String Hunting for Hardcoded Credentials and Clear Text Data with Control Flow Graph
String Hunting for Hardcoded Credentials and Clear Text Data with Control Flow Graph
99 GENERAL AND MISCELLANEOUS↗
SEARCH · Search NASA
Results for “secure data”
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
2022 GETEM Geothermal Drilling Cost Curve Update
The Geothermal Electricity Technology Evaluation Model (GETEM) is an essential tool for the U.S. Department of Energy's (DOE) Geothermal Technologies Office (GTO) to understand the performance and cost of technologies it is seeking to improve. This detailed model is used for supply curve analyses, assessing the current economic feasibility and levelized cost of energy (LCOE) of hydrothermal geothermal systems and enhanced geothermal systems (EGS), and evaluating the potential impact of advanced geothermal technologies. GETEM can be used to estimate the performance and costs of currently available U.S. geothermal power systems. It is also used to estimate the costs of technologies 5 to 20 years in the future, given the direction of potential research, development, and demonstration (RD&D) projects. The model is intended to help GTO determine which proposed RD&D programs and projects might offer the most efficient improvement when using taxpayer funding. The model requires annual updates as well as revisions to reflect the current state of the art. Drilling costs are a significant portion of total geothermal development costs. The current GETEM drilling cost inputs rely on drilling data from 2009 and require an updated analysis of more recent data to ensure they remain representative of current technologies. An updated, more accurate understanding of costs could help the geothermal industry secure project development financing and investment funding and better allow the oil and gas (O&G) industry (both operators and service companies) to weigh potential geothermal market participation and customization. This report details recent drilling improvements from the Utah Frontier Observatory for Research in Geothermal Energy (FORGE) and the O&G sector, comparing drilling performance and costs with values in GETEM, particularly the baseline drilling cost curves. Although drilling performance at FORGE has improved significantly, we did not find associated cost decreases that would justify lowering the GETEM baseline cost curves at this time.
API↗
Advanced Simulation and Computing (FY22 Implementation Plan Rev 0)
The DOE National Nuclear Security Administration (NNSA) Stockpile Stewardship Program (SSP) is an integrated technical program for maintaining the safety, surety, and reliability of the U.S. nuclear stockpile. The SSP incorporates nuclear test data, computational modeling and simulation, and experimental facilities to advance understanding of nuclear weapons. The suite of data analyzed comes from activities including stockpile surveillance, experimental research, and development and engineering programs. This integrated national program requires the continued use of experimental facilities and the computational capabilities to support the SSP missions. These component parts, in addition to an appropriately scaled production capability, enable NNSA to support stockpile requirements. The ultimate goal of the SSP, and thus of the Advanced Simulation and Computing (ASC) Program, is to ensure that the U.S. maintains a safe, secure, and effective strategic deterrent. Specific work activities and scope contained in this Implementation Plan (IP) represent the full-year annual operating plan for FY22. The Initial IP, effective , should be consistent with the Department’s Base Table when operating under a Continuing Resolution (CR). The final IP, effective date TBD, is consistent with the final, enacted appropriation.
45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
Privacy Preserving Federated Learning for Advanced Scientific Ecosystems
We present a framework to provide privacy preserving (PP) federating learning (FL) across multiple computational and experimental facilities. This work joins the compute capabilities of National Energy Research Scientific Computing Center (NERSC) and Oak Ridge National Laboratory Research Cloud (ORC) with simulated experimental data, such as those produced at the SLAC National Accelerator Laboratory and Spallation Neutron Source (SNS). We describe the software infrastructure developed to provide privacy for computational and experimental networks. We developed algorithmic privacy across the federated system by embedding database security, computation, and communication into the federation architecture, utilizing scientific tools developed by the experimental community.
Archibald, Rick [ORNL] (ORCID:0000000245389780)↗
Hydrologic and Agricultural Earth Observations and Modeling for the Water-Food Nexus
In a globalizing and rapidly-developing world, reliable, sustainable access to water and food are inextricably linked to each other and basic human rights. Achieving security and sustainability in both requires recognition of these linkages, as well as continued innovations in both science and policy. We present case studies of how Earth observations are being used in applications at the nexus of water and food security: crop monitoring in support of G20 global market assessments, water stress early warning for USAID, soil moisture monitoring for USDA's Foreign Agricultural Service, and identifying food security vulnerabilities for climate change assessments for the UN and the UK international development agency. These case studies demonstrate that Earth observations are essential for providing the data and scalability to monitor relevant indicators across space and time, as well as understanding agriculture, the hydrological cycle, and the water-food nexus. The described projects follow the guidelines for co-developing useable knowledge for sustainable development policy. We show how working closely with stakeholders is essential for transforming NASA Earth observations into accurate, timely, and relevant information for water-food nexus decision support. We conclude with recommendations for continued efforts in using Earth observations for addressing the water-food nexus and the need to incorporate the role of energy for improved food and water security assessments
Food Security↗
Experimental decoy-state Bennett-Brassard 1984 quantum key distribution through a turbulent channel
In free-space quantum key distribution (QKD) in turbulent conditions, scattering and beam wandering cause intensity fluctuations which decrease the detected signal-to-noise ratio. This effect can be mitigated by rejecting received bits when the channel's transmittance is below a threshold. Thus, the overall error rate is reduced and the secure key rate increases despite the deletion of bits. In this work, we implement recently proposed selection methods focusing on the prefixed-threshold real-time selection (P-RTS) where a cutoff can be chosen prior to data collection and independently of the transmittance distribution. We perform finite-size decoy-state Bennett-Brassard 1984 QKD in a laboratory setting where we simulate the atmospheric turbulence using an acousto-optical modulator. We show that P-RTS can yield considerably higher secure key rates for a wide range of the atmospheric channel parameters. In addition, we evaluate the performance of the P-RTS method for a realistically finite sample size. We demonstrate that a near-optimal selection threshold can be predetermined even with imperfect knowledge of the channel transmittance distribution parameters.
71 CLASSICAL AND QUANTUM MECHANICS, GENERAL PHYSIC↗
Feasibility of Realizing a Universal Identifier Based on Fiber Bragg Grating Technology
Over the past year we have collected data on different fiber Bragg gratings (FBG) with the end goal of understanding their suitability for use in a new type of unique identifier (UID) that could be used in both tags and seals for high-value, high-risk assets. The ideal UID will have a complex signature that allows items to be uniquely identified by that signature. Tamper indication must be an integral part of the tag/seal process with measurable changes to the device signature indicative of any attempt to tamper with the monitored item. Further, the signature must be so difficult to reproduce that even state-actors with significant resources at their disposal will be discouraged from attempting it. Finally, readout verification of the product must be simple and secure, while providing red-light/green-light results in real time. To evaluate how well an FBG-based UID could meet these goals, we collected data on a large number of FBG samples from different vendors. Measurements included the response of the devices to uniform tension, tension when wrapped on a mandrel, and the response to changes in temperature and humidity, as well as the effect of simple potting in expanding and nonexpanding potting materials. We tested FBG samples written into single-mode fibers that were coated with the two commonly used materials, polyimide and acrylate and gratings that were both uniform and those with an apodized response (i.e., the intensity of the grating was varied to minimize sidelobes). The result of the work to date did not find any significant issues with the design concept for a UID based on this technology. Specific findings include a baseline design comprising five FBGs with distinct spectral returns analyzed using a difference-correlation approach. To realize this device, careful attention must be given to the impact of environmental factors on the UID response, limiting the properties of the potting compounds and FBG coating materials that can be used.
71 CLASSICAL AND QUANTUM MECHANICS, GENERAL PHYSIC↗
Health Assessment and Performance Monitoring of Large Machine Diagnostics
Presentation to be given at the CCS-6 Statistical Seminar Series. Regularly maintained and operated diagnostic machines are a backbone of data collection and are a vital component of the Stockpile Stewardship Program’s efforts to better understand nuclear physics. The Cygnus X-ray machine, stationed at the Nevada National Security Site’s U1a underground facility, is one such diagnostic that provides a radiographic capability for the subcritical experiment program. Component failures within Cygnus can result in catastrophic downtime for the diagnostic, affecting performance, schedules, and cost. However, over the years various measurements have been collected on the two Cygnus axes, including voltage and current measurements at different locations, which we believe have predictive power to indicate machine health. We will share preliminary insight into this data and the machine learning approaches we are taking to assess Cygnus’ health, observe declining performance, and predict failures.
97 MATHEMATICS AND COMPUTING↗
29 th International Training Course on the Physical Protection of Nuclear Materials and Nuclear Facilities (Project Summary)
Sandia National Laboratories (Sandia) has hosted the International Training Course on the Physical Protection of Nuclear Materials and Nuclear Facilities since 1978. This course is the flagship training course of the International Atomic Energy Agency (IAEA). On behalf of the National Nuclear Security Administration (NNSA), Sandia manages, develops, and coordinates all course materials, and works closely with the IAEA to arrange all logistical details for the course ITC-29 incorporated some updates to the facility models, based on feedback received in ITC-28 and the ITC-29 dry run. In addition, all the graphics were refreshed after ITC-28 and implemented in the posters, data handbooks, etc. As in ITC-28, the ITC-29 staff worked closely with the IAEA on course materials, including a peer review process to ensure all course materials were aligned with Nuclear Security Series No. 13 and other relevant international guidance documentation from the IAEA. Due to the COVID-19 pandemic, ITC-29 was postponed twice and eventually took place in the late summer/early fall of 2022. Due to ongoing COVID-19 restrictions and safety requirements, the number of participants was reduced by about 31 percent from 59 participants in ITC-28 to 41 in ITC-29. As a result, the number of subgroups also decreased from eight in ITC-28 to six for ITC-29. This enabled the Sandia team to implement more opportunities for social distancing, particularly in the large classrooms. Despite the challenges, ITC-29 still passed a significant milestone, with the one-thousandth participant of the international training course attending during this event. Finally, the ITC staff continued the use of its improved method of evaluation to capture participants’ satisfaction with the updated course and to gather feedback concerning future improvements. This document provides a brief description of ITC-29, including a summary of lessons learned and key recommendations for future development efforts.
98 NUCLEAR DISARMAMENT, SAFEGUARDS, AND PHYSICAL P↗
Experimental Setup for Grid Control Device Software Updates in Supply Chain Cyber-Security
Supply chain cyberattacks that exploit insecure third-party software are a growing concern for the security of the electric power grid. These attacks seek to deploy malicious software in grid control devices during the fabrication, shipment, installation, and maintenance stages, or as part of routine software updates. Malicious software on grid control devices may inject bad data or execute bad commands, which can cause blackouts and damage power equipment. This paper describes an experimental setup to simulate the software update process of a commercial power relay as part of a hardware-in-the-loop simulation for grid supply chain cyber-security assessment. The laboratory setup was successfully utilized to study three supply chain cyber-security use cases.
Keller, Joseph↗
Investigation of Archived Gamma Data to Report Minimum Detectable Activities for Gamma-Emitting Radionuclides in Groundwater Samples
Los Alamos National Laboratory (LANL) has performed gamma analyses on ground water samples from the Nevada National Security Site (NNSS) (previously known as the Nevada Test Site or NTS) for the last 50 years. During that time, LANL has reported all of the detected radionuclides in various reports, letters and publications. However, until recently, no minimum detectable activities (MDAs) for undetected radionuclides of interest have been reported. In fact, most gamma emitting radionuclides were not detected in groundwater samples above their respective MDAs, and the MDAs can be used to define upper -bound activities for these radionuclides in the groundwater samples.
12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
Leveraging Existing Bioenergy Data: Workshop Summary Report
The U.S. Department of Energy’s (DOE’s) Office of Energy Efficiency and Renewable Energy (EERE) invests in a diverse portfolio of technologies to ensure domestic energy security, continued economic competitiveness, environmental sustainability, and the availability of cleaner fuels and power. The mission of EERE’s Bioenergy Technologies Office (BETO) is to develop transformative and revolutionary sustainable bioenergy technologies for a prosperous nation. BETO develops technologies that convert domestic biomass and waste resources into fuels, products, and power to enable affordable energy, economic growth, and innovation in renewable energy and chemicals production. This report summarizes the input received from attendees of the public workshop sponsored by BETO on July 21–23, 2020, as well as input received from a Request for Information (RFI) run in August and September 2019.
09 BIOMASS FUELS↗
Data for "Field-scale Evaluation of Ecosystem Service Benefits of Bioenergy Switchgrass"
Purpose-grown perennial herbaceous species are nonfood crops specifically cultivated for bioenergy production and have the potential to secure bioenergy feedstock resources while enhancing ecosystem services. This study assessed soil greenhouse gas emissions (CO2 and N2O), nitrate (NO3-N) leaching reduction potential, evapotranspiration (ET), and water-use efficiency (WUE) of bioenergy switchgrass ( Panicum virgatum L.) in comparison to corn ( Zea mays L.). The study was conducted on field-scale plots in Urbana, IL, during the 2020–2022 growing seasons. Switchgrass was established in 2020 and urea-fertilized at 56 kg N ha−1 year−1. Corn management followed best management practices for the US Midwest, including no-till and 202 kg N ha−1 year−1 fertilization, applied as urea–ammonium nitrate (32%). Our results showed lower direct N2O emissions in switchgrass compared to corn. Although soil CO2 emissions did not differ significantly during the establishment year, emissions in subsequent years were over 50% higher in switchgrass than in corn, likely due to increased belowground biomass, which was over five times higher in switchgrass. Nitrate-N leaching decreased as the switchgrass stand matured, reaching 80% lower than in corn by the third year. Differences in ET and WUE between corn and switchgrass were not significant; however, results indicate a trend toward reduced WUE in switchgrass under drought, driven by lower aboveground biomass production. Our study demonstrates that switchgrass can be implemented at a commercial scale without negatively impacting the hydrological cycle, while potentially reducing N losses through nitrate-N leaching and soil N2O emissions, and enhancing belowground C storage.
field data↗
Data-Driven Software Framework for Web-Based ISS Telescience
Software that enables authorized users to monitor and control scientific payloads aboard the International Space Station (ISS) from diverse terrestrial locations equipped with Internet connections is undergoing development. This software reflects a data-driven approach to distributed operations. A Web-based software framework leverages prior developments in Java and Extensible Markup Language (XML) to create portable code and portable data, to which one can gain access via Web-browser software on almost any common computer. Open-source software is used extensively to minimize cost; the framework also accommodates enterprise-class server software to satisfy needs for high performance and security. To accommodate the diversity of ISS experiments and users, the framework emphasizes openness and extensibility. Users can take advantage of available viewer software to create their own client programs according to their particular preferences, and can upload these programs for custom processing of data, generation of views, and planning of experiments. The same software system, possibly augmented with a subset of data and additional software tools, could be used for public outreach by enabling public users to replay telescience experiments, conduct their experiments with simulated payloads, and create their own client programs and other custom software.
Tso, Kam S.↗
Verifying the Computational Integrity of Power Grid Controls with Zero-Knowledge Proof
The control of future power grids is migrating from a centralized to a distributed/decentralized scheme to enable a massive penetration of distributed energy resources with rising dependence on communication infrastructure. A common assumption made for most existing distributed/decentralized controllers is that local controllers would faithfully follow the designated controller dynamics based on the data received from communication channels. However, with increased probability of cyberattacks on Operational Technology infrastructure, such an assumption could be risky because proper execution of the controller dynamics is then built on trust in secure communication and computation. In this work, we leverage a cryptography technology known as zero-knowledge scalable transparent arguments of knowledge (zk-STARK) to verify the computational integrity of power grid control algorithms, with projected linear dynamics-based control schemes as the initial proof-of-concept test case. The method presented here converts the cybersecurity challenge of data integrity for grid control into a subset of computational integrity.
computational integrity↗
Fact Sheet: National Space Policy
For over three decades, the United States has led the world in the exploration and use of outer space. Our achievements in space have inspired a generation of Americans and people throughout the world. We will maintain this leadership role by supporting a strong, stable, and balanced national space program that serves our goals in national security, foreign policy, economic growth, environmental stewardship, and scientific and technical excellence. Access to and use of space are central for preserving peace and protecting US national security as well as civil and commercial interests. The United States will pursue greater levels of partnership and cooperation in national and international space activities and work with other nations to ensure the continued exploration and use of outer space for peaceful purposes. The goals of the US space program are to: (a) Enhance knowledge of the Earth, the solar system, and the universe through human and robotic exploration; (b) Strengthen and maintain the national security of the United States; (c) Enhance the economic competitiveness and scientific and technical capabilities of the United States; (d) Encourage State, local, and private sector investment in, and use of, space technologies; (e) Promote international cooperation to further US domestic, national security, and foreign policies. The United States is committed to the exploration and use of outer space by all nations for peaceful purposes and for the benefit of all humanity. "Peaceful purposes" allow defense and intelligence-related activities in pursuit of national security and other goals. The United States rejects any claims to sovereignty by any nation over outer space or celestial bodies, or any portion thereof, and rejects any limitations on the fundamental right of sovereign nations to acquire data from space. The United States considers the space systems of any nation to be national property with the right of passage through and operations in space without interference. Purposeful interference with space systems shall be viewed as an infringement on sovereign rights. The US Government will maintain and coordinate separate national security and civil space systems where differing needs dictate. All actions undertaken by agencies and departments in implementing the national space policy shall be consistent with US law, regulations, national security requirements, foreign policy, international obligations, and nonproliferation policy. The National Science and Technology Council (NSTC) is the principal forum for resolving issues related to national space policy. As appropriate, the NSTC and NSC will co-chair policy process. This policy will be implemented within the overall resource and policy guidance provided by the President.
Source record↗
Security in Full-Force
When fully developed for NASA, Vanguard Enforcer(TM) software-which emulates the activities of highly technical security system programmers, auditors, and administrators-was among the first intrusion detection programs to restrict human errors from affecting security, and to ensure the integrity of a computer's operating systems, as well as the protection of mission critical resources. Vanguard Enforcer was delivered in 1991 to Johnson Space Center and has been protecting systems and critical data there ever since. In August of 1999, NASA granted Vanguard exclusive rights to commercialize the Enforcer system for the private sector. In return, Vanguard continues to supply NASA with ongoing research, development, and support of Enforcer. The Vanguard Enforcer 4.2 is one of several surveillance technologies that make up the Vanguard Security Solutions line of products. Using a mainframe environment, Enforcer 4.2 achieves previously unattainable levels of automated security management.
Source record↗
Practical Computer Security through Cryptography
The core protocols upon which the Internet was built are insecure. Weak authentication and the lack of low level encryption services introduce vulnerabilities that propagate upwards in the network stack. Using statistics based on CERT/CC Internet security incident reports, the relative likelihood of attacks via these vulnerabilities is analyzed. The primary conclusion is that the standard UNIX BSD-based authentication system is by far the most commonly exploited weakness. Encryption of Sensitive password data and the adoption of cryptographically-based authentication protocols can greatly reduce these vulnerabilities. Basic cryptographic terminology and techniques are presented, with attention focused on the ways in which technology such as encryption and digital signatures can be used to protect against the most commonly exploited vulnerabilities. A survey of contemporary security software demonstrates that tools based on cryptographic techniques, such as Kerberos, ssh, and PGP, are readily available and effectively close many of the most serious security holes. Nine practical recommendations for improving security are described.
McNab, David↗