SEARCH · Search NASA
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
The general technical goals of the project were to better understand the assumptions of security guarantees using secure commercial off-the-shelf (COTS) technologies, to identify possible security weaknesses introduced during system integration, and to create improved security hardware and software which result in well understood reference architectures for critical computing systems and applications.
Bugs in digital logic have led to some significant security vulnerabilities. Hardware bugs are particularly troublesome since they cannot be easily patched. Additionally, if the bug is in the root of trust, all trust built upon it can be vulnerable. Traditional testing either require a deep knowledge of the system, creative attack vectors and lots of human interaction. This is not scalable as there are very few engineers that can wear the hat of a designer, a verification engineer, and a cybersecurity expert. Hardware fuzzing is a relatively new research area in dynamic hardware testing. It has proven to be an effective method for discovering bugs, unexpected behaviors, and security vulnerabilities in software. While hardware fuzzing is new to the hardware domain, it has a strong track record in software testing. Fuzzing is a testing technique that randomly mutates the input data to uncover bugs or vulnerabilities in the design. It is especially good at finding corner cases that test engineers can not envision. Another advantage over other dynamic testing techniques is that, if done well, deep knowledge of the design is not required. Additionally, fuzzing scales well. If the system is set up correctly, it can run unsupervised for weeks if necessary. In this work, we propose using hardware fuzzing to improve the input vector generation for an information flow tracking tool. To get reasonable throughput of test vectors, an emulator is targeted as the execution platform. Efficient emulator execution has some specific requirements.
This report examines the software supply chain security posture of mobile applications developed for consumer whole-house battery and energy-management products. While these applications are not currently integrated with critical infrastructure, their growing role in connected energy domain spaces underscores the importance of understanding the external dependencies, permission structures, and runtime behaviors that could introduce systemic risk; particularly, if adoption expands into more critical environments.
Software vulnerabilities are flaws in computer systems that leave users open to attack. In many cases, these vulnerabilities go unnoticed and remain unresolved in codebases. Thus, awareness of software vulnerabilities among the public is crucial to ensure effective cybersecurity practices, the development of high quality software, and ultimately national security. This awareness can be better understood by studying the spread and evolution of software vulnerability discussions in online communities. This work is the first to evaluate and contrast how discussions about software vulnerabilities spread on three social platforms -- Twitter, GitHub, and Reddit. To lay the groundwork, we showcase a novel fundamental framework for measuring information spread that identifies the spread mechanisms and observables across platforms, the units of information, and the groups of measurements that can be applied to focus on a specific phenomena e.g., information cascades. We then analyze and contrast social network topologies for three example social networks and measure the scale and speed of the spread of discussion of specific vulnerabilities to understand how far and how widely they spread, how many users participate in discussions, and the duration of their spread. To demonstrate the awareness of more impactful software vulnerabilities, a subset of our analysis focuses on vulnerabilities targeted during recent major cyber attacks as well as vulnerabilities exploited by advanced persistent threat groups. We discover that usually, vulnerability discussions start on GitHub, before occurring on Twitter and Reddit. While studying how some user-level and content-level characteristics influence vulnerability spread, we observe that Twitter discussions started by users predicted to be humans have larger size, breadth, depth, adoption rate, lifetime, and structural virality compared to those started by users predicted to be bots. On Reddit, we contrast the differences in thread structure that originate from posts with positive, negative and neutral polarity. We find that posts that are positive have larger, deeper and wider discussions compared to negative and neutral posts. We anticipate the results of our analysis to not only increase the understanding of software vulnerability awareness but also inform models for simulating information spread across multiple social environments online.
This artifact is an intern project poster. The subject matter is modeling spread spectrum digital communications in electronic warfare modeling and simulation software produced by National and Homeland Security. It contains images of communications coverage analysis from the software, link budget terms, and image depicting the Wireless Spectrum Communications (WSComm) underlay control channel (UCC), and an image of a filter bank multicarrier spread spectrum (FBMCSS) signal. INL National and Homeland Security Electronic Warfare Modeling and Simulation software (EWMSS) is capable of modeling several digital and analog signal types, but it does not currently support spread spectrum techniques such as filter bank multicarrier spread spectrum (FBMCSS). FBMCSS modeling requires "processing gain," which is not present in EWMSS' link budget. Wireless Spectrum Communications (WSComm) Underlay Control Channel (UCC), a product of INL, employs FBMCSS and is modeled in EWMSS for this project. This research shows that by manually accounting for FBMCSS processing gain, EWMSS calculates a link margin that is within 0.023 dB of a link margin in an existing WSComm link budget. These link margins were based on free space path loss, an ideal propagation model. EWMSS has the capability to include terrain and other sophisticated propagation models in its calculations, giving it the potential to provide realistic, location-specific models of WSComm UCC if processing gain is accounted for.
The project involved exploring implications of genomic software vulnerabilities under realistic security assumptions and standard best practices for genomic variant detection. BWA is the first piece of software in the best-practices pipeline.
Most nuclear security systems used today were not designed for today’s threat environment. Systems that were intended to be stand alone are now interconnected. Devices that have a single purpose are built on multi-purpose platforms and communication protocols that, while effective, have no ability to authenticate authorized versus unauthorized commands. These attributes provide an attacker significant ability to affect the system, pivot throughout the interconnected networks, and remain undetected if he/she is able to compromise a single node. Software defined networking (SDN) has been used for years by information technology (IT) cloud service providers to quickly provision or remove servers or other systems to meet changing demand. The same concept has recently been applied to operational technology (OT) systems to enable very fast failover on critical systems that have stringent and deterministic (<5ms) transmit/receive times. By carefully engineering the communication flows through a network using preplanned routes and specific pathways it is possible to achieve deterministic and extremely reliable message delivery even when components fail. This engineering approach to network design has added security benefits including securing the networking control plane, eliminating network scanning and mapping, inhibiting ARP spoofing and host masquerading, eliminating unauthorized network pivoting and enabling greater situational awareness on the network. SDN in OT environments is new but early testing in electrical power and other critical infrastructure has shown it to be a very powerful tool for building reliable networks and reducing the digital attack surface of the network. The authors tested a software defined network switch on a simple physical protection system with components commonly found in nuclear security systems and found improved mitigations to denial of service attacks, lateral movement and network reconnaissance. The paper details the tests and their results.
Digital Instrumentation and control (I and C) system serves as the 'senses and nervous system' of a nuclear power plant (NPP). It plays an important role in the safe and economic operation in the NPPs. Digital I and C system has a series of advantages compared with analogue ones, but the introduction of the operation system platform, the application software, and the network communication structure are causing security risk to the power plant. Different kinds of procedures have already been adopted against these risks such as the communication isolation, but the security attacks still occur from time to time in the industrial fields around the world. This paper presents two computer security methods based on the thought of software verification and validation with step-by-step operation identification. First, three scenarios of security attack are proposed according to the structure of a distributed control system (DCS). Then a method with two network bypasses and a security computer are adopted to obtain the operation commands, the actuation signal, and the operation feedback in case of the first two scenarios by identifying the consistency of the obtained data. Furthermore, the method is optimized by combining the operation procedure and the camera shot to identify the anomaly of the information flow, thus to improve the effectiveness against the computer security issues. In the end, the influence and feasibility of this method is discussed. (authors)
Federal agencies are made responsible for managing the historic properties under their jurisdiction by the National Historic Preservation Act of 1966, as amended. A component of this responsibility is to mitigate the effect of a federal undertaking on historic properties through mitigation often through documentation. Providing public access to this documentation has always been a challenge. To address the issue of public access to mitigation information, personnel from Argonne National Laboratory created the Box Digital Display Platform, a system for communicating information about historic properties to the public. The platform, developed for the US Army Dugway Proving Ground, uses short introductory videos to present a topic but can also incorporate photos, drawings, GIS information, and documents. The system operates from a small, self-contained computer that can be attached to any digital monitor via an HDMI cable. The system relies on web-based software that allows the information to be republished as a touch-screen device application or as a website. The system does not connect to the Internet, and this increases security and eliminates the software maintenance fees associated with websites. The platform is designed to incorporate the products of past documentation to make this information more accessible to the public; specifically those documentations developed using the Historic American Building Survey/ Historic American Engineering Record (HABS/HAER) standards. Argonne National Laboratory’s Box Digital Display Platform can assist federal agencies in complying with the requirements of the National Historic Preservation Act. Environmental Practice 18: 209–213 (2016)
Boeing and its partner, PJM Interconnection, teamed to bring advanced “defense-grade” technologies for cyber security to the US regional power grid through demonstration in PJM’s energy management environment. Under this cooperative project with the Department of Energy, Boeing and PJM have developed and demonstrated a host of technologies specifically tailored to the needs of PJM and the electric sector as a whole. The team has demonstrated to the energy industry a combination of processes, techniques and technologies that have been successfully implemented in the commercial, defense, and intelligence communities to identify, mitigate and continuously monitor the cyber security of critical systems. Guided by the results of a Cyber Security Risk-Based Assessment completed in Phase I, the Boeing-PJM team has completed multiple iterations through the Phase II Development and Phase III Deployment phases. Multiple cyber security solutions have been completed across a variety of controls including: Application Security, Enhanced Malware Detection, Security Incident and Event Management (SIEM) Optimization, Continuous Vulnerability Monitoring, SCADA Monitoring/Intrusion Detection, Operational Resiliency, Cyber Range simulations and hands on cyber security personnel training. All of the developed and demonstrated solutions are suitable for replication across the electric sector and/or the energy sector as a whole. Benefits identified include; Improved malware and intrusion detection capability on critical SCADA networks including behavioral-based alerts resulting in improved zero-day threat protection; Improved Security Incident and Event Management system resulting in better threat visibility, thus increasing the likelihood of detecting a serious event; Improved malware detection and zero-day threat response capability; Improved ability to systematically evaluate and secure in house and vendor sourced software applications; Improved ability to continuously monitor and maintain secure configuration of network devices resulting in reduced vulnerabilities for potential exploitation; Improved overall cyber security situational awareness through the integration of multiple discrete security technologies into a single cyber security reporting console; Improved ability to maintain the resiliency of critical systems in the face of a targeted cyber attack of other significant event; Improved ability to model complex networks for penetration testing and advanced training of cyber security personnel
Rapidly expanding, new telecommunications infrastructure based on 5G technologies will disrupt and transform how we design, build, operate, and optimize scientific infrastructure and the experiments and services enabled by that infrastructure, from continental-scale sensor networks to centralized scientific user facilities, from intelligent Internet of Things devices to supercomputers. Concurrently, 5G will introduce, or exacerbate, challenges related to protecting infrastructure and associated scientific data as well as to fully leveraging opportunities related to expanded infrastructure scale and complexity. The U.S. Department of Energy (DOE) Office of Science operates scientific infrastructure, supporting some of the nation’s most advanced intellectual discoveries, spanning the country and including 30 world-class user facilities from supercomputers to accelerators. Along with field experiments and remote observatories, every aspect of DOE’s scientific enterprise will be affected by 5G, which amounts to a complete renovation of the underpinnings of the nation’s information infrastructure. In this report we explore the scientific opportunities and new research challenges associated with 5G, ranging from scalability to heterogeneity to cybersecurity. The rapid commercial deployment of 5G opens the opportunity to rethink and reinvent DOE’s scientific infrastructure and experimentation, from intelligent sensor networks at unprecedented scales to a digital continuum of cyberinfrastructure spanning low-power sensors, high-performance computing embedded within and at the edge of the network, and DOE’s large-scale user instrument and computing facilities. New programming paradigms, workflow and data frameworks, and AI-based system design, operation, and autonomous adaptation and optimization will be necessary in order to exploit these new opportunities. Field deployments and centralized scientific instruments can also be revolutionized, moving (without traditional performance penalties) from wired to wireless connectivity for data and control systems, improving flexibility, and opening new sensing modalities, including the use of the 5G electromagnetic spectrum itself as an environmental probe. For DOE science, in contrast to commercial 5G applications and settings, devices will be deployed in extreme environments such as cryogenically cooled instrument control systems and in remote settings with harsh conditions, requiring the design of new materials for RF communication and edge processing to operate in these regimes. Concurrently, 5G infrastructure comprises both hardware and sophisticated software systems - currently closed and proprietary. The cybersecurity challenges to 5G-empowered reinvention mirror the complexity and variety of new 5G features, from virtualization to private network slices to ubiquitous access. Research is also needed in order to accelerate the development of secure and open 5G software infrastructure, reducing reliance on hardware and software produced outside the United States and providing the transparency and rigorous evaluation and testing afforded through open software. Twelve broad research thrusts are laid out in four chapters, with a companion fifth chapter (and three additional research thrusts) underscoring the needs and opportunities for an aggressive testbed program co-designed by networking experts and scientists involved in the 15 research thrusts. The urgency of undertaking this research is fueled by a global, accelerating deployment of new telecommunications infrastructure that is designed for entertainment and commercial applications - barely scratching the surface of what 5G can do to extend U.S. leadership in scientific discovery.
The Exascale Computing Project (ECP) software deployment effort developed and advanced DevOps capabilities. One goal was to enable robust continuous integration (CI) workflows that span the protected high performance computing (HPC) environments found within many of the Department of Energy’s (DOE) national laboratories. This article highlights several challenges encountered with enabling automation, such as charging models for CI jobs, and meeting individualized security requirements that revolve around strongly associating running code with a human identity. Here, it also describes how the Jacamar CI tool evolved to meet latter requirements and became a key aspect of the solutions currently offered. Derived from this experience, we offer a conceptual framework for understanding current and future CI challenges at DOE facilities and offer suggestions for long-term solutions.
In this work, dynamic analysis techniques help programmers find the root cause of bugs in large-scale parallel applications.
Risk Informed Timelines (RIT) is a more modern and holistic method for understanding how access delay timelines are developed and utilized in physical security system evaluations. The software utilizes Bayesian methods to combine subject matter expert judgement and small performance test datasets in a consistent and defensible way. It allows a more holistic view of delay performance that provides distributions of task times and task success probabilities to account for tasks that, if failed, would result in failure of the attack. The RIT methodology is meant to enable security risk managers to begin the transition into more comprehensive delay timeline analysis. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525. SAND2021-8294 O
The war to establish cyber supremacy continues, and the literature is crowded with strictly technical cyber security measures. We present the results of a three year LDRD project using Linkography, a methodology new to the field of cyber security, we establish the foundation necessary to track and profile the microbehavior of humans attacking cyber systems. We also propose ways to leverage this understanding to influence and deceive these attackers. We studied the science of linkography, applied it to the cyber security domain, implemented a software package to manage linkographs, generated the preprocessing blocks necessary to ingest raw data, produced machine learning models, created ontology refinement algorithms and prototyped a web application for researchers and practitioners to apply linkography. Machine learning produced some of our key results: We trained and validated multinomial classifiers with a real world data set and predicted the attacker's next category of action with 86 to 98% accuracy; dimension reduction techniques indicated that the linkography-based features were among the most powerful. We also discovered ontology refinement algorithms that advanced the state of the art in linkography in general and cyber security in particular. We conclude that linkography is a viable tool for cyber security; we look forward to expanding our work to other data sources and using our prediction results to enable adversary deception techniques.
U.S. Department of Energy (DOE) sites have accumulated years of data and millions of spatial and temporal records related to the hydrological cycle, contaminant transport, and parameters of remediation technologies. In addition, numerical models which use field monitoring data to help understand flow and transport produce gigabytes of computed spatial and temporal data for each computation node. There is a need therefore for an advanced spatial data structure that can be used to address the management, processing, and analysis of spatial and temporal numerical modeling data derived from multiple sources. This can be accomplished using a geo-database. The development of an ArcSDE geo-database facilitates the centralized storage, backup, accessibility, organization, and management of model configuration and computed simulation data, putting it into a structured, coherent, and logical computer-supported system. GIS data processing and automation would enable faster and hence more complex analyses of field test data. The Applied Research Center (ARC) at Florida International University (FIU) has provided analysis of flow and transport for several watersheds at DOE's Oak Ridge Reservation (ORR), including East Fork Poplar Creek (EFPC), Upper EFPC in the Y-12 National Security Complex area (Y-12 NSC) and White Oak Creek (WOC). Integrated surface and subsurface flow, fate and transport models were developed to provide analysis of contaminant patterns within each watershed. In addition, digital monitoring data available from the Oak Ridge Environmental Information System (OREIS) related to mercury (Hg) contamination and remediation within these watersheds was used for calibration and verification of the model. Experimental studies were also carried out which provided kinetic and equilibrium data about important parameters related to Hg transport, speciation and methylation/demethylation kinetics within the watershed. Geographic Information Systems (GIS) technology was employed to support the modeling work through storage and geo-processing of spatial and temporal data required by the models and to produce hydrogeological maps for visualization. An ArcGIS geo-database was developed for centralized storage and management of experimental and computed model data and its capabilities were extended over the years using tools such as ModelBuilder combined with Python scripting to automate repetitive tasks, perform statistical analyses and generate maps and reports. The hydrologic geo-database model developed possesses a structure that enables linkage with scalable hydrologic modeling tools/applications to model hydrologic systems, and in this case, enables the testing of the potential impacts of various remediation scenarios on the ORR watersheds. The ArcSDE geo-database can also be used to automate and simplify the process of calling stored GIS and time series data. This geo-database can serve as a tool for contaminant flow and transport analyses which require large amounts of high-quality spatial and temporal data in order to ensure reliability and validity of modeling results. The existing geo-database structure developed for the hydrological modeling at ORR was designed to be replicable for application at other DOE sites. An investigation of downloadable free/open source GIS software along with required security protocols to facilitate online querying of the database was also conducted to determine methods by which project-derived data can be more easily shared with other project stakeholders such as DOE personnel and site contractors. (authors)
Dual-energy X-ray absorptiometry (DXA) is the most frequently performed examination to assess bone mineral density in clinical practice. Aside from images and graphical displays, many numerical values are part of DXA reports. These values are typically manually entered into the formal report through the electronic medical record or PACS workstation. The process takes time and is prone to errors. Exporting the DXA numerical data via HL7 engine to the electronic medical record was proposed to improve reporting efficiency and accuracy. The output from the DXA unit computer was reconfigured to export the report content via the HL7 interface engine into the electronic medical record. Radiology interpretive reporting was subsequently done directly in the electronic medical record. In the evaluation of errors, 100 preliminary DXA reports before the change and 100 after the change were examined. These reports were analyzed for errors that included decimal change, number transposition, negative number issue, other incorrect number error, and failure to include prior exam for comparison. In addition, report turnaround times were evaluated before and after the changes were made. Reporting time evaluations included 1-year volume prior to change (3915 reports) and 1 month post-change (206 reports). Of 100 DEXA exams before the change, 15 final reports contained 25 numerical errors. After the change, no numerical errors in the reports were identified. Exam end to final report time decreased from 2159 to 625 min on average. Automating data transmittal from the DXA modality for report generation improves accuracy and turnaround time. This approach did not require any third party software, and healthcare information security concerns were negated since we are using our standard workstations. Secondary to the affordability and applicability to the large percentage of the population using electronic medical record systems, this type of automated workflow is recommended.
This paper summarizes the three-year technical activities of the IEEE Task Force (TF) on behind-the-meter (BTM) distributed energy resources (DERs): estimation, uncertainty quantification, and control. The potential grid services from BTM DERs are discussed in detail. The paper also reviews the state-of-the-art for BTM DERs visibility, uncertainty quantification, and, optimization and control. Furthermore, different aspects of the market structures associated with BTM DERs are covered, including emerging market and business models. Finally, needs and recommendations are provided for additional areas such as system protection, computing capabilities, algorithm development, market structure design, cyberinfrastructure and security, and hardware and software developments.