Search NASA⌕ Search

SEARCH · Search NASA

Results for “Secure Software Development”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

The Chemical Management System (CMS): A Useful Tool for Inventory Management

Comprehensive inventory management is central to the efficient operation of any facility that uses and stores chemicals. There are numerous software packages available that perform this function satisfactorily. Most commercially available inventory management software is regulatory or procurement focused and usually comes with upfront or monthly fees. Finally, this report describes freely downloadable software developed at Sandia National Laboratories that delivers an effective inventory management system with an additional focus on chemical security.

37 INORGANIC, ORGANIC, PHYSICAL, AND ANALYTICAL CH↗
DOE OSTI2016

Los Alamos National Security, LLC Request for Information on how industry may partner with the Laboratory on KIVA software.

KIVA is a family of Fortran-based computational fluid dynamics software developed by LANL. The software predicts complex fuel and air flows as well as ignition, combustion, and pollutant-formation processes in engines. The KIVA models have been used to understand combustion chemistry processes, such as auto-ignition of fuels, and to optimize diesel engines for high efficiency and low emissions. Fuel economy is heavily dependent upon engine efficiency, which in turn depends to a large degree on how fuel is burned within the cylinders of the engine. Higher in-cylinder pressures and temperatures lead to increased fuel economy, but they also create more difficulty in controlling the combustion process. Poorly controlled and incomplete combustion can cause higher levels of emissions and lower engine efficiencies.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2023

SCUC-DER Integration Report: Integrating Distributed Energy Resources (DER) Using Advanced Unit Commitment Models and DER Aggregation Methodologies

Distributed energy resources (DERs) are continuing to grow due to regulatory, policy, and market shifts, and it needs to be ensured that small DERs are given a level playing field with traditional resources. Legacy market processes such as unit-commitment problems were designed for a power grid consisting largely of centralized power plants. In contrast, DERs consist of many small devices with distinct operating characteristics that may or may not be connected at the transmission interconnection points, limiting their visibility to the independent system operators (ISOs) who operate wholesale electricity markets. This report details the development and initial results from a simulation platform that integrates state-of-the-art security-constrained unit commitment software, detailed feeder models, and a DER aggregator model to quantify potential DER integration issues. Quantitative results to date illustrate potential infeasible scheduling solutions from SCUC when the DERA includes aggregations of energy-limited energy storage resources. Likewise, if aggregations are not penalized for dispatch deviations, they may have incentives to deviate from the SCUC-determined resource schedules. Assumptions about the amount of aggregated demand response resources (DRRs) and the ability of DERAs to follow profit incentives have an important impact – DRRs have significant flexibility and can typically feasibly meet their SCUC schedule, but on the other hand, their profit incentives can cause unscheduled increases in load before and after DRR dispatch. Computation time results on the SCUC solver and simulation platform only show a modest increase in SCUC solution time as the number of DERAs is increased, but results to date only reflect the RTS-GMLC test system; results may show more significant solver slowdown in larger transmission systems. The largest contribution to simulation time is attributed to the DERA offer generation method, which is suggested for future improvements.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2016

Importance Ranking of Software Dependability Attributes in the Nuclear Industry

With the current transition from analog to digital instrumentation and control systems in nuclear power plants, the number and variety of software-based systems has significantly increased. Due to the sophisticated nature and the increasing complexity of software, a significant challenge faced by the nuclear industry is the trust one can place in software-based systems once they have been developed. The trust placed in software is typically termed software dependability, a qualifier which encompasses different attributes such as software reliability, safety, security, availability and maintainability. It is recognized that these attributes relate to each other in different ways under various scenarios. The detailed dependencies between software dependability attributes can be found in a previous study. With limited time and budget resources, which dependability attribute should be given the highest priority when certifying software-based systems in the nuclear industry is a fundamental question that needs to be answered. This paper addresses this problem using stakeholders' opinion elicitation. A comprehensive questionnaire was designed to elicit the goals that should be fulfilled by the nuclear industry and to collect the relative importance of the various dependability attributes for each goal. We then used the Analytical Hierarchy Process (AHP) to analyze the data and obtained the relative importance ranking of software dependability attributes in the context of a reactor protection system. The results will provide guidance to resource allocation for the certification of software dependability in the nuclear industry. (authors)

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2019

Secure Design and Development Cybersecurity Capability Maturity Model (SD2-C2M2): Next-Generation Cyber Resilience by Design

The Secure Design and Development Cybersecurity Capability Maturity Model (SD2-C2M2) provides a browser-based tool that allows hardware and software developers to assess the maturity level of their design and development processes, allows management to determine desired maturity levels in seven domains, and allows developers to monitor process maturity improvements against management goals. The tool can be used by commercial developers as well as internal development organizations. This paper provides an overview of the tool and domains and presents a hypothetical case study of the tool to reduce software buffer overflow attack vulnerabilities by improving the software development process.

Gourisetti, Sri Nikhil G.↗
DOE OSTI2024

Inventory of Composable Elements (ICE) v6.0.0

The Inventory of Composable Elements (ICE) is an open source registry software platform for managing information about biological parts. It is capable of recording information about plasmids, microbial host strains and seeds, as well as DNA parts. Includes features such as DNA sequence visualization, editing and annotation, auto-aligning sequencing trace files against reference templates, SBOL XML/RDF support, and web-of-registries functionality. The web of registries functionality provides strong support for distributed interconnected use and enables sharing and transfer of biological parts across various independent ICE instances. ICE adopts modern software development principles, leveraging component-base frameworks, offering a REST API for convenient third-party integration and emphasizing scalability, security, and service integrations for dynamic content availability. The source code is hosted at https://github.com/JBEI/ice. A public instance is available at public-registry.jbei.org, where users can try out features, upload parts or simply use it for their projects.

Plahar, Hector↗
DOE OSTI2020

Overview of the MCNP6® SQA Plan and Requirements [Memorandum]

For all X Computational Physics Division (XCP) software under the Associate Laboratory Directorate for Weapons Physics (ALDX), the Weapons Research Services Secure Networks and Assurance Group (WRS-SNA) manages the software quality assurance (SQA) plan, requirements and guidance with respect to development processes and tools to meet the broader LANL SQA requirements. Each XCP software product is categorized into one of three software types: Safety Software, Non-Safety Risk Significant Software, and Non-Safety Commercially Controlled Software. In 2018, using LANL Form 2033, the MCNP6 code was categorized by the XCP division as Non-Safety Commercially Controlled Software, provided in Appendix A. Using WRSFORM- 0001U, the MCNP6 code was graded as a Medium Impact software product, provided in Appendix B. Given these determinations, the WRS-AD-0010U SQA plan is followed for all MCNP6 developments, documentation and code releases.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

The Nuclear Digital I&C System Supply Chain Cyber-Attack Surface

The nuclear supply chain attack surface is a large, complex network of interconnected stakeholders and activities. The global economy has widened and deepened the supply chain, resulting in larger numbers of geographically dispersed locations and increased difficulty ensuring the authenticity and security of digital assets. Although the nuclear industry has made significant strides in securing facilities from cyber-attacks, the supply chain remains vulnerable. This paper outlines supply chain threats and vulnerabilities and provides a Digital I&C System Supply Chain Cyber-Attack Surface diagram to illustrate the complexity of securing hardware, firmware, software, and system information throughout the entire supply chain lifecycle. The knowledge presented in this paper provides a foundation to use in cybersecurity supply chain risk analysis and to guide future supply chain research and development efforts leading to enhancement of a nuclear facility’s overall security posture.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
DOE OSTI2022

Module-OT: A Turnkey Solution for Securing Energy Systems

The Modular Security Apparatus for Managing Distributed Cryptography for Command-and-Control Messages on Operational Technology Networks (Module-OT) is a flexible and lightweight solution for grid-edge devices focusing on end-to-end security. It is a bump- in- the-wire solution acting as a secure conduit for data between devices or systems across a network. It improves the cybersecurity posture of DER systems by providing authentication, authorization, and data integrity to secure DER communications. Additionally, it performs key management, provides data security through whitelisting Internet Protocol addresses and ports, blocks unauthorized connections, controls user access, and allows serial or Ethernet connections for added flexibility. The core software is portable to various Linux-based operating systems and is developed to be customized by the developer and researcher communities. Module-OT has been validated in the lab, has been demonstrated at a 500-KW PV-plus-storage site, and has been proven ready to secure operational technology devices. Its core functionality meets current standards, including validation procedures of the NIST Cryptographic Algorithm Validation Program (CAVP) and the Federal Information Processing Standard (FIPS 140-2). Because of its capability to provide an accessible and affordable option for stepping up security across modern energy systems, Module-OT can serve as an effective technological option to standardize cybersecurity moving forward.

cryptography↗
DOE OSTI2017

Singularity: Scientific containers for mobility of compute

Here we present Singularity, software developed to bring containers and reproducibility to scientific computing. Using Singularity containers, developers can work in reproducible environments of their choosing and design, and these complete environments can easily be copied and executed on other platforms. Singularity is an open source initiative that harnesses the expertise of system and software engineers and researchers alike, and integrates seamlessly into common workflows for both of these groups. As its primary use case, Singularity brings mobility of computing to both users and HPC centers, providing a secure means to capture and distribute software and compute environments. This ability to create and deploy reproducible environments across these centers, a previously unmet need, makes Singularity a game changing development for computational science.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

VARS Framework

The Verification and Validation Assuring Reliability and Security (VARS) project team has developed the proof-of-concept VARS framework which will be implemented in the form of a software tool called Risk-Informed Verification and Validation Recommendation (RIVVR). The framework will provide Energy Delivery System (EDS) stakeholders with cybersecurity focused verification and validation (V&V) approach which includes list of potentially relevant vulnerabilities to test or address, pre-procurement guidance, and separate lists of relevant standards, tools, and techniques (ST2) to be considered by utilities and vendors

Pal, Seemita↗
DOE OSTI2018

Verification and Validation of Optimization of Replacement Portal Monitoring Replay Tools

The Los Alamos National Laboratory and the Johns Hopkins Applied Physics Laboratory (APL) are both developing optimization software to fulfill the objective of Phase III of the Replacement Portal Monitoring (RPM) Program for the Department of Homeland Security. The objective of the Phase III of the RPM Program is to conduct an evaluation of three RPM systems designed to enhance mission effectiveness, gain operational efficiencies, and to address emerging mission needs against the Countering Weapons of Mass Destruction (CWMD ) nuclear threat basis and special nuclear material (SNM) used in performance testing. As such this task involves the use of global optimization algorithms.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
DOE OSTI2026

Firmware Tampering Detection in Heavy-Duty Vehicles through J1939 CAN Analysis

Modern heavy-duty vehicles rely on complex networks of Electronic Control Units (ECUs) that communicate using the J1939 protocol. While this system makes it easier to update and configure vehicle components, it also opens the door to serious cybersecurity risks if not properly secured. This work investigates the potential for firmware tampering through the J1939 communication protocol, which enables ECU configuration and reprogramming over the Controller Area Network (CAN) bus. By monitoring CAN traffic during legitimate maintenance operations and reverse-engineering OEM diagnostic software, we identified common and proprietary J1939 message identifiers, authentication patterns, and vulnerabilities within Unified Diagnostic Services (UDS). These findings demonstrate that inadequate authentication mechanisms can allow malicious actors to alter ECU firmware or disable safety functions, posing severe operational and safety risks. Our analysis contributes to the development of vehicle intrusion detection systems capable of recognizing abnormal reprogramming activity and future firmware fingerprinting methods to verify software integrity across ECUs. This work highlights the importance of standardizing secure firmware authentication across manufacturers to strengthen cyber resilience in heavy-duty vehicle systems.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2022

Overcoming Challenges to Continuous Integration in HPC

Continuous integration (CI) has become a ubiquitous practice in modern software development, with major code hosting services offering free automation on popular platforms. CI offers major benefits, as it enables detecting bugs in code prior to committing changes. While high-performance computing (HPC) research relies heavily on software, HPC machines are not considered “common” platforms. This presents several challenges that hinder the adoption of CI in HPC environments, making it difficult to maintain bug-free HPC projects, and resulting in adverse effects on the research community. Here we explore the challenges that impede HPC CI, such as hardware diversity, security, isolation, administrative policies, and non-standard authentication, environments, and job submission mechanisms. We propose several solutions that could enhance the quality of HPC software and the experience of developers. Implementing these solutions would require significant changes at HPC centers, but if these changes are made, it would ultimately enable faster and better science.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2019

Particle/Ray Interaction Simulation Manager (PRISM) Assessment Report

The Particle/Ray Interaction Simulation Manager (PRISM) is a software tool developed by Triple Ring Technologies (TRT), http://www.tripleringtech.com/, under a Small Business Innovation Research Award from the Department of Homeland Security (DHS) to investigate the utility of simulations in X-ray-based explosive detection systems. The PRISM tool is intended to provide a standardized and intuitive user interface to control and configure realistic simulations of X-ray imaging systems. It includes a command-line interface that enables the user to configure simulated X-ray radiography and computed tomography (CT) systems. It allows the import of computer-aided design (CAD) models of objects and it supports Monte Carlo simulation engines such as GEANT4. PRISM is designed to simulate realistic X-ray projection images including scatter, noise, and various detector effects such as quantum efficiency, lag, and veiling glare. At the request of DHS, the authors assessed PRISM’s capabilities to simulate data generated by a Micro-CT test-bed system (MCT-TB) housed at the Lawrence Livermore National Laboratory (LLNL). This document describes the results of that assessment.

42 ENGINEERING↗
DOE OSTI2021

ExaSGD: 2021 Kernel Thrust Activities

The Kernel Thrust milestone ADSE22-214 covers the development of device-capable optimization algorithms and solvers technologies required by the ExaSGD project’s software stack in order to solve security-constrained alternating current optimal power flow (SC-ACOPF) problems on emerging exascale architectures. To this extent, in FY21 the main objective of the Kernel Thrust was (i) provide robust optimization solver(s) that run efficiently on hardware accelerator devices (i.e., NVIDIA and AMD GPUs) to perform intra-node computations and (ii) provide coarse-grain parallel optimization capabilities that exploit the decomposition opportunities present in the SC-ACOPF challenge problems to provide exascale-capable solvers.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2017

Security-informed safety: integrating security within the safety demonstration of a smart device - 157

Safety and security engineering have, over the years, developed their own regulations, standards, cultures, and practices. However, there's a growing realisation that security is closely connected to safety. Safety must be security-informed: if a safety-critical system isn't secure, it isn't safe. A safety demonstration is incomplete and unconvincing unless it considers security. In our work for government and industry, we have used the Claims, Arguments, Evidence (CAE) framework to analyse the impact of security on a safety justification or safety case and identified the significant changes needed to address security explicitly. This will impact the design and implementation process as well as the assurance and V and V approach. In this paper we discuss the impact of integrating security when developing a safety demonstration of a smart device. A smart device is an instrument, device or component that contains a microprocessor (and therefore contains both hardware and software) and is programmed to provide specialised capabilities, often measuring or controlling a process variable. Examples of smart devices include radiation monitors, relays, turbine governors, uninterruptible power supplies and heating ventilation, and air conditioning controllers. (authors)

42 ENGINEERING↗
DOE OSTI2020

XRootD Third Party Copy for the WLCG and HLLHC

A Third Party Copy (TPC) mechanism has existed in the pure XRootD storage environment for many years. However, using the XRootD TPC in the WLCG environment presents additional challenges due to the diversity of the storage systems involved such as EOS, dCache, DPM and ECHO, requiring that we carefully navigate the unique constraints imposed by these storage systems and their site-specific environments through customized configuration and software development. To support multitenant setups seen at many WLCG sites, X509 based authentication and authorization in XRootD was significantly improved to meet both security and functionality requirements. This paper presents architecture of the pull based TPC with optional X509 credential delegation, and how it is implemented in native XRootD and dCache. The paper discusses technical requirements, challenges, design choices and implementation details in the WLCG storage systems, as well as in FTS/gfal2. It also outlines XRootD’s plan to support newer TPC and security models such as token based authorization.

Adye, T.↗