Search NASA⌕ Search

SEARCH · Search NASA

Results for “secure data”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 127 records · Page 7

Securing 3D NAND Without Density Loss via In-Situ Encryption Using a Single Transistor XOR Cell

In this article, we push lightweight XOR-based in-situ encryption to extreme density by proposing a singletransistor XOR memory cell and applying it to 3D NAND, enabling secure data storage without density loss. Using a ferroelectric field-effect transistor (FeFET) as an example technology, we demonstrate that: i) a single-transistor memory can realize the XOR function by exploiting the ability to charge the source and drain separately and control current flow direction, eliminating the need for conventional encrypted cells that rely on complementary devices; ii) with a XOR-based cipher, encryption and decryption can be mapped to in-situ array operations, where ciphertext is stored as the threshold voltage (VTH) states of FeFETs in a NAND string, and decryption is achieved through read operations using key-dependent complementary source/drain bias; iii) the proposed technique is scalable to multi-level cell (MLC) storage by encrypting and decrypting data bit by bit; iv) using an integrated NAND FeFET array, we experimentally demonstrate encryption and decryption operations for both single-level cell (SLC) and MLC storage; v) systemlevel benchmarking shows that the proposed technique achieves 48× and 278× improvements in encryption and decryption throughput, respectively, compared to AES.

36 MATERIALS SCIENCE↗

Active Time-Domain Reflectometry for Unattended Safeguards Systems: FY16 Report

The International Atomic Energy Agency (IAEA) continues to expand its use of unattended measurement systems. An increasing number of systems and an expanding family of instruments create challenges in terms of deployment efficiency and the implementation of data authentication measures. Traditional data security measures, for example tamper-indicating (TI) conduit, are impractical for the long separation distances (often 100 meters or more) between unattended monitoring system (UMS) components. Pacific Northwest National Laboratory (PNNL) is studying the viability of active time-domain reflectometry (TDR) for the detection of cable tampering in unattended radiation detection systems. The instrument concept under investigation would allow for unmanned cable integrity measurements, remote surveillance reporting and locating of cable faults and/or tampers. This report describes PNNL’s FY16 progress and includes: an overview of the TDR methods under investigation; description of the TDR evaluation testbed developed by PNNL; development and testing of advanced signal processing algorithms to extract weak signals from relatively high noise levels; and initial testing of a laboratory prototype intended for IAEA UMS applications and based on a commercially available TDR module. Preliminary viability findings and recommendations for the next stage of development and testing are provided.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗

Concept of Operations: National Technology Test Bed Network for Water Resource Recovery

There is an urgency to advancing wastewater technologies due to aging water infrastructure and emerging regulations. A crosscutting working group proposes a conceptual design for a test bed network to understand and evaluate wastewater technologies to drive acceptance and deployment of new technologies to enhance performance. The working group includes contributors from the U.S. Department of Energy, the U.S. Environmental Protection Agency, the U.S. National Science Foundation, and the Water Research Foundation (formerly known as the Water Environment & Reuse Foundation). Upgrading today's aging wastewater treatment infrastructure to a new generation of water resource recovery facilities (WRRFs) requires the development and deployment of innovative technologies. The path to technology adoption depends on expensive, time consuming, and often repetitive cycles of testing and validation. Existing water resource recovery technology testing facilities (e.g., test beds) are underutilized and cannot, by themselves, broaden technology uptake. It has been proposed that technology adoption could be accelerated by a network linking these test facilities with innovators, manufacturers, utilities, regulators, policymakers, and educators. This document proposes a structure for a National Test bed Network (TBN) for water resource recovery. The concepts for its operation are explored herein. This document identifies drivers to launch a TBN and critical needs for successful implementation of the network. An important driver to technology implementation at WRRFs is the relationship between local utilities and state regulators. The TBN could provide access to validated performance data and facilitate deployment. To link the stakeholders and accelerate deployment, the TBN will require standards for methods, data quality, data management, and data security. These standards will enable validation of performance and will expand the “toolbox” that utilities and regulators could consider. Design, set up, and launch of this toolbox is beyond the scope of operations of utilities and regulators and will likely require external support to achieve full operation. Herein, a pathway is proposed to achieve this full operation. This document defines the function of a WRRF TBN. It also proposes a structure for the TBN to achieve its stated goals and mission. Finally, this document summarizes findings from several sources, including a series of workshops about the TBN concept, operators of test beds in ancillary industries, and discussions with regulators and permitting agencies. A description of this work was published in the peer-reviewed literature (Mihelcic 2017).

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

The Synchronic Web

The Synchronic Web is a distributed network for securing data provenance on the World Wide Web. By enabling clients around the world to freely commit digital information into a single shared view of history, it provides a foundational basis of truth on which to build decentralized and scalable trust across the Internet. Its core cryptographical capability allows mutually distrusting parties to create and verify statements of the following form: “I commit to this information—and only this information—at this moment in time.” The backbone of the Synchronic Web infrastructure is a simple, small, and semantic-free blockchain that is accessible to any Internet-enabled entity. The infrastructure is maintained by a permissioned network of well-known servers, called notaries, and accessed by a permissionless group of clients, called journals. Through an evolving stack of flexible and composable semantic specifications, the parties cooperate to generate synchronic commitments over arbitrary data. When integrated with existing infrastructures, adapted to diverse domains, and scaled across the breadth of cyberspace, the Synchronic Web provides a ubiquitous mechanism to lock the world’s data into unique points in discrete time and digital space. This document provides a technical description of the core Synchronic Web system. The distinguishing innovation in our design—and the enabling mechanism behind the model—is the novel use of verifiable maps to place authenticated content into canonically defined locations off-chain. While concrete specifications and software implementations of the Synchronic Web continue to evolve, the information covered in the body of this document should remain stable. We aim to present this information clearly and concisely for technical non-experts to understand the essential functionality and value proposition of the network. In the interest of promoting discourse, we take some liberty in projecting the potential implications of the new model.

97 MATHEMATICS AND COMPUTING↗

Reverse Engineering of Medical Devices for Innovation and Advancement in Healthcare

• Medical technology is rapidly evolving and introducing new functionality and methodologies that suggest a higher risk for common vulnerability exposures (CVE) • Introduction of functionalities like Wi-Fi, Bluetooth, and internet connectivity require devices to be rigorously evaluated for vulnerabilities • Subsequently like many other fields cell-phone interconnectivity suggests a significantly higher level of risk to critical infrastructure and data security

Baldwin, David [Savannah River National Laboratory↗

Fleet DNA Phase 1 Refinement & Phase 2 Implementation; NREL (National Renewable Energy Laboratory)

Fleet DNA acts as a secure data warehouse for medium- and heavy-duty vehicle data. It demonstrates that vehicle drive cycle data can be collected and stored for large-scale analysis and modeling applications. The data serve as a real-world data source for model development and validation. Storage of the results of past/present/future data collection efforts improves analysis efficiency through pooling of shared data and provides the opportunity for 'big data' type analyses. Fleet DNA shows it is possible to develop a common database structure that can store/analyze/report on data sourced from multiple parties, each with unique data formats/types. Data filtration and normalization algorithms developed for the project allow for a wide range of data types and inputs, expanding the project’s potential. Fleet DNA demonstrates the power of integrating Big Data with existing and future tools and analyses: it provides an enhanced understanding and education of users, users can explore greenhouse gases and economic opportunities via AFLEET and ADOPT modeling, drive cycles can be characterized and visualized using DRIVE, high-level vehicle modeling can be performed using real-world drive cycles via FASTSim, and data reporting through Fleet DNA Phase 1 and 2 websites provides external users access to analysis results and gives the opportunity to explore on their own.

33 ADVANCED PROPULSION SYSTEMS↗

Implementation Scenarios for Electric Vehicle Roadway Wireless Power Transfer; NREL (National Renewable Energy Laboratory)

Analysis has been performed on the Transportation Secure Data Center (TSDC) warehouse of collected GPS second-by-second driving profile data of vehicles in the Atlanta, Chicago, Fresno, Kansas City, Los Angeles, Sacramento, and San Francisco Consolidated Statistical Areas (CSAs) to understand in-motion wireless power transfer introduction scenarios. In this work it has been shown that electrification of 1% of road miles could reduce fuel use by 25% for Hybrid Electric Vehicles (HEVs) in these CSAs. This analysis of strategically located infrastructure offers a promising approach to reduced fuel consumption; however, even the most promising 1% of road miles determined by these seven analysis scenarios still represent an impressive 2,700 miles of roadway to electrify. Therefore to mitigate the infrastructure capital costs, integration of the grid-tied power electronics in the Wireless Power Transfer (WPT) system at the DC-link to photovoltaic and/or battery storage is suggested. The integration of these resources would allow for the hardware to provide additional revenue through grid services at times of low traffic volumes and conversely at time of high traffic volumes these resources could reduce the peak demand that the WPT system would otherwise add to the grid.

33 ADVANCED PROPULSION SYSTEMS↗

NREL's Advanced Distribution Management System (ADMS) Test Bed

NREL's advanced distribution management system (ADMS) research helps utilities meet customer expectations of reliability, power quality, renewable energy use, data security, and resilience to natural disasters and other threats.

Advanced Research on Integrated Energy Systems↗

Healthcare Cybersecurity

Updated healthcare cybersecurity with a focus in patient data security, system interoperability, and medical device vulnerability mitigation

99 GENERAL AND MISCELLANEOUS↗

Evaluation of the Self Retrieval Augmented Generation Technique on Common Security Advisory Framework Data

This small experimental report evaluates a variation of Retrieval Augmented Generation (RAG), called Self-RAG. This method uses a generative language model that incorporates retrieved facts into its generation and is explicitly trained to be able to determine whether retrieved information is enough to answer the input query, with a user-defined threshold for confidence. We performed an experiment using data from the publicly available CISA Common Security Advisory Framework (CSAF) repository (https://github.com/cisagov/CSAF) as the database of facts to be used in retrieval. Qualitative results from the experiment demonstrate that the Self-RAG method has some ability to provide reasonable answers to queries that are in the dataset and will often ignore irrelevant information when asked outside of domain questions (e.g., general facts). In settings with deliberately confusing questions (the question is within domain, but asks about a fabricated advisory), it was able to refuse 40% of the time without further adjustments to the original framework. While this performance is not sufficient for current practical use, further improvements to data formatting, disambiguating results, and leveraging threshold values could improve performance significantly. However, evaluating this will require more extensive evaluations on larger datasets and potentially better models.

97 MATHEMATICS AND COMPUTING↗

Data Architecture for Security Monitoring (Project Summary)

The research has 2 thrusts: 1. new data architectures and tech-transfer-ready prototype tools that use write optimized data structures (WODS) to track real-world events, provide value to analysts, and support our cyber missions; and 2. algorithm research to address infinite streams of data, including expiration and sustainability.

97 MATHEMATICS AND COMPUTING↗

Universal Utility Data Exchange (UUDEX) – Security and Administration: Cybersecurity of Energy Delivery Systems (CEDS) Research and Development

A critical component of the Universal Utility Data Exchange (UUDEX) approach is the integrated security contained within its processing. This document describes how that security is designed and expected to be implemented by UUDEX Implementations (U-Implementations), including the UUDEX Server (U-Server) and UUDEX Clients (U-Clients). The UUDEX security hierarchy consists of three levels: 1. The UUDEX Instance (U-Instance) itself, which sits at the top of the hierarchy and contains the U-Server, the UUDEX Identity Authority (U-Identity Authority), and the UUDEX Administrator (U-Administrator) functions; 2. A group of one or more UUDEX Participants (U-Participants) that present “organizations” that participate in the U-Instance and contains the UUDEX Administrator Participant (U-U-Administrator Participant) function; 3. A group of one or more UUDEX Endpoints (U-Endpoints) that represent the individual UUDEX Publish Clients (U-Publish Client) responsible for supplying data to the U-Instance that is consumed by UUDEX Subscriber Clients (U-Subscriber Clients). U-Endpoints can be either autonomous devices that publish and subscribe data such as data exchange servers found in supervisory control and data acquisition and energy management systems, or they can be tied to users of applications that, for example, submit DOE OE-417 disturbance reports. U-Participants and U-Endpoints can be organized into UUDEX Groups (U-Groups). Any number of U-Participants or U-Endpoints can be members of a U-Group. A given U-Participant or U-Endpoint can be a member of multiple U-Groups, but a U-Group cannot contain other U-Groups. For example, a U-Group could be created to contain all U-Participant Transmission Operators within the purview of a Reliability Coordinator, and another U-Group could be created to contain all U-Participant Generator Operators within the purview of a Reliability Coordinator. U-Participants that are both Transmission Operators and Generator Operators would be members of both U-Groups. U-Participants, U-Endpoints, and U-Groups are used in the access control structures to provide access to individual UUDEX Subjects (U-Subjects). U-Groups are created by the U-Administrator and are managed by the U-Administrator or the designated U-Group Managers. U-Endpoints can be assigned UUDEX Roles (U-Roles) that can be used to further restrict access. U-Roles are assigned to individual U-Endpoints. For example, a U-Role of “Security Analyst” could be used to restrict which U-Endpoints can publish or subscribe security incident reports and vulnerability notifications, while a U-Role of “Transmission Planner” can be used to restrict which U-Endpoints can publish power system model updates. U-Role definitions are created by the U-Administrator, but the U-Roles are assigned to U-Endpoints by their respective UUDEX Participant Administrators (U-Participant Administrator). Because all information required to make security decisions is either included within the U-Endpoint’s X.509 digital certificate or stored in a datastore on the U-Server, all security decisions are performed and enforced within the U-Server. This reduces the complexity of the U-Client code and minimizes the chance for compromise of the integrity of the UUDEX security features.

97 MATHEMATICS AND COMPUTING↗

Module-OT: A Turnkey Solution for Securing Energy Systems

The Modular Security Apparatus for Managing Distributed Cryptography for Command-and-Control Messages on Operational Technology Networks (Module-OT) is a flexible and lightweight solution for grid-edge devices focusing on end-to-end security. It is a bump- in- the-wire solution acting as a secure conduit for data between devices or systems across a network. It improves the cybersecurity posture of DER systems by providing authentication, authorization, and data integrity to secure DER communications. Additionally, it performs key management, provides data security through whitelisting Internet Protocol addresses and ports, blocks unauthorized connections, controls user access, and allows serial or Ethernet connections for added flexibility. The core software is portable to various Linux-based operating systems and is developed to be customized by the developer and researcher communities. Module-OT has been validated in the lab, has been demonstrated at a 500-KW PV-plus-storage site, and has been proven ready to secure operational technology devices. Its core functionality meets current standards, including validation procedures of the NIST Cryptographic Algorithm Validation Program (CAVP) and the Federal Information Processing Standard (FIPS 140-2). Because of its capability to provide an accessible and affordable option for stepping up security across modern energy systems, Module-OT can serve as an effective technological option to standardize cybersecurity moving forward.

cryptography↗

Building Foundations for Nuclear Security Enterprise Analysis Utilizing Nuclear Weapon Data

The Nuclear Security Enterprise, managed by the National Nuclear Security Administration - a semiautonomous agency within the Department of Energy - has been associated with numerous assessments with respect to the estimating, management capabilities, and practices pertaining to nuclear weapon modernization efforts. This report identifies challenges in estimating and analyzing the Nuclear Security Enterprise through an analysis of analogous timeframe conditions utilizing two types of nuclear weapon data - (1) a measure of effort and (2) a function of time. The analysis of analogous timeframe conditions that utilizes only two types of nuclear weapon data yields four summary observations that estimators and analysts of the Nuclear Security Enterprise will find useful.

98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗

Using advanced data structures to enable responsive security monitoring

Write-optimized data structures (WODS), offer the potential to keep up with cyberstream event rates and give sub-second query response for key items like IP addresses. These data structures organize logs as the events are observed. To work in a real-world environment and not fill up the disk, WODS must efficiently expire older events. As the basis for our research into organizing security monitoring data, we implemented a tool, called Diventi, to index IP addresses in connection logs using RocksDB (a write-optimized LSM tree). In this work, we extended Diventi to automatically expire data as part of the data structures’ normal operations. We guarantee that Diventi always tracks the N most recent events and tracks no more than N + k events for a parameter k < N, while ensuring the index is opportunistically pruned. To test Diventi at scale in a controlled environment, we used anonymized traces of IP communications collected at SuperComputing 2019. We synthetically extended the 2.4 billion connection events to 100 billion events. We tested Diventi vs. Elasticsearch, a common log indexing tool. In our test environment, Elasticsearch saw an ingestion rate of at best 37,000 events/s while Diventi sustained ingestion rates greater than 171,000 events/s. Our query response times were as much as 100 times faster, typically answering queries in under 80 ms. Furthermore, we saw no noticeable degradation in Diventi from expiration. We have deployed Diventi for many months where it has performed well and supported new security analysis capabilities.

97 MATHEMATICS AND COMPUTING↗

Nevada National Security Site 2019 Data Report: Groundwater Monitoring Program Area 5 Radioactive Waste Management Site

This report presents groundwater and leachate sample results from the Area 5 Radioactive Waste Management Site (RWMS) at the Nevada National Security Site in Nye County, Nevada. Since 1993, groundwater samples have been collected and static water levels have been measured from the aquifer immediately below the Area 5 RWMS. The data are evaluated for evidence of effects on the aquifer related to the Area 5 RWMS. Leachate from the Cell 18 lined mixed waste cell has been sampled since 2011, and leachate from the Cell 25 lined mixed waste cell was first sampled in 2019 after it began receiving waste in August 2018. Leachate data are analyzed for hazardous contaminants to determine appropriate leachate handling and disposal. This report includes five years of data from 2015 through 2019.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗