Search NASA⌕ Search

SEARCH · Search NASA

Results for “encryption”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

End-to-End Encryption for Cyber-Physical Systems Using Fully Homomorphic Encryption

Cyber-physical systems require reliable, safe, and secure control of critical infrastructure, combining computational and networking capabilities, which heighten the risk of cyber attacks. These attacks can disrupt the physical process, causing unforeseen consequences. One solution is the use of fully homomorphic encryption (FHE) to protect the control loop, allowing for secure computations and communications without compromising signal and control system privacy. The challenge with FHE, however, is its requirement for inputs to be integers. This presentation introduces a modified Learning With Errors (LWE) FHE approach that encodes control system dynamics and signals into integers. Our proposed scheme leverages a generalized LWE encoding function and modifies the Gentry-Sahai-Waters gadget decomposition tool to encrypt the control system. Using the modified LWE scheme, we formalize a fully encrypted control system, supported by simulated results.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Fully Homomorphic Encryption

This code implements a Fully Homomorphic Encryption (FHE) system, enabling secure computation on encrypted data without requiring decryption. It supports encryption, decryption, and homomorphic operations like matrix multiplication and addition. This code is adaptable for integrating FHE into linear-time invariant (LTI) systems, including digital control and filtering. With proper configuration from subject matter expertise, encrypted system parameters and signals can be manipulated to perform tasks like state updates, output calculations, and convolution in the encrypted domain. By preserving the structure of LTI systems while ensuring privacy, the framework facilitates secure applications in areas such as autonomous systems, signal processing, and industrial automation. The code initializes the encryption system using parameters provided in the env dictionary. These parameters include the ciphertext modulus, key dimension, plaintext fixed-point scaling factor, and noise bound. During initialization, a secret key is generated, which is essential for encrypting and decrypting data securely. The modular design allows users to tailor these parameters to specific use cases or security requirements. The code implements multiple cryptographic schemes. The learning with errors (LWE) encryption method encodes cleartext message to their plaintext fixed-point representation then encrypted into ciphertext space with additive noise. This noise ensures the security of the scheme, relying on the computational hardness of the LWE problem. The code also includes the Gentry-Sahai-Waters (GSW) scheme based off the LWE problem. Homomorphic matrix multiplication is performed between the LWE and GSW to encrypted data. This is achieved using a decomposition function on the LWE ciphertext during the multiplication operation. For higher-dimensional data, the code includes a method to encrypt entire matrices (GSWMat) using GSW encryption. These encrypted matrices can then be used for homomorphic matrix multiplications (MatMult). The decryption function uses the secret key to recover the original plaintext, removing the added noise and scaling that was originally applied during encryption.

Lois, Roberts [Idaho National Laboratory (INL), Id↗
DOE OSTI2019

Communication device for implementing selective encryption in a software defined network

The present disclosure pertains to systems and methods for selectively encrypting data flows within a software defined network (SDN). In one embodiment, a communication device may be configured to receive a plurality of unencrypted data packets. The communication device may receive from an SDN controller a criterion used to identify at least one of the unencrypted data flows to be encrypted. Based on the criterion, an encryption subsystem may generate an encrypted data flow the unencrypted data packets based on an encryption key. In some embodiments, the encryption system may parse the packets and encrypt the data payloads without encrypting the routing information associated with the packet. In other embodiments, the encryption subsystem may be configured to encapsulate and encrypt the entire unencrypted data packet. In some embodiments, the encryption subsystem may further be configured to authenticate a sending device and/or to verify the integrity of a message.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2020

Communication device for implementing selective encryption in a software defined network

The present disclosure pertains to systems and methods for selectively encrypting data flows within a software defined network (SDN). In one embodiment, a communication device may be configured to receive a plurality of unencrypted data packets. The communication device may receive from an SDN controller a criterion used to identify at least one of the unencrypted data flows to be encrypted. Based on the criterion, an encryption subsystem may generate an encrypted data flow the unencrypted data packets based on an encryption key. In some embodiments, the encryption system may parse the packets and encrypt the data payloads without encrypting the routing information associated with the packet. In other embodiments, the encryption subsystem may be configured to encapsulate and encrypt the entire unencrypted data packet. In some embodiments, the encryption subsystem may further be configured to authenticate a sending device and/or to verify the integrity of a message.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Encrypted model predictive control design for security to cyberattacks

Abstract In recent years, cyber‐security of networked control systems has become crucial, as these systems are vulnerable to targeted cyberattacks that compromise the stability, integrity, and safety of these systems. In this work, secure and private communication links are established between sensor–controller and controller–actuator elements using semi‐homomorphic encryption to ensure cyber‐security in model predictive control (MPC) of nonlinear systems. Specifically, Paillier cryptosystem is implemented for encryption‐decryption operations in the communication links. Cryptosystems, in general, work on a subset of integers. As a direct consequence of this nature of encryption algorithms, quantization errors arise in the closed‐loop MPC of nonlinear systems. Thus, the closed‐loop encrypted MPC is designed with a certain degree of robustness to the quantization errors. Furthermore, the trade‐off between the accuracy of the encrypted MPC and the computational cost is discussed. Finally, two chemical process examples are employed to demonstrate the implementation of the proposed encrypted MPC design.

Suryavanshi, Atharva↗
DOE OSTI2021

A quantum encryption design featuring confusion, diffusion, and mode of operation

Abstract Quantum cryptography—the application of quantum information processing and quantum computing techniques to cryptography has been extensively investigated. Two major directions of quantum cryptography are quantum key distribution (QKD) and quantum encryption, with the former focusing on secure key distribution and the latter focusing on encryption using quantum algorithms. In contrast to the success of the QKD, the development of quantum encryption algorithms is limited to designs of mostly one-time pads (OTP) that are unsuitable for most communication needs. In this work we propose a non-OTP quantum encryption design utilizing a quantum state creation process to encrypt messages. As essentially a non-OTP quantum block cipher the method stands out against existing methods with the following features: 1. complex key-ciphertext relation (i.e. confusion) and complex plaintext-ciphertext relation (i.e. diffusion); 2. mode of operation design for practical encryption on multiple blocks. These features provide key reusability and protection against eavesdropping and standard cryptanalytic attacks.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Securing 3D NAND Without Density Loss via In-Situ Encryption Using a Single Transistor XOR Cell

In this article, we push lightweight XOR-based in-situ encryption to extreme density by proposing a singletransistor XOR memory cell and applying it to 3D NAND, enabling secure data storage without density loss. Using a ferroelectric field-effect transistor (FeFET) as an example technology, we demonstrate that: i) a single-transistor memory can realize the XOR function by exploiting the ability to charge the source and drain separately and control current flow direction, eliminating the need for conventional encrypted cells that rely on complementary devices; ii) with a XOR-based cipher, encryption and decryption can be mapped to in-situ array operations, where ciphertext is stored as the threshold voltage (VTH) states of FeFETs in a NAND string, and decryption is achieved through read operations using key-dependent complementary source/drain bias; iii) the proposed technique is scalable to multi-level cell (MLC) storage by encrypting and decrypting data bit by bit; iv) using an integrated NAND FeFET array, we experimentally demonstrate encryption and decryption operations for both single-level cell (SLC) and MLC storage; v) systemlevel benchmarking shows that the proposed technique achieves 48× and 278× improvements in encryption and decryption throughput, respectively, compared to AES.

36 MATERIALS SCIENCE↗
DOE OSTI2020

Encryption of Signal Pulses to Replace Tamper-indicating Conduit

In order to verify signal integrity and point of origin for TTL pulse data used in IAEA systems, and to avoid the need for expensive tamper-indicating conduit or electronic techniques, we propose the development of a signal pulse signing and encryption in-line device. In measurement applications in which the data acquisition electronics is separate from the enclosed, sealed detector, tamper-indicating techniques are required to protect raw TTL pulse streams between the detector and the data acquisition module, i.e UMSR. The goal of this proposed project is to design a rad-tolerant transmitter that would mount inside the sealed detector system and a receiver in the sealed electronics cabinet with the data acquisition instrument. This transmitter/receiver pair would digitally sign and encrypt the pulse stream data at the detector then transmit the data to the sealed cabinet where the receiver would decrypt the data and reproduce the original pulse stream. Existing tamper indicating techniques, such as LiveWire’s spread spectrum time domain reflectometry rely on detecting physical changes to the wiring system and can be blind to fast coupling of micro-second wide pulses. Digital signing and encryption techniques such as the Sandia Laboratories Enhanced Data Authentication System (EDAS) are capable of encrypting communications data, i.e. RS-232, but are not capable reproducing a critical time correlated data streams. Recent NA-241 Safeguards Technology supported developments have reduced the need for special conduit to transmit data via Ethernet by incorporating the IAEA RAINSTORM data encryption and authentication protocol, a tamper indicator is still required to protect raw pulse data from detectors to the acquisition electronics. Encrypting pulse data is especially complicated for radiation detection instruments due to the time correlation data analysis that is performed on this data stream. Any corruption in the timing information will produce errors in measurement values.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2019

Authentication Protocol for ICS without Encryption

Industrial control systems (ICS) describes the different types of control systems and associated instrumentation, which includes the devices, systems, networks, and controls used to operate and/or automate industrial processes. Depending on the industry, each ICS functions differently and are built to electronically manage tasks efficiently. Historically, industrial plants have included networking, and changes have been made over time without consideration for security. Many ICS devices currently have inadequate security features. Adding encryption in ICS is undesirable because many of the new detection method involves deep packet inspection. Therefore, we propose to develop a method of providing authentication between devices without encrypting the data. This testbed design will allow rapid development and experimentation with Cyber Physical Systems. Modbus connects to a supervisory computer with a Remote Terminal Unit (RTU) in Supervisory Control and Data Acquisition (SCADA) systems. Our project seeks to enhance security in the ICS environment by adding device authentication to the lower levels of the plant floor. This approach was selected as it allows verification of the sender of data from level 1/level 0 devices up to supervisory systems. This addition is desirable as it adds enhanced verification to the integrity of system data without obscuring (via encryption) the data being transmitted across the network. This is important because many ICS systems are real time critical (decryption adds to latency) and many other good security options require deep packet inspection (which encryption completely defeats). To accomplish this, a proof of concept of adding an authentication scheme was designed and will be tested with a common ICS protocol. The setup includes a single serial cable connecting the serial ports on two devices, a Master and a Minion. Authentication will occur in the following methods: - Data layer involving Transport Layer Security/Secure Socket Layer (TLS/SSL); - TCP/IP route implementation; - Key exchange algorithm; - Raspberry Pi programming for authentication. A portion of the setup includes adding Raspberry Pi into the system as the device is handling the authentication for the network traffic. Modbus is the chosen ICS protocol. It is used to transmit signals from instrumentation and control devices back to a main controller or data gathering system. Typically, the device identity is assumed but not verified. For verifying device identity, we constructed a digital signature architecture with TLS. A novel adaptation of this is to use only the digital signature that is provided and not the encryption capability. This allows ICS traffic to flow unobscured while still providing verification for the integrity of the data. Verification of this process will involve adding additional I/O level network devices with spoofed IP addresses and detecting the authenticated versus unauthenticated traffic. Our TLS implementation will have encryption disabled but should still allow for digital signing of data. This will enable our system to distinguish between real end devices and spoofed end devices. This experiment is presently building the test setup. It is focusing on a small setting to identify authenticated and unauthenticated devices on the network. This should allow for scaling to a larger network size after the initial proof of concept. One concern with this scheme is a certificate deployment has a large scale key management. Network size will thus increase the key management task for security. In addition, we believe that further research should be done on exploring the use of this method to defeat man-in-the-middle attacks.

42 ENGINEERING↗
DOE OSTI2019

Ultrafast optical message encryption–decryption system using semiconductor optical amplifier based XOR logic gate

Encryption of information is required to secure data transmitted in optical networks. In this communication, authors propose simple and novel scheme for all-optical encryption–decryption at 120 Gb/s. Encryption–decryption system is based on XOR logic designed using semiconductor optical amplifier (SOA) based Mach–Zehnder interferometers. SOA model is presented theoretically from the stand point of high-speed application and implemented in encryption decryption setups for simulation. Extinction ratio for encrypted and decrypted signal is obtained as 10.5 dB and 8.30 dB respectively with satisfactory quality factor. The system has simple, compact architecture and easily integrable with other photonic devices.

71 CLASSICAL AND QUANTUM MECHANICS, GENERAL PHYSIC↗
DOE OSTI2019

Image encryption and watermarking combined dynamic chaotic hopping pattern with double random phase encoding DRPE

In modern civilization information, security is a crucial problem. Image encryption and watermarking can effectively protect information from unauthorized access. This paper introduces a new vigorous symmetric optical image encryption and watermarking technique. This technique depends on a novel dynamic delay chaotic hopping pattern (DDCHP) combined with double random phase encoding (DRPE). To get a robust watermark image, the plain image is first watermarked with a binary secret message using a new chaotic hopping pattern (CHP) and then encrypted using a DRPE system that is controlled by double random independent keys generated with double DDCHP. In this symmetric cryptosystem, three different chaotic maps are used to enlarge the key space of the proposed cryptosystem against brute-force attack and overcome the linearity and vulnerable of the classical DRPE. The system keys are hypersensitive and their initial parameters are selected carefully. Security scrutiny proves the efficiency of the suggested cryptosystem. Therefore, the obtained simulation results prove that the cryptosystem is robust enough against the known attacks, such as statistical attack (uniform histograms of different encrypted images, correlation coefficients between the plain and the encrypted image is as low as 5.46 × 10{sup −6}), differential attack (99.99% NPCR and 38.6% UACI), brute force attack (large enough key space), and entropy attack. Moreover, the robustness of the watermark (secret message) is proved due to the solidity of CHP. The proposed approach can be used in different implementations like secure military communications, e-finance, e-healthcare, authenticated multimedia broadcasting, etc.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Barriers and Alternatives to Encryption in Critical Nuclear Systems

Over the past decade, cybersecurity researchers have released multiple studies highlighting the insecure nature of I&C system communication protocols. In response, standards bodies have addressed the issue by adding the ability to encrypt communications to some protocols in some cases, while control system engineers have argued that encryption within these kinds of high consequence systems is in fact dangerous. Certainly, control system information between systems should be protected. But encrypting the information may not be the best way to do so. In fact, while in IT systems vendors are concerned with confidentiality, integrity, and availability, frequently in that order, in OT systems engineers are much more concerned with availability and integrity that confidentiality. In this paper, we will counter specific arguments against encrypting control system traffic, and present potential alternatives to encryption that support nuclear OT system needs more strongly that commodity IT system needs while still providing robust integrity and availability guarantees.

42 ENGINEERING↗
DOE OSTI2023

Secure eco-routing with databases under homomorphic encryption

A method for generating energy-optimized travel routes for a motor vehicle includes one or more of the following: receiving an origin destination (OD) of the motor vehicle and an encrypted energy consumption database of the motor vehicle; generating N candidate routes for the OD; evaluating encrypted energy consumption over a route using an encrypted energy consumption database; applying at least one of homomorphic addition function or homomorphic multiplication function to the encrypted energy consumption data; and returning N candidate routes and their encrypted energy consumption to a client.

Hegde, Bharatkumar↗
DOE OSTI2024

Privacy-Preserving Artificial Intelligence on Edge Devices: A Homomorphic Encryption Approach

Recent advancements in privacy-preserving artificial intelligence (AI) have paved the way for enhanced privacy in computational processes. A standing challenge, however, is the robust privacy preservation in AI algorithms, especially when integrated into edge devices and Internet-of-Thing (IoT) infrastructures. Most prevailing solutions have adopted traditional encryption methods which, though secure, often introduce significant overhead and potential dips in accuracy. In this study, we put forth an innovative approach, utilizing the CKKS encryption scheme, aiming to harmoniously balance computational efficiency with stringent data privacy. By harnessing the capabilities of Full Homomorphic Encryption (FHE) under the CKKS scheme, we ensure the preservation of privacy, successfully curbing the inherent noise traditionally linked with accuracy reductions in similar encryption-oriented solutions. Through comprehensive experiments, our approach showcased its potential as a strong contender for privacy preservation, demonstrating commendable performance across all tests, affirming that FHE is indeed viable for devices with constrained computational power and energy resources.

Khan, Muhammad Jahanzeb↗
DOE OSTI2019

The Modern Wild West: The Rough-and-Tumble World of Encryption

Encryption is a big deal, but it hasn’t always been so. In the early 90s, it was solidly in the realm of governments, corporations, and what the general public might consider paranoid tech geeks. Encryption was used to protect documents containing classified information, sensitive financial data, trade secrets, or emails between a few people who met at a key-signing party. Today, people have been educated a bit more, and most understand the privacy implications of not using some form of encryption.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Homomorphic Encryption for Electrical Metering Aggregation: Protecting the Privacy of Building Tenants

Electrical meters are devices that measure consumer electricity usage. The data collected by these meters is necessary for utility billing and electrical grid management but can also be used to assess the environmental impact of buildings. Prior research has found that unprotected metering data could potentially be used to infer some information about the behaviors of building tenants by detecting changes in electricity usage. For example, a period of low electricity usage could suggest that the tenants are not in the building. As smart metering becomes more common, there is a growing need for data privacy protections for metering data that do not negatively impact the quality and availability of data used for energy management and billing applications. To identify potential solutions, we developed a Python-based data aggregation platform to analyze the potential efficacy of privacy-enhancing technologies for energy metering applications. This platform aggregates groups of metering sites into virtual buildings, which could potentially detach changes in electrical activity from individual tenants, making it more difficult to track the activity of a specific tenant. To further protect data during analysis, this project utilizes homomorphic encryption as part of its initial approach. Homomorphic encryption offers a means of protecting energy consumption data while permitting mathematical operations to be performed without the need to know the data contents. This allows for data to be processed into usable statistics without revealing energy consumption information. A series of homomorphic encryption libraries were evaluated to determine their applicability and limitations in the context of metering data. The use of these techniques may help to reassure consumers and encourage further adoption of smart grid infrastructure.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
DOE OSTI2025

Encrypted Control Using Modified Learning With Errors-based Schemes

Cyber-physical systems (CPSs) require reliable, safe, and secure control of critical infrastructure, combining computational and networking capabilities, which heighten the risk of cyber attacks. These attacks can disrupt the physical process, causing unforeseen consequences. One solution is the use of fully homomorphic encryption (FHE) to protect the control loop, allowing for secure computations and communications without compromising signal and control system privacy. The challenge with FHE, however, is its requirement for inputs to be integers. This paper introduces a modified Learning With Errors (LWE) FHE approach that encodes control system dynamics and signals into integers. Our proposed scheme leverages a generalized LWE encoding function and modifies the Gentry-Sahai-Waters (GSW) gadget decomposition tool to encrypt the control system. Using the modified LWE scheme, we formalize a fully encrypted control system, supported by simulated results.

42 - ENGINEERING↗