Search NASA⌕ Search

SEARCH · Search NASA

Results for “security verification”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 91 records · Page 5
All sourcesNASA NTRSDOE OSTI
DOE OSTI2019

Using Pulse Connect Secure © to Implement Multi-Factor Authentication Solutions

Pulse Connect Secure © (PCS) is a trusted platform for government agencies to provide secure access to web portals. As more and more accounts are being hacked and web sites are being compromised, single factor authentication with a username and password has become insufficient to adequately protect authenticated web portals. Multi-factor authentication (MFA), granting user access only when two or more independent pieces of information are presented, has become a necessary tool in the prevention of security breaches. This paper provides an overview of three MFA solutions that utilize the features of PCS. Categories include Personal Identity Verification (PIV) card authentication, service provider initiated (SP–initiated) Security Assertion Markup Language based (SAML–based) authentication, and identity provider initiated (IdP–initiated) SAML–based authentication.

97 MATHEMATICS AND COMPUTING↗
NASA NTRS2016

Verification of Triple Modular Redundancy Insertion for Reliable and Trusted Systems

If a system is required to be protected using triple modular redundancy (TMR), improper insertion can jeopardize the reliability and security of the system. Due to the complexity of the verification process and the complexity of digital designs, there are currently no available techniques that can provide complete and reliable confirmation of TMR insertion. We propose a method for TMR insertion verification that satisfies the process for reliable and trusted systems.

Verification↗
DOE OSTI2023

Detecting and characterizing special nuclear material for nuclear nonproliferation applications

Abstract There is an urgent need for new, better instrumentation and techniques for detecting and characterizing special nuclear material (SNM), i.e., highly enriched uranium and plutonium. The development of improved instruments and techniques requires experiments performed with the SNM itself, which is of limited availability. This paper describes the findings of experiments performed at the National Criticality Experiments Research Center conducted using new instruments and techniques on unclassified, kg-quantity SNM objects. These experiments, performed in the framework of the Department of Energy, National Nuclear Security Administration Consortium for Monitoring, Technology, and Verification, focused on detecting, characterizing, and localizing SNM samples with masses ranging from 3.3 to 13.8 kg, including plutonium and highly enriched uranium using prototype detectors and techniques. The work demonstrates SNM detection and characterization using recently-developed prototype detection systems. Specifically, we present new results in passive detection and imaging of plutonium and uranium objects using gamma-ray and dual particle (fast neutron and gamma-ray) imaging. We also present a new analysis of the delayed neutron emissions during active interrogation of uranium using a neutron generator.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2017

Akatosh: Automated Cyber Incident Verification and Impact Analysis

Akatosh, a U.S. Department of Homeland Security Transition to Practice Program (TTP) project developed by Oak Ridge National Laboratory with industry and academic partnership, enables automated, real-time forensic analysis of endpoints after malware-attacks and other cyber security incidents by automatically maintaining detailed snapshots of host-level activity on endpoints over time. It achieves this by integrating intrusion detection systems (IDS) with forensic tools. The combination allows Akatosh to collect vast amounts of endpoint data and assists in verifying, tracking, and analyzing endpoints in real time. This provides operations personnel and analysts as well as managers and executives with continuous feedback on the impact of malicious software and other security incidents on endpoints in their network.

Smith, Jared M.↗
DOE OSTI2017

NMIS/FNMIS Comparison for US DOE Office of Nuclear Verification

A comparison of the characteristics of the Nuclear Materials Identification System (NMIS) and its more fieldable version that was developed for future treaty applications, the Fieldable Nuclear Materials Identification System (FNMIS), is presented. Both systems were developed for the US Department of Energy (DOE) Office of Nuclear Verification (ONV). Under the Warhead Safety and Security Exchange Agreement, NMIS was also jointly developed with the Russian Federation. The configuration of the systems and their characteristics are described. In addition, the capabilities, advantages and disadvantages, and a comparison fast-neutron transmission imaging measurement is presented. The comparison measurements gave essentially the same results because the software and imaging apparatus have the same capabilities, with the FNMIS completing the measurements slightly faster. NMIS is an open system that is more easily modified for research applications and is not suitable for the ONV mission, and FNMIS is compatible with an information barrier, which is more useful for ONV applications.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
NASA NTRS1991

Integrity and security in an Ada runtime environment

A review is provided of the Formal Methods group discussions. It was stated that integrity is not a pure mathematical dual of security. The input data is part of the integrity domain. The group provided a roadmap for research. One item of the roadmap and the final position statement are closely related to the space shuttle and space station. The group's position is to use a safe subset of Ada. Examples of safe sets include the Army Secure Operating System and the Penelope Ada verification tool. It is recommended that a conservative attitude is required when writing Ada code for life and property critical systems.

Bown, Rodney L.↗
DOE OSTI2018

Muon-Computed Tomography using POCA Trajectory for Imaging Spent Nuclear Fuel in Dry Storage Casks

Cosmic ray muon-computed tomography (μCT) is a new imaging modality with unique characteristics that can be particularly important for applications in nuclear proliferation detection and international treaty verification. Using cosmic ray muons for nuclear security presents several potential advantages. Among others, muons are generated naturally in the atmosphere, can penetrate high-density materials, and are freely available. No radiological sources are required and consequently there is no associated radiological dose. Recently, the feasibility of using muons for imaging spent nuclear fuel stored in shielded casks has been explored and has been proved beneficial. However, challenges in μCT imaging include low muon flux of ~10,000 muons/m2/min, the effects of multiple Coulomb scattering (MCS) blurring the image, and inefficiency in being able to use all recorded muons for imaging. In this paper, we argue that the use of muon tracing should produce tomographic muon images with improved quality – or more quickly for the same image quality – compared to the case where conventional methods are used. In our paper, we report on the development and assessment of a novel muon tracing method for μCT. The proposed method back projects the muon’s scattering angle into each pixel crossed by its PoCA trajectory then forward projects the variance of the scattering angle in each pixel to detector bins along the muon’s incident horizontal direction. Two scenarios were simulated to assess the expected detection capability of this proposed method. GEANT4 was used to model the main characteristics of 1-60 GeV muons through matter. The simulated images showed an expected improvement in resolution and a reduced the reliance on the muon momentum information compared to a more conventional muon tomography method.

Liu, Zhengzhi↗
DOE OSTI2025

Orthogonality broadcasting and quantum position verification

The no-cloning theorem leads to information-theoretic security in various quantum cryptographic protocols. However, this security typically derives from a possibly weaker property that classical information encoded in certain quantum states cannot be broadcast. To formally capture this property, we introduce the study of ‘orthogonality broadcasting.’ When attempting to broadcast the orthogonality of two different qubit bases, we establish that the power of classical and quantum communication is equivalent. However, quantum communication is shown to be strictly more powerful for broadcasting orthogonality in higher dimensions. We then relate orthogonality broadcasting to quantum position verification and provide a new method for establishing error bounds in the no pre-shared entanglement model that can address protocols previous methods could not. Our key technical contribution is an uncertainty relation that uses the geometric relation of the states that undergo broadcasting rather than the non-commutative aspect of the final measurements.

quantum cryptography↗
NASA NTRS2016

Verification of Triple Modular Redundancy (TMR) Insertion for Reliable and Trusted Systems

We propose a method for TMR insertion verification that satisfies the process for reliable and trusted systems. If a system is expected to be protected using TMR, improper insertion can jeopardize the reliability and security of the system. Due to the complexity of the verification process, there are currently no available techniques that can provide complete and reliable confirmation of TMR insertion. This manuscript addresses the challenge of confirming that TMR has been inserted without corruption of functionality and with correct application of the expected TMR topology. The proposed verification method combines the usage of existing formal analysis tools with a novel search-detect-and-verify tool. Field programmable gate array (FPGA),Triple Modular Redundancy (TMR),Verification, Trust, Reliability,

Trust↗
DOE OSTI2015

Single-Volume Neutron Scatter Camera for High-Efficiency Neutron Imaging and Source Characterization. Year 2 of 3 Summary

The neutron scatter camera (NSC), an imaging spectrometer for fission energy neutrons, is an established and proven detector for nuclear security applications such as weak source detection of special nuclear material (SNM), arms control treaty verification, and emergency response. Relative to competing technologies such as coded aperture imaging, time-encoded imaging, neutron time projection chamber, and various thermal neutron imagers, the NSC provides excellent event-by-event directional information for signal/background discrimination, reasonable imaging resolution, and good energy resolution. Its primary drawback is very low detection efficiency due to the requirement for neutron elastic scatters in two detector cells. We will develop a singlevolume double-scatter neutron imager, in which both neutron scatters can occur in the same large active volume. If successful, the efficiency will be dramatically increased over the current NSC cell-based geometry. If the detection efficiency approaches that of e.g. coded aperture imaging, the other inherent advantages of double-scatter imaging would make it the most attractive fast neutron detector for a wide range of security applications.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
NASA NTRS2017

Cleared for Launch - Lessons Learned from the OSIRIS-REx System Requirements Verification Program

Requirements verification of a large flight system is a challenge. It is especially challenging for engineers taking on their first role in space systems engineering. This paper describes our approach to verification of the Origins, Spectral Interpretation, Resource Identification, Security-Regolith Explorer (OSIRIS-REx) system requirements. It also captures lessons learned along the way from developing systems engineers embroiled in this process. We begin with an overview of the mission and science objectives as well as the project requirements verification program strategy. A description of the requirements flow down is presented including our implementation for managing the thousands of program and element level requirements and associated verification data. We discuss both successes and methods to improve the managing of this data across multiple organizational interfaces. Our approach to verifying system requirements at multiple levels of assembly is presented using examples from our work at instrument, spacecraft, and ground segment levels. We include a discussion of system end-to-end testing limitations and their impacts to the verification program. Finally, we describe lessons learned that are applicable to all emerging space systems engineers using our unique perspectives across multiple organizations of a large NASA program.

Requirements Verification↗
DOE OSTI2023

CYVET: A Cyber-Physical Assurance Framework Based on a Semi-Supervised Vetting Approach

The project is designed to directly address the needs described in the Topic Area 4 (“Cybersecurity Verification and Validation”) of the CEDS’19 Research Call. The proposed CYVET system directly addresses the need to elevate the current industry capabilities to verify and validate OT cybersecurity and associated control system infrastructure. Currently, there is a significant gap in the energy sector’s capability in that regard during infrastructure improvement, equipment procurement, and compliance certification. CYVET provides that needed capability. CYVET is device and architecture agnostic and thus broadly applicable across the energy sector. The goal of this project is to develop and deliver a cybersecurity verification and validation framework testing capability to verify and validate OT equipment, software, and the underlying control system architecture. The primary project objectives are (i) Verification: the synthesis and reconciliation of standards and vendor supplied features, (ii) Validation: the generation, execution, and presentation of testing scripts of verified security features, and (3) Demonstration: apply the developed technology capabilities for verification and validation at a relevant end-user facility in the energy sector.

Lopez Jr, Juan↗
NASA NTRS2002

NAS Grid Benchmarks

We provide a paper-and-pencil specification of a benchmark suite for computational grids. It is based on the NAS (NASA Advanced Supercomputing) Parallel Benchmarks (NPB) and is called the NAS Grid Benchmarks (NGB). NGB problems are presented as data flow graphs encapsulating an instance of a slightly modified NPB task in each graph node, which communicates with other nodes by sending/receiving initialization data. Like NPB, NGB specifies several different classes (problem sizes). In this report we describe classes S, W, and A, and provide verification values for each. The implementor has the freedom to choose any language, grid environment, security model, fault tolerance/error correction mechanism, etc., as long as the resulting implementation passes the verification test and reports the turnaround time of the benchmark.

VanderWijngaart, Rob↗
DOE OSTI2017

Secure environment establishment for FPGA-based safety-critical systems: quality management system context - 159

The paper discusses importance of secure development and operational environment establishment process, its particular stages, including security-oriented analysis and assessment of safety-critical instrumentation and control (I and C) systems. Two particular aspects are covered - security assessment and security assurance related to processes established by Quality Management System (QMS). One of the underlying ideas for the security assessment approach is in performance of gap analysis. Such analysis considers influence of all different factors within I and C system development process, and further application of Intrusion Modes and Effect Criticality Analysis (IMECA) technique. It makes the approach applicable to various safety-critical systems, considering underlying technologies (for example, Field-Programmable Gate Arrays (FPGA). Nowadays FPGA technology is often used in wide spectrum of hardware devices - from personal devices to complex I and C systems for Nuclear Power Plants (NPPs). The problem of cyber security assessment and assurance for FPGA technology in general and its application in safety-critical I and C systems in particular is not completely solved due to several reasons that cover regulations, QMS processes, implementation of development and verification activities, etc. The paper overviews existing regulations, which cover various aspects of NPP I and C systems development and operation, FPGA technology implementation, and secure development and operational environment establishment and assurance. The paper also emphasizes that complex approach should be used to identify and mitigate all specific vulnerabilities thorough the whole life cycle on the basis on Intrusion Modes, Effect and Criticality Analysis technique. The paper also proposes approach to the development of safety-critical I and C systems in the scope of cyber security assurance process at developer site. Secure development environment is described as a key factor during the development process and the paper also discusses establishment and maintenance of such environment as a part of company's Nuclear Quality Assurance's QMS. (authors)

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2019

Authentication Protocol for ICS without Encryption

Industrial control systems (ICS) describes the different types of control systems and associated instrumentation, which includes the devices, systems, networks, and controls used to operate and/or automate industrial processes. Depending on the industry, each ICS functions differently and are built to electronically manage tasks efficiently. Historically, industrial plants have included networking, and changes have been made over time without consideration for security. Many ICS devices currently have inadequate security features. Adding encryption in ICS is undesirable because many of the new detection method involves deep packet inspection. Therefore, we propose to develop a method of providing authentication between devices without encrypting the data. This testbed design will allow rapid development and experimentation with Cyber Physical Systems. Modbus connects to a supervisory computer with a Remote Terminal Unit (RTU) in Supervisory Control and Data Acquisition (SCADA) systems. Our project seeks to enhance security in the ICS environment by adding device authentication to the lower levels of the plant floor. This approach was selected as it allows verification of the sender of data from level 1/level 0 devices up to supervisory systems. This addition is desirable as it adds enhanced verification to the integrity of system data without obscuring (via encryption) the data being transmitted across the network. This is important because many ICS systems are real time critical (decryption adds to latency) and many other good security options require deep packet inspection (which encryption completely defeats). To accomplish this, a proof of concept of adding an authentication scheme was designed and will be tested with a common ICS protocol. The setup includes a single serial cable connecting the serial ports on two devices, a Master and a Minion. Authentication will occur in the following methods: - Data layer involving Transport Layer Security/Secure Socket Layer (TLS/SSL); - TCP/IP route implementation; - Key exchange algorithm; - Raspberry Pi programming for authentication. A portion of the setup includes adding Raspberry Pi into the system as the device is handling the authentication for the network traffic. Modbus is the chosen ICS protocol. It is used to transmit signals from instrumentation and control devices back to a main controller or data gathering system. Typically, the device identity is assumed but not verified. For verifying device identity, we constructed a digital signature architecture with TLS. A novel adaptation of this is to use only the digital signature that is provided and not the encryption capability. This allows ICS traffic to flow unobscured while still providing verification for the integrity of the data. Verification of this process will involve adding additional I/O level network devices with spoofed IP addresses and detecting the authenticated versus unauthenticated traffic. Our TLS implementation will have encryption disabled but should still allow for digital signing of data. This will enable our system to distinguish between real end devices and spoofed end devices. This experiment is presently building the test setup. It is focusing on a small setting to identify authenticated and unauthenticated devices on the network. This should allow for scaling to a larger network size after the initial proof of concept. One concern with this scheme is a certificate deployment has a large scale key management. Network size will thus increase the key management task for security. In addition, we believe that further research should be done on exploring the use of this method to defeat man-in-the-middle attacks.

42 ENGINEERING↗
DOE OSTI2020

Feasibility of Realizing a Universal Identifier Based on Fiber Bragg Grating Technology

Over the past year we have collected data on different fiber Bragg gratings (FBG) with the end goal of understanding their suitability for use in a new type of unique identifier (UID) that could be used in both tags and seals for high-value, high-risk assets. The ideal UID will have a complex signature that allows items to be uniquely identified by that signature. Tamper indication must be an integral part of the tag/seal process with measurable changes to the device signature indicative of any attempt to tamper with the monitored item. Further, the signature must be so difficult to reproduce that even state-actors with significant resources at their disposal will be discouraged from attempting it. Finally, readout verification of the product must be simple and secure, while providing red-light/green-light results in real time. To evaluate how well an FBG-based UID could meet these goals, we collected data on a large number of FBG samples from different vendors. Measurements included the response of the devices to uniform tension, tension when wrapped on a mandrel, and the response to changes in temperature and humidity, as well as the effect of simple potting in expanding and nonexpanding potting materials. We tested FBG samples written into single-mode fibers that were coated with the two commonly used materials, polyimide and acrylate and gratings that were both uniform and those with an apodized response (i.e., the intensity of the grating was varied to minimize sidelobes). The result of the work to date did not find any significant issues with the design concept for a UID based on this technology. Specific findings include a baseline design comprising five FBGs with distinct spectral returns analyzed using a difference-correlation approach. To realize this device, careful attention must be given to the impact of environmental factors on the UID response, limiting the properties of the potting compounds and FBG coating materials that can be used.

71 CLASSICAL AND QUANTUM MECHANICS, GENERAL PHYSIC↗
DOE OSTI2024

Formally Verified ZTA Requirements for OT/ICS Environments with Isabelle/HOL

The clean energy transformation includes the integration of distributed energy resources with the power grid, which has led to a substantial increase in the complexity of power grids infrastructure and the underlying operational technology environment. Power grids infrastructure represents an operational technology environment that has become a system of systems, integrating heterogeneous devices which are both software-and hardware-intensive; as a result, there are increasing demands to exploit advances in the commodity of software-hardware infrastructures to improve energy systems requirements such as cybersecurity and resilience. In such a setting, system requirements at different levels mix, which leads to vulnerabilities and undesirable outcomes. The use of formal methods to characterize and prove system requirements removes ambiguity, increases automation, and provides high levels of assurance and reliability. In this paper, we contribute a methodology and a framework for the system-level verification of zero trust architecture requirements in operational technology environments. We define a formal specification for the core functionalities of operational technology environments, the corresponding invariants, and security proofs. Of particular note is our modular approach for the formal verification of asynchronous interactions in operational technology environments. The formal specification and the proofs have been mechanized using the interactive theorem proving environment Isabelle/HOL.

formal methods↗