Search NASA⌕ Search

SEARCH · Search NASA

Results for “authentication”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

The Design and Evaluation of Zero Trust Architecture for Electric Vehicle Charging Infrastructure: EVs @ Scale Series on EV Charging Station Cybersecurity

Implementing a zero trust architecture can significantly bolster the security of electric vehicle (EV) charging infrastructure. EV charging infrastructure includes numerous networked interfaces, each of which can present potential vulnerabilities. When these vulnerabilities are exploited, they can compromise the entire system, leading to severe operational and security risks. Zero trust is a security model that operates on the principle of "never trust, always verify," which helps manage the attack surface and limit the scope of any potential compromises. Fundamentally, this model ensures that no entity, whether inside or outside the network, is trusted by default. The design principles of zero trust include continuous verification, strict deny-by-default access controls, and micro-segmentation. Continuous verification ensures that every request is thoroughly checked, regardless of its origin. Strict access controls enforce the principle of least privilege, allowing users and devices only the minimum necessary access to perform their functions. Micro-segmentation involves dividing the network into smaller, isolated segments to prevent lateral movement in case of a breach. In the context of EV charging infrastructure, zero trust can be implemented through various strategies. For example, multi-factor authentication (MFA) can be required for engineers to access the management interfaces and control systems of charging stations. Real-time monitoring and analysis of network traffic can help detect and respond to anomalies. Systems that do not need to communicate with each other can be micro-segmented to enhance security. All communications should adhere to predefined policies to be permitted. Additionally, encrypting communications can protect sensitive information exchanged between chargers and management systems. This paper presents a zero trust architecture specifically designed for EV charging infrastructure. Implementing zero trust not only mitigates risks but also builds a resilient infrastructure capable of withstanding and quickly recovering from cyber threats. The architecture addresses six defined security objectives. A comprehensive test plan is developed to assess the architecture against these objectives, and the results of the evaluation are reported. This approach is essential for maintaining the reliability and integrity of EV charging services in an increasingly interconnected and vulnerable digital landscape. This is the first in a planned series of papers exploring the implementation of zero trust in EV charging infrastructure. Each paper will delve into different aspects and applications of zero trust, highlighting how various work processes and requirements can lead to distinct architectural designs. These architectures will be tailored to address specific security challenges and operational needs within the EV charging ecosystem, ensuring a robust and adaptable security framework.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2024

A Managed Tokens Service for Securely Keeping and Distributing Grid Tokens

Fermilab is transitioning authentication and authorization for grid operations to using bearer tokens based on the WLCG Common JWT (JSON Web Token) Profile. One of the functionalities that Fermilab experimenters rely on is the ability to automate batch job submission, which in turn depends on the ability to securely refresh and distribute the necessary credentials to experiment job submit points. Thus, with the transition to using tokens for grid operations, we needed to create a service that would obtain, refresh, and distribute tokens for experimenters’ use. This service would avoid the need for experimenters to be experts in obtaining their own tokens and would better protect the most sensitive long-lived credentials. Further, the service needed to be widely scalable, as we are currently keeping credentials active for approximately 15 experiments, each with 1-3 different credentials, and distributing those credentials to 2-20 submit points per experiment, with those numbers steadily increasing. To address these issues, we created and deployed a Managed Tokens service. The service is written in Go, taking advantage of that language’s native concurrency primitives to easily be able to scale operations as we onboard experiments. The service uses as its first credentials a set of kerberos keytabs, stored on the same secure machine that the Managed Tokens service runs on. These kerberos credentials allow the service to use htgettoken via condor_vault_storer to store vault tokens in the HTCondor credential managers (credds) that run on the batch system scheduler machines (HTCondor schedds); as well as downloading a local, shorter-lived copy of the vault token. The kerberos credentials are then also used to distribute copies of the locally-stored vault tokens to experiment submit points. When experimenters schedule jobs to be submitted, these distributed vault tokens are used to access a Hashicorp Vault instance (run separately from the Managed Tokens service), and previously-stored refresh tokens there are used to obtain the bearer token that is submitted with the job. We will discuss here the design of the Managed Tokens service, including elaborating on certain choices we made with regards to concurrent operations, configuration, monitoring, and deployment.

Bhat, Shreyas↗
DOE OSTI2024

Analyzing Risks of Virtual Private Network Connections

The use of Splunk for analyzing VPN logs is an effective approach for identifying vulnerabilities in network endpoints. Splunk, a powerful platform for searching, monitoring, and analyzing machine-generated data, enables organizations to aggregate VPN logs in real-time, providing insights into network activity, user behavior, and potential security risks. By indexing VPN traffic and authentication logs, security teams can track abnormal patterns such as multiple failed login attempts, unusual IP addresses, or unexpected changes in bandwidth usage, all of which could indicate potential vulnerabilities or breaches. With Splunk’s advanced search and reporting capabilities, users can create custom dashboards and alerts to detect suspicious activities. Automated searches can flag endpoints exhibiting unusual behavior, while correlation analysis can identify links between compromised devices and broader network vulnerabilities. In particular, Splunk's machine learning capabilities can be leveraged to predict and prevent threats by identifying trends that might otherwise be missed in traditional log analysis. This proactive approach to monitoring VPN logs allows for the early detection of security weaknesses, enabling rapid response and minimizing potential damage to network integrity. By enhancing endpoint visibility, Splunk plays a crucial role in securing remote connections and safeguarding sensitive information. Additionally, Splunk’s automation and alerting features allow teams to create custom workflows that notify them of vulnerable or misconfigured endpoints identified through Shodan. This synergy between Splunk’s log analysis and Shodan’s device intelligence enhances an organization’s ability to proactively identify and mitigate security risks, improving the overall resilience of their VPN infrastructure.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

A Taxonomy and Feature set for Server-Side Identification of Proxies

Malicious actors frequently use proxies and VPNs to evade detection and hide their origin. Current challenges to information security include the use of residential proxies to blend in with normal traffic and Man-in-the-Middle phishing proxies that are used to compromise accounts protected with mult-factor authentication. We advance a taxonomy and feature set for the identification of proxied traffic based on the network layer where proxying occurs. We describe how these features apply to common proxy types and how to use these features in the classification of the proxied traffic. Collection of these additional features is feasible using existing network sensors and web servers, while only adding about 30% volume to commonly deployed network sensor logs.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Enabling Innovative Analysis on Heterogeneous Clusters through HTCdaskgateway

High energy particle (HEP) physics research is going through fundamental changes as we move to collect larger amounts of data from the Large Hadron Collider (LHC). Analysis facilities and distributed computing, through HTCs, have come together to create the next pythonic generation of analysis by utilizing HTCdaskgateway, a Dask gateway extension, allowing users to spawn workers compatible with both their analysis and heterogeneous clusters in line with authentication requirements. This is enabling physicists to engage with scientific python in ways they had not before because of domain specific C++ tools. An example of HTCdaskgateway’s use is Fermilab’s Elastic Analysis Facility.

Chavez, Elise [U. Wisconsin, Madison (main)]↗
DOE OSTI2024

A Prototype Software to Demonstrate a Data Catalog for Hanford Environmental Datasets

Ensuring that data on long-term environmental remediation at the Hanford Site is high-quality, traceable, and easily accessible is an ongoing challenge, complicated by decades of data collection, multiple contractors maintaining data sources, and the wide range of data types. A centralized data catalog, known as the Hanford Environmental Information and Data Index (HEIDI), has been under development as part of the Hanford Environmental Data Management (HEDM) program to address these challenges. HEIDI fulfills a critical need to bring together a wide range of data types and sizes from multiple authoritative data sources, while documenting the data pedigree and quality information (i.e., traceable to the data source/originator). This document describes additional development and maturation of the HEIDI prototype. Key accomplishments included deploying the catalog software, Esri Geoportal Server, on a server accessible to Hanford Local Area Network users, conducting cybersecurity evaluations, investigating integrated authentication solutions, and conducting functional testing of the catalog prototype. The server-based deployment enabled targeted feedback, leading to enhancements including improved accessibility features and an expanded metadata schema. Specifications for the server-based deployment of the prototype catalog and the HEIDI metadata schema are provided in this document to support subsequent HEIDI deployment by the U.S. Department of Energy Richland Operations Office.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2025

A Novel, Low-Cost, Portable Device for Counterfeit and Noncompliant Refrigerant Detection

The increasing prevalence of counterfeit refrigerants presents significant risks to Heating, Ventilation, Air Conditioning, and Refrigeration (HVACR) systems, including compromised equipment performance, safety hazards, and environmental non-compliance. This report details the development of a novel, cost-effective, and portable detection device designed to accurately identify counterfeit refrigerants. The device utilizes a controlled gas sampling and analysis system within a sealed chamber, ensuring precise measurements while maintaining safety through a purging mechanism. The system features a high-sensitivity sensor integrated with an onboard control module that analyzes gas composition in real-time, providing users with clear visual indicators for refrigerant authenticity. Laboratory validation demonstrated the device’s high accuracy (exceeding 95%) in detecting unauthorized refrigerant blends. Key advantages include affordability, ease of use, rapid response time, and compatibility with a wide range of refrigerants. This solution supports compliance with regulatory frameworks such as the AIM Act, enhances safety in HVACR operations, and mitigates the risks associated with counterfeit refrigerants. Future developments will focus on expanding refrigerant detection capabilities, integrating machine learning for enhanced accuracy, implementing cost-reduction strategies to improve accessibility and market adoption, and optimizing system packaging for enhanced field portability.

37 INORGANIC, ORGANIC, PHYSICAL, AND ANALYTICAL CH↗
DOE OSTI2025

Deployment and Evaluation of SciStream on OLCF's Advanced Computing Ecosystem (ACE)

The growing demand for real-time analysis, experimental steering, and decision-making in scientific workflows has created a need for tightly coupled integrations between experimental facilities and high-performance computing (HPC) systems. The Department of Energy’s Integrated Research Infrastructure (IRI) initiative highlights data streaming as a key capability for enabling memory-to-memory data transfers, bypassing the limitations of traditional store-and-forward models. SciStream is a toolkit developed by researchers at Argonne National Laboratory (ANL) to support such streaming by addressing cross-domain security, delegated authentication, and application transparency. We deployed and evaluated SciStream on the Oak Ridge Leadership Computing Facility’s (OLCF) Advanced Computing Ecosystem (ACE) infrastructure, leveraging the Olivine OpenShift cluster and its high-bandwidth Data Streaming Nodes (DSNs) as gateway nodes. Our evaluation included synthetic streaming workloads derived from IRI science workflows, a streaming simulator, and integration with RabbitMQ to handle low-level messaging. This report documents the deployment process, performance evaluation, and challenges encountered, along with opportunities for future improvements.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2026

DER Cybersecurity Standards: Assessment and Gap Analysis

The purpose of this report is to share the comprehensive gap analysis of existing cybersecurity standards applicable to Distributed Energy Resources (DERs) within the electric power sector. This analysis aims to identify critical deficiencies in current standards, assess their alignment with industry needs, and provide actionable recommendations for enhancing cybersecurity measures. The scope encompasses various DER technologies, including solar, wind, energy storage, and hydrogen fuel cells, and emphasizes the significance of establishing robust cybersecurity frameworks and standards to safeguard these increasingly integrated systems. The report provides valuable insights for stakeholders in the DER ecosystem, including manufacturers, utilities, and regulators. It underscores the importance of continued development and refinement of cybersecurity standards to keep up with the technical advances in DERs and associated cybersecurity challenges. The analysis evaluated IEC, IEEE, ISA, ISO, and UL standards relevant to DER cybersecurity. Standards were assessed on their coverage of key requirements including data availability, integrity, confidentiality, access control, authentication, encryption, and system hardening. For each standard, the analysis assessed its alignment with current industry practices, regulatory compliance, effectiveness in addressing known risks, coverage of emerging risks, and how it promotes interoperability. The evaluation also considered potential integration challenges and barriers to adoption.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Characterization of Peripheral Neurophotonic Systems for High-Performance Human-Computer Interfaces (CRADA Final Report)

As part of the Cyclotron Road program, Morphosis Inc. sought to investigate a non-invasive neuromuscular sensing approach for use as an intuitive and secure human–computer interface. These highly miniaturized, wearable neural interfaces were completely non-invasive and maintained stable, high-bandwidth, long-term access to a user’s actions, intent, and identity, while offering an exceptionally high signal-to-noise ratio compared to contemporary neural recording technologies. The widespread adoption of neural interfaces had the potential to reshape how people interact with technology, with profound societal impacts. Millions worldwide suffered from movement and/or speech disabilities, and these tools had the potential to democratize access to technology to enhance autonomy and quality of life. More broadly, interfaces capable of accurately conveying intentions and safeguarding identities could serve as a cornerstone for privacy, trust, and personal authenticity in digital environments. The use of thought-driven control of digitally enabled devices and governance of digital identities had the potential to revolutionize relationships with technology, transforming how people learn, communicate, and interact with the world.

42 ENGINEERING↗
DOE OSTI2025

An Nginx-based Content Distribution Network for HEP

With the move to HTTP/WebDAV and JSON Web Tokens as a standard protocol for transfers within the WLCG distributed storage network, a large amount of off-the-shelf technologies become viable for meeting the requirements of a Storage Element (SE). In this work, we explore the capabilities and performance of the OpenResty framework, which extends the nginx server with the LuaJIT scripting language, to recreate the feature set of a SE. We demonstrate token-authenticated HTTP read, write, and WebDAV third-party copy features, as well as a storage federation with HTTP redirect, proxy, and caching capabilities. We further explore the performance scaling in terms of throughput and requests per second.

Aarora, Aashay [UC, San Diego]↗
DOE OSTI2026

Expanding the Boundaries of Transuranium Chemistry

During the last several Heavy Elements Chemistry grant cycles under award(s): DE-FG02-13ER16414, we have published nearly 90 research articles (see bibliography) in 25 peer-reviewed journals. Additionally, this funding has resulted in several review articles. Together, these publications have already reached well over 4500 citations. These research articles have introduced several hundreds of new crystallographically authenticated f-element compounds and materials and have greatly affected the field of Heavy Elements Chemistry. Concentrating on the heaviest elements that can be studied on the milligram scale, the transplutonium elements are the focus of nearly 30 of these manuscripts containing results such as the first single crystal structure of a berkelium compound and californium presenting itself as an additional transition point in the actinide series.

38 RADIATION CHEMISTRY, RADIOCHEMISTRY, AND NUCLEA↗
DOE OSTI2025

Securing Grid Communications Infrastructure: Addressing Gaps Beyond NERC CIP Facility Perimeters

The North American electric grid relies on a complex communications infrastructure that extends beyond facility perimeters traditionally covered by NERC Critical Infrastructure Protection (CIP) standards. While CIP requirements have significantly strengthened cybersecurity within Electronic Security Perimeters, many operational communications—such as those between control centers, substations, and third-party networks—fall outside current regulatory scope. As grid modernization introduces new technologies and connectivity models, these external pathways present evolving security challenges. This brief explores the nature of these challenges, including emerging attack vectors and supply chain considerations, and highlights how ongoing grid transformation increases exposure to sophisticated threats. It outlines practical strategies and policy options to complement existing standards, such as expanding secure communications practices, enhancing supply chain transparency, and fostering collaboration among federal, state, and industry stakeholders. Near-term actions like encryption, authentication, and contractual safeguards can help reduce risk while longer-term frameworks are developed to ensure resilient and secure grid operations.

24 - POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2026

Scalable Fabrication of a Fibrous Amine-functionalized Matrix (FAM) Sorbent for Critical Mineral Recovery

We report a novel flat sheet Fibrous Amine-functionalized Matrix (FAM) sorbent platform designed for efficient and selective capture of CM from dilute solutions. The FAM sorbent features crosslinked amine microfilms coated onto/within a glass fiber matrix, providing fast mass transfer and excellent mechanical stability. Systematic batch and flow-through tests with FAM revealed rapid metal uptake kinetics and high capacity for representative species, achieving ~90 mg/g of Gallium, ~100 mg/g of Cobalt, and ~90 mg/g for Neodymium. Moreover, multiple eluents, including mineral acids and complexing agents, enabled highly effective desorption of adsorbed metals, demonstrating the feasibility of regenerating FAM sorbents. Importantly, tests with authentic coal ash leachate demonstrated strong selectivity toward U.S. Department of Energy (DOE)-listed CM and rare earth elements over abundant base cations, confirming the robustness of FAM in realistic complex solutions. The flat sheet geometry was amenable to scaling into durable spiral wound modules, highlighting the potential for future regeneration and reuse. This work establishes FAM sorbents as a promising platform for the recovery of CM from wastewaters, advancing both resource sustainability and environmental stewardship.

critical mineral recovery↗
DOE OSTI2026

Integrating DOE ASCR Computing into HEPCloud through GlideinWMS

Fermilab's HEPCloud facility expands the laboratory's computing capacity by provisioning resources beyond the local grid, using GlideinWMS to deliver pilots to where experiments such as CMS and DUNE run. The High-Performance Computing (HPC) facilities of the DOE Office of Advanced Scientific Computing Research (ASCR) are a growing part of that pool. HEPCloud currently provisions NERSC over SSH, but NERSC is moving away from that path as it adopts multi-factor authentication and directs automated access to its Superfacility API and the DOE Integrated Research Infrastructure (IRI) APIs. Maintaining and extending access across the ASCR ecosystem now requires provisioning through these interfaces. This work adds new pilot submission paths to GlideinWMS for the NERSC Superfacility API, IRI, and Globus Compute. Each uses the provisioning model GlideinWMS already applies to batch resources, so experiments can run on ASCR computing resources without changes to their existing workflows. This work finally presents a comparison of the paths to guide which interfaces are best suited for different workflows.

Majumder, Meghanto [U. Houston (main)]↗
DOE OSTI2026

Expandable Log Analyzing Framework

Prior to my internship, I was informed that a previous intern had built a tool to analyse MongoDB logs and look for invalid access attempts, which served as a great reference point for my project. I was initially tasked with expanding on her prototype and filling in the gaps such as integrating it with the main monitoring tool the lab uses. Eventually, the scope grew, expanding to support other databases and a growing collection of tools. I organized the framework around an observer pattern, meaning one point in the program sending updates to the rest of the framework. Every time a log was read and parsed, it was sent to be processed by the tools, using the type of event as a means to determine which tools should get a chance to act on the log. This decouples the tools from the log reader, making future updates and additions much easier. The framework processes MongoDB logs at ~135,000 entries per second and PostgreSQL logs at ~170,500 entries per second, accurately detecting anomalies such as slow queries and connections from unknown addresses. This framework serves to fill gaps in database monitoring tools currently implemented at the lab, such as tracking failed authentication for PostgreSQL and MongoDB which had very minimal or none before this framework. National labs such as Fermilab hold sensitive data and valuable computing resources, making them attractive targets. Monitoring intrusion attempts on databases is made much easier by this comprehensive monitoring suite.

Clark, Dylan [Unlisted, IL]↗
DOE OSTI2026

Expandable Log Analyzing Framework

Prior to my internship, I was informed that a previous intern had built a tool to analyse MongoDB logs and look for invalid access attempts, which served as a great reference point for my project. I was initially tasked with expanding on her prototype and filling in the gaps such as integrating it with the main monitoring tool the lab uses. Eventually, the scope grew, expanding to support other databases and a growing collection of tools. I organized the framework around an observer pattern, meaning one point in the program sending updates to the rest of the framework. Every time a log was read and parsed, it was sent to be processed by the tools, using the type of event as a means to determine which tools should get a chance to act on the log. This decouples the tools from the log reader, making future updates and additions much easier. The framework processes MongoDB logs at ~135,000 entries per second and PostgreSQL logs at ~170,500 entries per second, accurately detecting anomalies such as slow queries and connections from unknown addresses. This framework serves to fill gaps in database monitoring tools currently implemented at the lab, such as tracking failed authentication for PostgreSQL and MongoDB which had very minimal or none before this framework. National labs such as Fermilab hold sensitive data and valuable computing resources, making them attractive targets. Monitoring intrusion attempts on databases is made much easier by this comprehensive monitoring suite.

Clark, Dylan [Unlisted, IL]↗
DOE OSTI2026

An mRNA vaccine encoding the Ebola virus glycoprotein induces high neutralizing antibody titers and provides strong protection against lethal infections in mouse models

Ebola virus (EBOV) is the causative agent of Ebola disease (EBOD), a viral hemorrhagic fever with a notably high case fatality rate. Current treatments for EBOD are limited to monoclonal antibodies or two licensed viral vector vaccines, a recombinant vesicular stomatitis virus (rVSV)-vectored vaccine or an adenovirus and modified vaccinia Ankara regimen. However, comparisons of protection, efficacy, and durability with alternative nucleotide platforms remain understudied. Here, we evaluated the immunogenicity of an mRNA vaccine expressing the EBOV glycoprotein (GP) in parallel with rVSV- and DNA-based vaccine platforms. The mRNA EBOV-GP vaccine, formulated in lipid nanoparticles, elicited significantly higher levels of total IgG and neutralizing antibody titers compared to the rVSV-EBOV-GP vaccine. Linear antibody epitope analysis indicated a preference for targeting the mucin-like domain in EBOV-GP1 following rVSV-based vaccination, while the mRNA platform distinctly targeted the internal fusion loop of EBOV-GP2. After characterizing the immunogenicity of the mRNA vaccine, two models of EBOD were used to demonstrate its protective efficacy: a surrogate rVSV-based challenge model of EBOD using type-I interferon deficient C57BL/6 mice and infection of BALB/c mice with authentic mouse-adapted EBOV. In both studies, the EBOV mRNA vaccine fully protected the mouse cohorts against morbidity and mortality. Additionally, the EBOV mRNA vaccine produced greater neutralizing antibody titers compared to the DNA EBOV-GP vaccine. These results suggest that an mRNA vaccine expressing EBOV-GP can induce robust, functional humoral responses that are protective against EBOD, warranting further development as an alternative to, or as part of a vaccine strategy including, viral vectored vaccines.

DNA vaccines↗