Search NASA⌕ Search

SEARCH · Search NASA

Results for “cryptographic”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 127 records · Page 7
All sourcesNASA NTRSDOE OSTI
DOE OSTI2020

Module-OT: A Hardware Security Module for Operational Technology

Increased penetration levels of renewable energy and other types of distributed energy resources (DERs) on the modern electric grid-combined with technological advancements for electric system monitoring and control-introduce new cyberattack vectors and increase the cyberattack surface of energy systems. According to the IEEE Std. 1547-2018, DERs must use Modbus, Distributed Network Protocol 3 (DNP3), or Smart Energy Profile 2.0 (SEP2) as their communication protocol. Previous research identified several vulnerabilities and security breaches in each one of these communication protocols; despite this, existing standards for DERs do not recommend cybersecurity measures. In order to reduce vulnerabilities in power distribution systems, this paper presents a novel open-source hardware security module that improves both information and operational security to better protect data and communications on the distribution grid. The security hardware is called “module for operational technology,” or simply Module-OT, and it has been validated and tested in an emulated distribution system application. Module-OT is integrated within a communication system in the transport layer of the Open Systems Interconnection (OSI) model. It improves system security through encryption, authentication, authorization, certificate management, and user access control. The main advancement of Module-OT is the addition of hardware cryptographic acceleration that improves the overall communication performance in terms of end-to-end latency.

70 PLASMA PHYSICS AND FUSION TECHNOLOGY↗
DOE OSTI2021

Implementation of quantum key distribution and quantum clock synchronization via time bin encoding

Quantum key distribution allows for a provably secure transmission of cryptographic keys over an optical channel. Encoded polarization states or time-bin degree of freedom have been used for successful demonstrations. However, photon losses in long fibers, slow single photon detectors, and detector dark counts significantly limit the overall bit rate. Improving key throughput and reducing the overhead of key reconciliation remain as major challenges. Methods which utilize multiple time bins allow for multiple key bits to be encoded in a single photon, thus increasing the fidelity of transmitted keys and decreasing the overhead of key reconciliation in real-world conditions. Previous implementations of these methods required that Alice and Bob share a time reference by sharing a dedicated classical channel used for synchronization. This work presents a technique that allows two parties to exchange time-bin encoded photons without the need for synchronized time references. Our technique uses a framing protocol which allows Alice to encode a time reference along with a key which is determined by Alice before transmission. Security can be achieved by monitoring the visibility of a pair of Franson interferometers, using decoy pulses and measuring the round trip time between Alice and Bob. The bit rate of this technique is limited only by the recovery time of the detector and the speed of the modulation electronics. We experimentally demonstrate a raw bit rate of 5Mb/s over an optical channel with 55dB of loss, which is competitive with current research. We also demonstrate absolute timing synchronization with an accuracy of 20ps.

encryption↗
DOE OSTI2017

Provably secure and high-rate quantum key distribution with time-bin qudits

The security of conventional cryptography systems is threatened in the forthcoming era of quantum computers. Quantum key distribution (QKD) features fundamentally proven security and offers a promising option for quantum-proof cryptography solution. Although prototype QKD systems over optical fiber have been demonstrated over the years, the key generation rates remain several orders of magnitude lower than current classical communication systems. In an effort toward a commercially viable QKD system with improved key generation rates, we developed a discrete-variable QKD system based on time-bin quantum photonic states that can generate provably secure cryptographic keys at megabit-per-second rates over metropolitan distances. We use high-dimensional quantum states that transmit more than one secret bit per received photon, alleviating detector saturation effects in the superconducting nanowire single-photon detectors used in our system that feature very high detection efficiency (of more than 70%) and low timing jitter (of less than 40 ps). Our system is constructed using commercial off-the-shelf components, and the adopted protocol can be readily extended to free-space quantum channels. In conclusion, the security analysis adopted to distill the keys ensures that the demonstrated protocol is robust against coherent attacks, finite-size effects, and a broad class of experimental imperfections identified in our system.

71 CLASSICAL AND QUANTUM MECHANICS, GENERAL PHYSIC↗
DOE OSTI2017

Distinguishability of quantum states and shannon complexity in quantum cryptography

The proof of the security of quantum key distribution is a rather complex problem. Security is defined in terms different from the requirements imposed on keys in classical cryptography. In quantum cryptography, the security of keys is expressed in terms of the closeness of the quantum state of an eavesdropper after key distribution to an ideal quantum state that is uncorrelated to the key of legitimate users. A metric of closeness between two quantum states is given by the trace metric. In classical cryptography, the security of keys is understood in terms of, say, the complexity of key search in the presence of side information. In quantum cryptography, side information for the eavesdropper is given by the whole volume of information on keys obtained from both quantum and classical channels. The fact that the mathematical apparatuses used in the proof of key security in classical and quantum cryptography are essentially different leads to misunderstanding and emotional discussions [1]. Therefore, one should be able to answer the question of how different cryptographic robustness criteria are related to each other. In the present study, it is shown that there is a direct relationship between the security criterion in quantum cryptography, which is based on the trace distance determining the distinguishability of quantum states, and the criterion in classical cryptography, which uses guesswork on the determination of a key in the presence of side information.

71 CLASSICAL AND QUANTUM MECHANICS, GENERAL PHYSIC↗
DOE OSTI2019

Decoy States and Low-Density Parity-Check Error-Correcting Codes in Quantum Cryptography with Phase–Time Coding

The cryptographic robustness of quantum key distribution (QKD) with phase–time coding against a photon number splitting (PNS) attack is analyzed. The line length up to which a secret key distribution is guaranteed is determined both by the protocol itself and by the efficiency of error correction in raw keys. The effect of different parameters of avalanche single-photon detectors on the length of the secret key distribution line is investigated. To correct errors, various versions of low-density parity-check (LDPC) codes are considered whose efficiency today is the closest to the Shannon theoretical limit.

71 CLASSICAL AND QUANTUM MECHANICS, GENERAL PHYSIC↗
DOE OSTI2014

Conductance matrix of multiterminal semiconductor devices with edge channels

A method for determining the conductance matrix of multiterminal semiconductor structures with edge channels is proposed. The method is based on the solution of a system of linear algebraic equations based on Kirchhoff equations, made up of potential differences U{sub ij} measured at stabilized currents I{sub kl}, where i, j, k, l are terminal numbers. The matrix obtained by solving the system of equations completely describes the structure under study, reflecting its configuration and homogeneity. This method can find wide application when using the known Landauer-Buttiker formalism to analyze carrier transport in the quantum Hall effect and quantum spin Hall effect modes. Within the proposed method, the contribution of the contact area resistances R{sub c} to the formation of conductance matrix elements is taken into account. The possibilities of practical application of the results obtained in developing analog cryptographic devices are considered.

36 MATERIALS SCIENCE↗
DOE OSTI2017

PKPass

Password management solutions exist, but few are designed for enterprise systems administrators sharing oncall rotations. Due to the Multi-Factor Level of Assurance 4 effort, DOE is now distributing PIV cards with cryptographically signed certificate and private key pairs to administrators and other security-significant users. We utilize this public key infrastructure (PKI) to encrypt passwords for other recipients in a secure way. This is cross platform (works on OSX and Linux systems), and has already been adopted internally by the NCCS systems administration staff to replace their old password book system.

Adamson, RyanM.↗
DOE OSTI2025

Fully Homomorphic Encryption

This code implements a Fully Homomorphic Encryption (FHE) system, enabling secure computation on encrypted data without requiring decryption. It supports encryption, decryption, and homomorphic operations like matrix multiplication and addition. This code is adaptable for integrating FHE into linear-time invariant (LTI) systems, including digital control and filtering. With proper configuration from subject matter expertise, encrypted system parameters and signals can be manipulated to perform tasks like state updates, output calculations, and convolution in the encrypted domain. By preserving the structure of LTI systems while ensuring privacy, the framework facilitates secure applications in areas such as autonomous systems, signal processing, and industrial automation. The code initializes the encryption system using parameters provided in the env dictionary. These parameters include the ciphertext modulus, key dimension, plaintext fixed-point scaling factor, and noise bound. During initialization, a secret key is generated, which is essential for encrypting and decrypting data securely. The modular design allows users to tailor these parameters to specific use cases or security requirements. The code implements multiple cryptographic schemes. The learning with errors (LWE) encryption method encodes cleartext message to their plaintext fixed-point representation then encrypted into ciphertext space with additive noise. This noise ensures the security of the scheme, relying on the computational hardness of the LWE problem. The code also includes the Gentry-Sahai-Waters (GSW) scheme based off the LWE problem. Homomorphic matrix multiplication is performed between the LWE and GSW to encrypted data. This is achieved using a decomposition function on the LWE ciphertext during the multiplication operation. For higher-dimensional data, the code includes a method to encrypt entire matrices (GSWMat) using GSW encryption. These encrypted matrices can then be used for homomorphic matrix multiplications (MatMult). The decryption function uses the secret key to recover the original plaintext, removing the added noise and scaling that was originally applied during encryption.

Lois, Roberts [Idaho National Laboratory (INL), Id↗
DOE OSTI2023

Hashes are not suitable to verify fixity of the public archived web

Web archives, such as the Internet Archive, preserve the web and allow access to prior states of web pages. We implicitly trust their versions of archived pages, but as their role moves from preserving curios of the past to facilitating present day adjudication, we are concerned with verifying the fixity of archived web pages, or mementos, to ensure they have always remained unaltered. A widely used technique in digital preservation to verify the fixity of an archived resource is to periodically compute a cryptographic hash value on a resource and then compare it with a previous hash value. If the hash values generated on the same resource are identical, then the fixity of the resource is verified. We tested this process by conducting a study on 16,627 mementos from 17 public web archives. We replayed and downloaded the mementos 39 times using a headless browser over a period of 442 days and generated a hash for each memento after each download, resulting in 39 hashes per memento. The hash is calculated by including not only the content of the base HTML of a memento but also all embedded resources, such as images and style sheets. We expected to always observe the same hash for a memento regardless of the number of downloads. However, our results indicate that 88.45% of mementos produce more than one unique hash value, and about 16% (or one in six) of those mementos always produce different hash values. We identify and quantify the types of changes that cause the same memento to produce different hashes. These results point to the need for defining an archive-aware hashing function, as conventional hashing functions are not suitable for replayed archived web pages.

96 KNOWLEDGE MANAGEMENT AND PRESERVATION↗
DOE OSTI2026

SEGUID v2: Extending SEGUID checksums for circular, linear, single- and double-stranded biological sequences

Background Synthetic biology involves combining different DNA fragments, each containing functional biological parts, to address specific problems. Fundamental gene-function research often requires cloning and propagating DNA fragments, such as those from the iGEM Parts Registry or Addgene, typically distributed as circular plasmids. Addgene’s repository alone offers around 150,000 plasmids. To ensure data integrity, cryptographic checksums can be calculated for the sequences. Each sequence has a unique checksum, making checksums useful for validation and quick lookups of associated annotations. For example, the SEGUID checksum uniquely identifies protein sequences with a 27-character string. Objectives The original SEGUID, while effective for protein sequences and single-stranded DNA (ssDNA), is not suitable for circular DNA since there is no natural starting position nor for double-stranded DNA (dsDNA) since two separate sequences are present. Challenges include how to uniquely represent linear dsDNA, circular ssDNA, and circular dsDNA. To meet these needs, we propose SEGUID v2, which extends the original SEGUID to handle additional types of sequences. Conclusions SEGUID v2 produces orientation and rotation invariant checksums for single-stranded, double-stranded, possibly staggered, linear, and circular DNA and RNA sequences. Customizable alphabets allow for other types of sequences. In contrast to the original SEGUID, which uses Base64, SEGUID v2 uses Base64url to encode the SHA-1 hash. This ensures SEGUID v2 checksums can be used as-is in filenames, regardless of platform, and in URLs, with minimal friction. Availability SEGUID v2 is readily available for major programming languages, distributed under the MIT license. JavaScript package seguid is available on npm, Python package seguid on PyPi, R package seguid on CRAN, and a Tcl script on GitHub. These tools, along with documentation, examples, and an online SEGUID Calculator , can be found at https://www.seguid.org .

Pereira, Humberto↗
DOE OSTI2012

Secure Control Systems for the Energy Sector

Schweitzer Engineering Laboratories (SEL) will conduct the Hallmark Project to address the need to reduce the risk of energy disruptions because of cyber incidents on control systems. The goals is to develop solutions that can be both applied to existing control systems and designed into new control systems to add the security measures needed to mitigate energy network vulnerabilities. The scope of the Hallmark Project contains four primary elements: 1. Technology transfer of the Secure Supervisory Control and Data Acquisition (SCADA) Communications Protocol (SSCP) from Pacific Northwest National Laboratories (PNNL) to Schweitzer Engineering Laboratories (SEL). The project shall use this technology to develop a Federal Information Processing Standard (FIPS) 140-2 compliant original equipment manufacturer (OEM) module to be called a Cryptographic Daughter Card (CDC) with the ability to directly connect to any PC enabling that computer to securely communicate across serial to field devices. Validate the OEM capabilities with another vendor. 2. Development of a Link Authenticator Module (LAM) using the FIPS 140-2 validated Secure SCADA Communications Protocol (SSCP) CDC module with a central management software kit. 3. Validation of the CDC and Link Authenticator modules via laboratory and field tests. 4. Creation of documents that record the impact of the Link Authenticator to the operators of control systems and on the control system itself. The information in the documents can assist others with technology deployment and maintenance.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2013

Inherent secure communications using lattice based waveform design

The wireless communications channel is innately insecure due to the broadcast nature of the electromagnetic medium. Many techniques have been developed and implemented in order to combat insecurities and ensure the privacy of transmitted messages. Traditional methods include encrypting the data via cryptographic methods, hiding the data in the noise floor as in wideband communications, or nulling the signal in the spatial direction of the adversary using array processing techniques. This work analyzes the design of signaling constellations, i.e. modulation formats, to combat eavesdroppers from correctly decoding transmitted messages. It has been shown that in certain channel models the ability of an adversary to decode the transmitted messages can be degraded by a clever signaling constellation based on lattice theory. This work attempts to optimize certain lattice parameters in order to maximize the security of the data transmission. These techniques are of interest because they are orthogonal to, and can be used in conjunction with, traditional security techniques to create a more secure communication channel.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2015

Report on a Zero-Knowledge Protocol Tabletop Exercise

This report summarizes the discussion and conclusions reached during a table top exercise held at Sandia National Laboratories, Albuquerque on September 3, 2014 regarding a recently described approach for nuclear warhead verification based on the cryptographic concept of a zero-knowledge protocol (ZKP) presented in a recent paper authored by Glaser, Barak, and Goldston. A panel of Sandia National Laboratories researchers, whose expertise includes radiation instrumentation design and development, cryptography, and arms control verification implementation, jointly reviewed the paper and identified specific challenges to implementing the approach as well as some opportunities. It was noted that ZKP as used in cryptography is a useful model for the arms control verification problem, but the direct analogy to arms control breaks down quickly. The ZKP methodology for warhead verification fits within the general class of template-based verification techniques, where a reference measurement is used to confirm that a given object is like another object that has already been accepted as a warhead by some other means. This can be a powerful verification approach, but requires independent means to trust the authenticity of the reference warhead - a standard that may be difficult to achieve, which the ZKP authors do not directly address. Despite some technical challenges, the concept of last-minute selection of the pre-loads and equipment could be a valuable component of a verification regime.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
DOE OSTI2018

Review of Authentication Strategies and Trends for Distributed Energy Resources (DERs)

In this study we review literature on machine to machine (M2M) authentication and encryption pertaining to communication with grid-attached power inverters. We regard security recommendations from NIST, constrained device recommendations from CoAP, as well as influences from the existing markets. We will not focus on passwordless or multifactor schemes of user authentication, the handover/roaming authentication of mobile systems, or the group authentication of WiMAX/LTE communications. The de-facto standards for authentication and encryption are certificate-based public key cryptography and AES, respectively. While certificate-based public key cryptography is widely adopted, certificate management is seen as an Achilles heel of public key infrastructure (PKI). State of the art authentication system research includes work on certificateless authentication; however, much work in the areas of privacy preservation, efficient or lightweight systems continue to be based in public key methods. We will see efforts such as bilinear pairing, aggregate message authentication codes, one-time signatures, and Merkle trees surface and resurface with improved authentication approaches. Though research continues to produce new encryption schemes, AES prevails as a viable choice, as it can be implemented across a variety of resource constrained devices. Other lightweight encryption algorithms often employ the same fundamental addition-rotation-xor operations as AES while achieving higher efficiency, but at steep tradeoffs to security. Despite mathematical proofs of the security of cryptographic algorithms, in practice the greatest weaknesses continue to be incurred during implementation. Security researchers will find edge cases and bugs that allow unintentional behavior. In the following sections, accepted methodologies of authentication and encryption are discussed. Due diligence for securing M2M communications requires consideration during planning, design, implementation and product lifetime, as opposed to a set-it and forget-it policy. Best practices can be gleaned from published successes and failures, with no single end-all, be-all detailed solution.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2019

Module OT Laboratory Test Procedure

This document will detail a test procedure, involving bench and emulation testing, for the Module OT device developed for the joint NREL-SNL DOE CEDS project titled "Modular Security Apparatus for Managing Distributed Cryptography for Command & Control Messages on Operational Technology (OT) Networks." The aim of this document is to create the testing and evaluation protocol for the module for lab-level testing; this includes checklists and experiments for information gathering, functional testing, cryptographic implementation, public key infrastructure, key exchange/authentication, encryption, and implementation testing in the emulation environment.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2018

Keyless Infrastructure Security Solution (KISS) (Technology Landscape Analysis Report)

The following landscape analysis explores blockchain or distributed ledger technologies application to securing electricity infrastructure. The exploration of how distributed ledger technologies can be used to increase the trustworthiness and integrity of the grid’s edge is imperative to the economic, security and well-being of all modern societies that rely on electricity. Blockchain technology’s ability to secure, track and optimize complex data transactions provides an exciting value proposition to securing and optimizing the U.S. power grid. An energy delivery system (EDS) operating at the grid’s edge requires unprecedented levels of security and trustworthiness to verify integrity of data and manage complex transactive and distributed Energy Resources (DERs) exchanges. Moreover, grid-edge devices lack visibility, control and security to conduct real-time energy transactions with the required security, speed and scale. The U.S. power grid is a complex system of systems that requires secure, reliable and trustworthy EDSs. Grid modernization has increased the speed and size of data sets exchanged on these systems (Gordes and Mylrea 2014). Exasperating the challenge is these systems are increasingly distributed creating new data fidelity and interoperability challenges for grid operators struggling to balance and incorporate DERs. Blockchain technology provides an atomically verifiable cryptographic signature to help increase the trustworthiness of EDSs at the grid’s edge. This feature is especially important at distribution level since EDSs and field devices have increasing operational and security requirements that are often diametrically opposed. For example, as data, speed and analytic requirements increase, security and functionality requirements increase. Further, as the grid’s edge incorporate DERs and transacts in real time, availability is prioritized over the integrity and confidentially of that data. Blockchain presents the prospect of solving some of these complex challenges related to grid security and modernization. However, there are more questions about blockchain applicability than answers. There are number of theoretical blockchain applications to the energy sector, but few energy utilities have actually applied, implemented or even experimented with the underlying distributed ledger technology and consensus algorithms that enable blockchain to exchange data more efficiently and securely.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Modular Security Apparatus for Managing Distributed Cryptography for Command-and-Control Messages on Operational Technology Networks (Module-OT)

Module-OT is a bump- in- the- wire solution acting as a secure conduit for data between devices or systems across a network. Using the latest in open-source cryptographic libraries, all defined communications undergo authentication, authorization, and encryption. The core system can be easily installed through industry standard processes, and the use of popular open-source packages allows for it to be customizable customized by the developer community or deployed in unique embedded environments.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2023

AOI-2, A Novel Access Control Blockchain Paradigm for Cybersecure Sensor Infrastructure in Fossil Power Generation Systems

Fossil power generation systems are increasingly vulnerable to attack from both cybercriminals as well as internal threats. These vulnerabilities demand that emerging technologies such as blockchains be utilized to secure the data involved in the information flows within the Supervisory Control and Data Acquisition (SCADA) systems of the fossil power generation plants. The publicly accessible blockchain protocols, although secure, are visible to everyone. Even private blockchains currently are unable to support different levels of access to different participants, which is a critical requirement for the existing SCADA systems running the power plants. In light of the above, novel blockchain protocols that are specifically adapted to fossil power generation environments need to be developed in order to achieve the goal of cybersecure sensor networks. In this work, we address this question by creating a novel blockchain technology, namely smart private ledger, for cybersecure communication within the fossil power generation systems. A lab-scale sensor network consisting of strain and temperature sensors is constructed to develop the ledger. The technology has hierarchical access control which is compatible with the existing SCADA systems in fossil power plants. The sensor data is used with cryptographic digital signatures and secret sharing protocols within the nodes of the blockchain technology. The research results will lead to cybersecurity for machine-to-machine interactions, infrastructure for secure data logging for sensors, decentralized data storage, and second-layer technologies for high volume machine-to-machine interactions in the power plants. The work aims to largely address the concerns for the security of distributed sensor networks in such systems that can be compromised by insider threats and by cybercriminals. The research has led to the training of the next generation of engineers and scientists in the important areas of sensor engineering and blockchain technology.

01 COAL, LIGNITE, AND PEAT↗