Search NASA⌕ Search

SEARCH · Search NASA

Results for “authentication”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2018

System and method for authentication

Described are methods and systems for determining authenticity. For example, the method may include providing an object of authentication, capturing characteristic data from the object of authentication, deriving authentication data from the characteristic data of the object of authentication, and comparing the authentication data with an electronic database comprising reference authentication data to provide an authenticity score for the object of authentication. The reference authentication data may correspond to one or more reference objects of authentication other than the object of authentication.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

Streaming authentication and multi-level security for communications networks using quantum cryptography

Message authenticators for quantum-secured communications facilitate low-latency authentication with assurances of security. Low-latency message authenticators are especially valuable in infrastructure systems where security and latency constraints are difficult to satisfy with conventional non-quantum cryptography. For example, a message transmitter receives a message and derives an authentication tag for the message based at least in part on an authenticator that uses one or more quantum keys. The message transmitter outputs the message and its authentication tag. A message receiver receives a message and authentication tag for the message. The message receiver derives a comparison tag for the message based at least in part on an authenticator that uses one or more quantum keys. The message receiver checks whether the message is authentic based on a comparison of the authentication tag and the comparison tag. In example implementations, the authenticator uses stream-wise cyclic redundancy code operations.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Streaming authentication and multi-level security for communications networks using quantum cryptography

Message authenticators for quantum-secured communications facilitate low-latency authentication with assurances of security. Low-latency message authenticators are especially valuable in infrastructure systems where security and latency constraints are difficult to satisfy with conventional non-quantum cryptography. For example, a message transmitter receives a message and derives an authentication tag for the message based at least in part on an authenticator that uses one or more quantum keys. The message transmitter outputs the message and its authentication tag. A message receiver receives a message and authentication tag for the message. The message receiver derives a comparison tag for the message based at least in part on an authenticator that uses one or more quantum keys. The message receiver checks whether the message is authentic based on a comparison of the authentication tag and the comparison tag. In example implementations, the authenticator uses stream-wise cyclic redundancy code operations.

Hughes, Richard J.↗
DOE OSTI2018

Review of Authentication Strategies and Trends for Distributed Energy Resources (DERs)

In this study we review literature on machine to machine (M2M) authentication and encryption pertaining to communication with grid-attached power inverters. We regard security recommendations from NIST, constrained device recommendations from CoAP, as well as influences from the existing markets. We will not focus on passwordless or multifactor schemes of user authentication, the handover/roaming authentication of mobile systems, or the group authentication of WiMAX/LTE communications. The de-facto standards for authentication and encryption are certificate-based public key cryptography and AES, respectively. While certificate-based public key cryptography is widely adopted, certificate management is seen as an Achilles heel of public key infrastructure (PKI). State of the art authentication system research includes work on certificateless authentication; however, much work in the areas of privacy preservation, efficient or lightweight systems continue to be based in public key methods. We will see efforts such as bilinear pairing, aggregate message authentication codes, one-time signatures, and Merkle trees surface and resurface with improved authentication approaches. Though research continues to produce new encryption schemes, AES prevails as a viable choice, as it can be implemented across a variety of resource constrained devices. Other lightweight encryption algorithms often employ the same fundamental addition-rotation-xor operations as AES while achieving higher efficiency, but at steep tradeoffs to security. Despite mathematical proofs of the security of cryptographic algorithms, in practice the greatest weaknesses continue to be incurred during implementation. Security researchers will find edge cases and bugs that allow unintentional behavior. In the following sections, accepted methodologies of authentication and encryption are discussed. Due diligence for securing M2M communications requires consideration during planning, design, implementation and product lifetime, as opposed to a set-it and forget-it policy. Best practices can be gleaned from published successes and failures, with no single end-all, be-all detailed solution.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2019

Authentication Protocol for ICS without Encryption

Industrial control systems (ICS) describes the different types of control systems and associated instrumentation, which includes the devices, systems, networks, and controls used to operate and/or automate industrial processes. Depending on the industry, each ICS functions differently and are built to electronically manage tasks efficiently. Historically, industrial plants have included networking, and changes have been made over time without consideration for security. Many ICS devices currently have inadequate security features. Adding encryption in ICS is undesirable because many of the new detection method involves deep packet inspection. Therefore, we propose to develop a method of providing authentication between devices without encrypting the data. This testbed design will allow rapid development and experimentation with Cyber Physical Systems. Modbus connects to a supervisory computer with a Remote Terminal Unit (RTU) in Supervisory Control and Data Acquisition (SCADA) systems. Our project seeks to enhance security in the ICS environment by adding device authentication to the lower levels of the plant floor. This approach was selected as it allows verification of the sender of data from level 1/level 0 devices up to supervisory systems. This addition is desirable as it adds enhanced verification to the integrity of system data without obscuring (via encryption) the data being transmitted across the network. This is important because many ICS systems are real time critical (decryption adds to latency) and many other good security options require deep packet inspection (which encryption completely defeats). To accomplish this, a proof of concept of adding an authentication scheme was designed and will be tested with a common ICS protocol. The setup includes a single serial cable connecting the serial ports on two devices, a Master and a Minion. Authentication will occur in the following methods: - Data layer involving Transport Layer Security/Secure Socket Layer (TLS/SSL); - TCP/IP route implementation; - Key exchange algorithm; - Raspberry Pi programming for authentication. A portion of the setup includes adding Raspberry Pi into the system as the device is handling the authentication for the network traffic. Modbus is the chosen ICS protocol. It is used to transmit signals from instrumentation and control devices back to a main controller or data gathering system. Typically, the device identity is assumed but not verified. For verifying device identity, we constructed a digital signature architecture with TLS. A novel adaptation of this is to use only the digital signature that is provided and not the encryption capability. This allows ICS traffic to flow unobscured while still providing verification for the integrity of the data. Verification of this process will involve adding additional I/O level network devices with spoofed IP addresses and detecting the authenticated versus unauthenticated traffic. Our TLS implementation will have encryption disabled but should still allow for digital signing of data. This will enable our system to distinguish between real end devices and spoofed end devices. This experiment is presently building the test setup. It is focusing on a small setting to identify authenticated and unauthenticated devices on the network. This should allow for scaling to a larger network size after the initial proof of concept. One concern with this scheme is a certificate deployment has a large scale key management. Network size will thus increase the key management task for security. In addition, we believe that further research should be done on exploring the use of this method to defeat man-in-the-middle attacks.

42 ENGINEERING↗
DOE OSTI2019

Using Pulse Connect Secure © to Implement Multi-Factor Authentication Solutions

Pulse Connect Secure © (PCS) is a trusted platform for government agencies to provide secure access to web portals. As more and more accounts are being hacked and web sites are being compromised, single factor authentication with a username and password has become insufficient to adequately protect authenticated web portals. Multi-factor authentication (MFA), granting user access only when two or more independent pieces of information are presented, has become a necessary tool in the prevention of security breaches. This paper provides an overview of three MFA solutions that utilize the features of PCS. Categories include Personal Identity Verification (PIV) card authentication, service provider initiated (SP–initiated) Security Assertion Markup Language based (SAML–based) authentication, and identity provider initiated (IdP–initiated) SAML–based authentication.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2018

Apparatus, system, and method for sensor authentication

A method includes receiving an output signal from a sensor, recovering a noise signal from the output signal, comparing the noise signal with a stored baseline noise signature, and reporting authentication of the sensor if the comparison is within a pre-determined error limit. A sensor authentication apparatus, comprises a processor and a memory operably coupled with the processor. Instructions, when executed, cause the processor to separate a noise signal from a measured signal, and detect a noise signature match by comparing the noise signal with at least one stored baseline noise signature associated with the sensor. A sensor authentication system comprises a sensor authentication unit and a data acquisition unit. At least one of the sensor authentication unit and the data acquisition unit is configured to compare a noise signal with a baseline noise signature to authenticate the at least one sensor from among a plurality of sensors.

Svoboda, John M.↗
DOE OSTI2022

Optical authentication of images

Systems and methods performed for generating authentication information for an image using optical computing are provided. When a user takes a photo of an object, an optical authentication system receives light reflected and/or emitted from the object. The system also receives a random key from an authentication server. The system converts the received light to plenoptic data and uploads it to the authentication server. In addition, the system generates an optical hash of the received light using the random key, converts the generated optical hash to a digital optical hash, and uploads the digital optical hash to the authentication server. When the authentication server receives the upload, it verifies whether the time of the upload is within a certain threshold time from the sending of the random key and whether the digital optical hash was generated from the same light as the plenoptic data.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Optical authentication of images

Systems and methods performed for generating authentication information for an image using optical computing are provided. When a user takes a photo of an object, an optical authentication system receives light reflected and/or emitted from the object. The system also receives a random key from an authentication server. The system converts the received light to plenoptic data and uploads it to the authentication server. In addition, the system generates an optical hash of the received light using the random key, converts the generated optical hash to a digital optical hash, and uploads the digital optical hash to the authentication server. When the authentication server receives the upload, it verifies whether the time of the upload is within a certain threshold time from the sending of the random key and whether the digital optical hash was generated from the same light as the plenoptic data.

Murialdo, Maxwell R.↗
DOE OSTI2024

Adoption of a token-based authentication model for the CMS Submission Infrastructure

The CMS Submission Infrastructure (SI) is the main computing resource provisioning system for CMS workloads. A number of HTCondor pools are employed to manage this infrastructure, which aggregates geographically distributed resources from the WLCG and other providers. Historically, the model of authentication among the diverse components of this infrastructure has relied on the Grid Security Infrastructure (GSI), based on identities and X509 certificates. In contrast, commonly used modern authentication standards are based on capabilities and tokens. The WLCG has identified this trend and aims at a transparent replacement of GSI for all its workload management, data transfer and storage access operations, to be completed during the current LHC Run 3. As part of this effort, and within the context of CMS computing, the Submission Infrastructure group is in the process of phasing out the GSI part of its authentication layers, in favor of IDTokens and Scitokens. The use of tokens is already well integrated into the HTCondor Software Suite, which has allowed us to fully migrate the authentication between internal components of SI. Additionally, recent versions of the HTCondor-CE support tokens as well, enabling CMS resource requests to Grid sites employing this CE technology to be granted by means of token exchange. After a rollout campaign to sites, successfully completed by the third quarter of 2022, the totality of HTCondor CEs in use by CMS are already receiving Scitoken-based pilot jobs. On the ARC CE side, a parallel campaign was launched to foster the adoption of the REST interface at CMS sites (required to enable token-based job submission via HTCondor-G), which is nearing completion as well. In this contribution, the newly adopted authentication model will be described. We will then report on the migration status and final steps towards complete GSI phase out in the CMS SI.

Pérez-Calero Yzquierdo, Antonio↗
DOE OSTI2019

Policy-managed physical access authentication

Systems and methods are disclosed that provide for physical access management of an access-controlled area of a distributed site of an electric power delivery system using one or more one or more articulated access control policies. In some embodiments, to authenticate rights to access an access-controlled area, a first user may provide an associated access control system with credentials satisfying first authentication requirements based on an applicable policy. In connection with subsequent access authentication requests, the access control system may accept credentials satisfying second authentication requirements that may be different than the first authentication requirements. In this manner, access control requirements to the access-controlled area may be managed based on an associated articulated policy.

Masters, George W.↗
DOE OSTI2022

Precoder Design for Physical-Layer Security and Authentication in Massive MIMO UAV Communications

Supporting reliable and seamless wireless connectivity for unmanned aerial vehicles (UAVs) has recently become a critical requirement to enable various different use cases of UAVs. Due to their widespread deployment footprint, cellular networks can support beyond visual line of sight (BVLOS) communications for UAVs. In this paper, we consider cellular connected UAVs (C-UAVs) that are served by massive multiple input-multiple-output (MIMO) links to extend coverage range, while also improving physical layer security and authentication. Here, we consider Rician channel and propose a novel linear precoder design for transmitting data and artificial noise (AN). We derive the closed-form expression of the ergodic secrecy rate of CUAVs for both conventional and proposed precoder designs. In addition, we obtain the optimal power splitting factor that divides the power between data and AN by asymptotic analysis. Then, we apply the proposed precoder design in the fingerprint embedding authentication framework, where the goal is to minimize the probability of detection of the authentication tag at an eavesdropper. In simulation results, we show the superiority of the proposed precoder in both secrecy rate and the authentication probability considering moderate and large number of antenna massive MIMO scenarios.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2019

Network-based Classification of Authentication Attempts using Machine Learning

Network security operators are challenged with protecting an increasing number of clients from authentication-based attacks such as password guessing. Host-based defenses help in preventing such attacks but are difficult to manage and monitor at scale. These challenges open the door for network-based defenses. In this work, we introduce AuthML. AuthML performs protocol-agnostic authentication modeling to detect successful and unsuccessful authentication attempts at the network level. Using machine learning (ML), AuthML operates directly on network communication to determine the outcome of authentication attempts in real time. To show AuthML’s efficacy, we validate our approach on multiple deployment scenarios. AuthML achieves an accuracy of 99.9% examining 29,015 new flows in this operational phase, demonstrating that we can achieve similar performance in real time to state-of-the-art techniques without manual protocol analysis.

Taylor, Curtis↗
DOE OSTI2023

Advanced Reactor Control Systems Authentication Methods and Recommendations

In the dynamic landscape of Operational Technology (OT), and specifically the emerging landscape for Advanced Reactors, the establishment of trust between digital assets emerges as a challenge for cybersecurity modernization. This report reviews existing approaches to authentication in Enterprise environments, and proposed methods for authentication in OT, and analyzes each for its applicability to future Advanced Reactor digital networks. Principles of authentication ranging from underlying cryptographic mechanisms to trust authorities are evaluated through the lens of OT. These facets emphasize the importance of mutual authentication in real-time environments, enabling a paradigm shift from the current approach of strong boundaries to a more malleable network that allows for flexible operation. This work finds that there is a need for evaluation and decision making by industry stakeholders, but current technologies and approaches can be adapted to fit needs and risk tolerances.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2018

Multi-factor authentication using quantum communication

Multi-factor authentication using quantum communication ("QC") includes stages for enrollment and identification. For example, a user enrolls for multi-factor authentication that uses QC with a trusted authority. The trusted authority transmits device factor information associated with a user device (such as a hash function) and user factor information associated with the user (such as an encrypted version of a user password). The user device receives and stores the device factor information and user factor information. For multi-factor authentication that uses QC, the user device retrieves its stored device factor information and user factor information, then transmits the user factor information to the trusted authority, which also retrieves its stored device factor information. The user device and trusted authority use the device factor information and user factor information (more specifically, information such as a user password that is the basis of the user factor information) in multi-factor authentication that uses QC.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2020

System for authenticating an additively manufactured object

A method for authenticating an additively manufactured (AM) object is disclosed herein. A computing device obtains a measurement that is indicative of a stochastic distribution of dopant incorporated into the AM object. The computing device generates authentication data for the AM object based upon the measurement, and authenticates the AM object based upon the authentication data.

36 MATERIALS SCIENCE↗
DOE OSTI2021

Data source authentication of synchrophasor measurement devices based on 1D-CNN and GRU

Synchrophasor measurement devices (SMDs) have been widely deployed to support real-time monitoring and control of power systems. In the meantime, data spoofing has emerged in recent years. Therefore, it is of great importance to study data authentication algorithms for detecting and defending the data spoofing effectively. Here, a one-dimensional convolutional neural network (1D-CNN) is utilized to extract temporal signatures hidden in frequency, voltage angle and amplitude data; then the gated recurrent unit (GRU) employs these temporal signatures for data source authentication. In case studies, the performances of different algorithms are tested in large-scale power systems with numerous SMDs for the first time, and comparisons among different algorithms show that the proposed algorithm can achieve a higher accuracy of data source authentication with a shorter time window.

47 OTHER INSTRUMENTATION↗
DOE OSTI2022

PUF-Based Two-Factor Authentication Protocol for Securing the Power Grid Against Insider Threat

Recent advances in smart grid technologies have enabled additional distributed control paradigms that allow more efficient and reliable operation. However, this creates new security concerns for the grid, such as attackers using spoofed grid control devices to generate false measurements. This paper introduces a two-factor authentication protocol leveraging standard public-key cryptography as one authentication factor and a hardware-based fingerprint, known as a Physical Unclonable Function, as a second authentication factor. This protocol incurs a small overhead and prevents cyber-attacks even when an adversary is able to compromise the cryptographic keys stored in the non-volatile memory of an intelligent control device.

42 ENGINEERING↗