing CoCIM (or RMSA) encryption keys SSPSerialDataDumper downloads a CoCIM’s stored messages to a computer connected to the CoCIM via a serial cable; SSPLogAnalyzer decrypts and authenticates messages that have been downloaded using the Serial Data Dumper program and then displays the messages values.

Hymel, Ross↗
DOE OSTI2019

Authentication Protocol for ICS without Encryption

Industrial control systems (ICS) describes the different types of control systems and associated instrumentation, which includes the devices, systems, networks, and controls used to operate and/or automate industrial processes. Depending on the industry, each ICS functions differently and are built to electronically manage tasks efficiently. Historically, industrial plants have included networking, and changes have been made over time without consideration for security. Many ICS devices currently have inadequate security features. Adding encryption in ICS is undesirable because many of the new detection method involves deep packet inspection. Therefore, we propose to develop a method of providing authentication between devices without encrypting the data. This testbed design will allow rapid development and experimentation with Cyber Physical Systems. Modbus connects to a supervisory computer with a Remote Terminal Unit (RTU) in Supervisory Control and Data Acquisition (SCADA) systems. Our project seeks to enhance security in the ICS environment by adding device authentication to the lower levels of the plant floor. This approach was selected as it allows verification of the sender of data from level 1/level 0 devices up to supervisory systems. This addition is desirable as it adds enhanced verification to the integrity of system data without obscuring (via encryption) the data being transmitted across the network. This is important because many ICS systems are real time critical (decryption adds to latency) and many other good security options require deep packet inspection (which encryption completely defeats). To accomplish this, a proof of concept of adding an authentication scheme was designed and will be tested with a common ICS protocol. The setup includes a single serial cable connecting the serial ports on two devices, a Master and a Minion. Authentication will occur in the following methods: - Data layer involving Transport Layer Security/Secure Socket Layer (TLS/SSL); - TCP/IP route implementation; - Key exchange algorithm; - Raspberry Pi programming for authentication. A portion of the setup includes adding Raspberry Pi into the system as the device is handling the authentication for the network traffic. Modbus is the chosen ICS protocol. It is used to transmit signals from instrumentation and control devices back to a main controller or data gathering system. Typically, the device identity is assumed but not verified. For verifying device identity, we constructed a digital signature architecture with TLS. A novel adaptation of this is to use only the digital signature that is provided and not the encryption capability. This allows ICS traffic to flow unobscured while still providing verification for the integrity of the data. Verification of this process will involve adding additional I/O level network devices with spoofed IP addresses and detecting the authenticated versus unauthenticated traffic. Our TLS implementation will have encryption disabled but should still allow for digital signing of data. This will enable our system to distinguish between real end devices and spoofed end devices. This experiment is presently building the test setup. It is focusing on a small setting to identify authenticated and unauthenticated devices on the network. This should allow for scaling to a larger network size after the initial proof of concept. One concern with this scheme is a certificate deployment has a large scale key management. Network size will thus increase the key management task for security. In addition, we believe that further research should be done on exploring the use of this method to defeat man-in-the-middle attacks.

42 ENGINEERING↗
DOE OSTI2020

ART Front End v1

Enhances accessibility of the Automated Recommendation Tool (ART), by adding on a graphical user interface, user authentication, and by exposing a REST API. Enables authenticated remote users and applications to interface with ART and to leverage remote computing resources to perform runs.

Forrer, Mark↗
DOE OSTI2023

Clean Energy Cybersecurity Accelerator Cohort 1: Authentication and Authorization

In the 2023 National Cybersecurity Strategy, the Biden-Harris Administration defines the need for a "defensible, resilient digital ecosystem where it is costlier to attack systems than defend them." The strategy cites the Clean Energy Cybersecurity Accelerator (CECA) as an exemplary effort to bolster the security and resilience of clean energy generation. These efforts help "secure the clean energy grid of the future and [generate] security best practices that extend to other critical infrastructure sectors" and promise broad and far-reaching impacts to bridge the capabilities of private industry and the needs of energy production. Cohort 1 of CECA launched in the fall of 2022 with a focus on solutions that provide strong authentication and authorization for industrial control systems to mitigate attacks on the energy grid. Authentication and authorization verify that the identity (authentication) and permissions (authorization) of a user or device are aligned with their assigned roles. Weaknesses in either can have serious repercussions. To assess the strength of Cohort 1's solutions, CECA devised threat scenarios grounded in historical precedents: the CECA team reviewed exploits from real-world case studies of state-sponsored actors to match the assessment's attack paths and targets. Cohort 1 results provided the energy industry, product vendors, and related agencies valuable insights into the efficacy and applicability of solutions in common system configurations under realistic threat scenarios. The results of the assessment highlight points for interrogation and improvement in subsequent technology iterations. CECA's evaluations are part of an ongoing conversation and collaboration to bolster U.S. cyber resilience against adversaries today and in the future.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2020

A holistic cyber-physical security protocol for authenticating the provenance and integrity of structural health monitoring imagery data

Modern infrastructure systems, such as bridges, dams, power generation stations, and buildings increasingly have an intrinsic cyber-physical nature to them. Infrastructure now commonly, includes actuators, network connections, sensors, control systems, and computational resources. It is of increasing concern that modern infrastructure is vulnerable to cyber-attacks that can damage both the cyber and physical nature of the infrastructure. To date, the physical and cyber health of infrastructure has been considered separately. However, the increasing concerns associated with the cyber-physical security of infrastructure coupled with the emergence of 5G networks made using components that are not universally considered trustworthy, and the emergence of techniques for creating deepfakes and adversarial examples suggests the time has come to begin considering cyber health and structural health with a more holistic approach. In this work, a protocol is developed for ensuring the imagery data captured by a structural health monitoring system can be unambiguously attributed to legitimate sensors associated with the structural health monitoring system. A computer vision approach based on the idea of mutual information is then presented to detect damage in an image. This work presents the protocol for authenticating the provenance of imager data and demonstrates that this protocol does not have overly adverse effects when used with the mutual information-based technique for detecting damage in the resulting imagery data.

Jung, HweeKwon↗
DOE OSTI2025

Harnessing the Power of AI: Status and Expansion of Current Domestic Transport Security Through Flexible Embedded Hardware

As applications of Artificial Intelligence (AI) continue to expand, there are increasing opportunities to leverage applied AI methodologies with mobile transportation focused embedded systems. Current applications of AI in transportation focus on a variety of areas, including fuel efficiency, safety, security, and other broad fields of optimization or detection. To leverage these AI workflows and methodologies in the field, teams must utilize complex embedded systems capable of implementing these AI-enabled algorithms in real-time. In this paper, we will investigate how these algorithms can be integrated into existing technologies leveraging vehicle data - such as the Controller Area Network Transport Security Tracking and Reporting Unit (C-STAR). The C-STAR technology is an embedded platform with onboard computation capable of running next generation algorithms in vehicle systems AI, such as preventative maintenance, driver authentication, and transport security. As deployed in the field, the C-STAR has a limited AI functionality –this paper will directly discuss how a device like C-STAR can be utilized and the advantages of integrating these new technologies. We will open with relevant background information and transportation projects that leverage AI, focusing specifically on those around transport security such as vehicle identification, anomaly detection, and deterrence. We will then extend this into potential opportunities and scaling for AI methodologies using platforms like the C-STAR. Finally, we will speak directly to the challenges of deploying AI-powered workflows, such as computing power needs, bandwidth, hallucinations, and other regulatory considerations.

Cook, Adian [ORNL] (ORCID:0000000160825395)↗
DOE OSTI2020

Enterprise Credentialing Service Statement of Work (SOW)

The scope of this project includes providing professional services in support of the development and deployment of an Enterprise Credentialing Service for the Department of Energy (DOE) National Nuclear Security Administration (NNSA), which will be used for issuing and managing credentials used for authentication, digital signature, and encryption functions by users, applications, and devices in a closed computing environment. The Seller shall provide subject matter expertise for the design and deployment of the technologies and processes that comprise the Enterprise Credentialing Service, which will include a public key infrastructure (PKI) and a credential management system (CMS) that issues and manages PKI-based smartcard credentials. The Enterprise Credentialing Service will support approximately 17,000 users at 15 DOE NNSA sites and laboratories located across the continental United States.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Similarity Downselection: Finding the n Most Dissimilar Molecular Conformers for Reference-Free Metabolomics

Computational methods for creating in silico libraries of molecular descriptors (e.g., collision cross sections) are becoming increasingly prevalent due to the limited number of authentic reference materials available for traditional library building. These so-called “reference-free metabolomics” methods require sampling sets of molecular conformers in order to produce high accuracy property predictions. Due to the computational cost of the subsequent calculations for each conformer, there is a need to sample the most relevant subset and avoid repeating calculations on conformers that are nearly identical. The goal of this study is to introduce a heuristic method of finding the most dissimilar conformers from a larger population in order to help speed up reference-free calculation methods and maintain a high property prediction accuracy. Finding the set of the n items most dissimilar from each other out of a larger population becomes increasingly difficult and computationally expensive as either n or the population size grows large. Because there exists a pairwise relationship between each item and all other items in the population, finding the set of the n most dissimilar items is different than simply sorting an array of numbers. For instance, if you have a set of the most dissimilar n = 4 items, one or more of the items from n = 4 might not be in the set n = 5. An exact solution would have to search all possible combinations of size n in the population exhaustively. We present an open-source software called similarity downselection (SDS), written in Python and freely available on GitHub. SDS implements a heuristic algorithm for quickly finding the approximate set(s) of the n most dissimilar items. We benchmark SDS against a Monte Carlo method, which attempts to find the exact solution through repeated random sampling. We show that for SDS to find the set of n most dissimilar conformers, our method is not only orders of magnitude faster, but it is also more accurate than running Monte Carlo for 1,000,000 iterations, each searching for set sizes n = 3–7 out of a population of 50,000. We also benchmark SDS against the exact solution for example small populations, showing that SDS produces a solution close to the exact solution in these instances. Using theoretical approaches, we also demonstrate the constraints of the greedy algorithm and its efficacy as a ratio to the exact solution.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2019

Federated User Account Management

Abstract. BNL SDCC (Scientific Data and Computing Center) recently deployed a centralized identity management solution to support Single Sign On (SSO) authentication across multiple IT systems. The system supports federated login access via CILogon and InCommon and multi-factor authentication (MFA) to meet security standards for various application and services such as Jupyterhub / Invenio that are provided to the SDCC user community. CoManage (Cloud) and FreeIPA / Keycloak (local) are utilized to provided complex authorization for authenticated users. This talk will focus on technical overviews and strategies to tackle the challenges/obstacles in our facility.

42 ENGINEERING↗
DOE OSTI2018

System and method for authentication

Described are methods and systems for determining authenticity. For example, the method may include providing an object of authentication, capturing characteristic data from the object of authentication, deriving authentication data from the characteristic data of the object of authentication, and comparing the authentication data with an electronic database comprising reference authentication data to provide an authenticity score for the object of authentication. The reference authentication data may correspond to one or more reference objects of authentication other than the object of authentication.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2015

Ultra-secure RF Tags for Safeguards and Security - SBIR Phase II Final Report

This is the Final Report for the DOE Phase II SBIR project “Ultra-secure RF Tags for Safeguards and Security.” The topics covered herein include technical progress made, progress against the planned milestones and deliverables, project outcomes (results, collaborations, intellectual property, etc.), and a discussion on future expectations of deployment and impacts of the results of this work. In brief, all planned work for the project was successfully completed, on or ahead of schedule and on budget. The major accomplishment was the successful development of a very advanced passive ultra-secure RFID tag system with combined security features unmatched by any commercially available ones. These tags have high-level dynamic encrypted authentication, a novel tamper-proofing mechanism, system software including graphical user interfaces and networking, and integration with a fiber-optic seal mechanism. This is all accomplished passively (with no battery) by incorporating sophisticated hardware in the tag which harvests the energy from the RFID readers that are interrogating the tag. Based on initial feedback (and deployments) at DOE’s Lawrence Livermore National Laboratory (LLNL), it is anticipated these tags and their offspring will meet DOE and international community needs for highly secure RFID systems. Beyond the accomplishment of those original objectives for the ultra-secure RF tags, major new spin-off thrusts from the original work were identified and successfully pursued with the cognizance of the DOE sponsor office. In particular, new classes of less sophisticated RFID tags were developed whose lineage derives from the core R&D thrusts of this SBIR. These RF “tag variants” have some, but not necessarily all, of the advanced characteristics described above and can therefore be less expensive and meet far wider markets. With customer pull from the DOE and its national laboratories, new RFID tags and systems (including custom readers and software) for government needs in asset management and tracking were developed. These were tested at a national laboratory and other government facilities, and resulted in immediate procurement actions by the government and deployment of these new systems. Thus, commercialization of the results of this Phase II DOE SBIR was already underway before the end of the SBIR itself. More importantly, operations involving asset management at selected DoE and government sites are already being impacted favorably and could have much broader impacts in the near future.

42 ENGINEERING↗
DOE OSTI2018

A Measurement Source Authentication Methodology for Power System Cyber Security Enhancement

This letter proposes a spatial signature-based power system measurement source identification and authentication methodology. A mathematical morphology method is used to decompose the power system measurement signals and obtain the intrinsic components, which sparsity trends and roughness values are further derived to establish the time-frequency (TF) sparsity mapping. Then random forest classification is utilized to correlate the correct measurement source for each measurement signal based on the derived TF sparsity mapping. Finally, experiment results using five phasor measurement units has validated the effectiveness of this methodology.

42 ENGINEERING↗
DOE OSTI2019

Image encryption and watermarking combined dynamic chaotic hopping pattern with double random phase encoding DRPE

In modern civilization information, security is a crucial problem. Image encryption and watermarking can effectively protect information from unauthorized access. This paper introduces a new vigorous symmetric optical image encryption and watermarking technique. This technique depends on a novel dynamic delay chaotic hopping pattern (DDCHP) combined with double random phase encoding (DRPE). To get a robust watermark image, the plain image is first watermarked with a binary secret message using a new chaotic hopping pattern (CHP) and then encrypted using a DRPE system that is controlled by double random independent keys generated with double DDCHP. In this symmetric cryptosystem, three different chaotic maps are used to enlarge the key space of the proposed cryptosystem against brute-force attack and overcome the linearity and vulnerable of the classical DRPE. The system keys are hypersensitive and their initial parameters are selected carefully. Security scrutiny proves the efficiency of the suggested cryptosystem. Therefore, the obtained simulation results prove that the cryptosystem is robust enough against the known attacks, such as statistical attack (uniform histograms of different encrypted images, correlation coefficients between the plain and the encrypted image is as low as 5.46 × 10{sup −6}), differential attack (99.99% NPCR and 38.6% UACI), brute force attack (large enough key space), and entropy attack. Moreover, the robustness of the watermark (secret message) is proved due to the solidity of CHP. The proposed approach can be used in different implementations like secure military communications, e-finance, e-healthcare, authenticated multimedia broadcasting, etc.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Assessing the Impact of Measurement Precision on Metabolite Identification Probability in Multidimensional Mass Spectrometry-Based, Reference-Free Metabolomics

Identification of compounds with minimal ambiguity remains a central challenge in mass spectrometry-based metabolomics. Conventional compound identification relies on comparing analytical signatures (e.g., mass-to-charge ratio, collision cross section, tandem mass spectra) against reference data obtained from measurements of authentic chemical standards. The breadth of annotatable compounds using this approach is necessarily limited by availability of authentic standards, analytical throughput, and resolving power of the separations that underly the measurements. The maturation of computational methods, both theory-driven and artificial intelligence/machine learning-based, for prediction of various molecular properties relevant to multidimensional mass spectrometry measurements has opened the door to a new “reference-free” paradigm of compound annotation. Through augmenting existing reference data for molecular properties with computational predictions, the universe of identifiable chemical species can be expanded significantly beyond its current limits. An unexplored aspect of this novel approach is understanding how to gauge confidence in resulting annotations, especially as the compound search space is expanded. Intuitively, the confidence of a compound annotation is related to the inherent discriminatory power of the molecular properties used for identification, as well as the precision with which the properties are measured or predicted. In this work, we characterize this relationship between measurement precision and identification probability in a systematic and quantitative fashion for a defined region of chemical space that includes organic small molecule metabolites. Importantly, this work establishes a framework for conducting metabolite identification probability analysis that enables others to quantify this relationship for their own compounds and properties of interest.

Metabolite Identification↗
DOE OSTI2021

Open Radiation Monitoring: Conceptual System Design

The Open Radiation Monitoring (ORM) Project seeks to develop and demonstrate a modular radiation detection architecture designed specifically for use in arms control treaty verification (ACTV) applications that will facilitate rapid development of trusted systems to meet the needs of potential future treaties. Development of trusted systems to support potential future treaties is a complex and costly endeavor that typically results in a purpose-built system designed to perform one specific task. The majority of prior trusted system development efforts have relied on the use of commercial embedded computers or microprocessors to control the system and process the acquired data. These processors are complex, making authentication and certification of measurement systems and collected data challenging and time consuming. We believe that a modular architecture can be used to reduce more complex systems to a series of single-purpose building blocks that could be used to implement a variety of detection modalities with shared functionalities. With proper design, the functionality of individual modules can be confirmed through simple input/output testing, thereby facilitating equipment inspection and in turn building trust in the equipment by all treaty parties. Furthermore, a modular architecture can be used to control data flow within the measurement system, reducing the risk of "hidden switches" and constraining the amount of sensitive information that could potentially be inadvertently leaked. This report documents a conceptual modular system architecture that is designed to facilitate inspection in an effort to reduce overall authentication and certification burden. As of publication, this architecture remains in a conceptual phase and additional funding is required to prove out the utility of a modular architecture and test the assumptions used to rationalize the design.

61 RADIATION PROTECTION AND DOSIMETRY↗
DOE OSTI2021

A Proxy Signature-Based Drone Authentication in 5G D2D Networks

5G is the beginning of a new era in cellular communication, bringing up a highly connected network with the incorporation of the Internet of Things (IoT). To flexibly operate all the IoT devices over a cellular network, Device-toDevice (D2D) communication standard was developed. However, IoT devices such as drones utilizing 5G D2D services could be a perfect target for malicious attacks as they pose several safety threats if they are compromised. Furthermore, there will be heavy traffic with an increased number of IoT devices connected to the 5G core. Therefore, we propose a lightweight, fast, and reliable authentication mechanism compatible with the 5G D2D ProSe standard mechanisms. Specifically, we propose a distributed authentication with a delegation-based scheme instead of the repeated access to the 5G core network key management functions. Hence, a legitimate drone is authorized by the core network via offering a proxy signature to authenticate itself to other drones. We implemented the proposed protocol in ns-3 that supports 5G D2D-based communication. We also conducted computational calculations on the RaspberryPi3 IoT device to mimic the drone calculation process and delays. The results demonstrate that the proposed protocol is lightweight and reliable

5G security↗
DOE OSTI2016

PIV Logon Configuration Guidance

This document details the configurations and enhancements implemented to support the usage of federal Personal Identity Verification (PIV) Card for logon on unclassified networks. The guidance is a reference implementation of the configurations and enhancements deployed at the Los Alamos National Laboratory (LANL) by Network and Infrastructure Engineering – Core Services (NIE-CS).

97 MATHEMATICS AND COMPUTING↗