Search NASA⌕ Search

SEARCH · Search NASA

Results for “hardware reverse engineering”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2013

Non-Destructive State Machine Reverse Engineering

Most of the integrated circuits (ICs) that are in electronic systems today are based on state machines. We are taking advantage of this to develop a hardware reverse engineering method that discovers the IC’s underlying state machine, rather than its transistors and gates. While there are other methods for destructively reverse engineering ICs or for non-destructively characterizing ICs, our method offers a fast and accurate analysis while remaining non-destructive. To do this, we present an intelligent brute-force method of exploring the logic of the IC using only the input and outputs designed into the IC - the I/O pins. From this exploration, we can apply a folding algorithm to discover the designed state machine.

counterfeit↗
DOE OSTI2022

Hardware functional obfuscation with ferroelectric active interconnects

Existing circuit camouflaging techniques to prevent reverse engineering increase circuit-complexity with significant area, energy, and delay penalty. In this paper, we propose an efficient hardware encryption technique with minimal complexity and overheads based on ferroelectric field-effect transistor (FeFET) active interconnects. By utilizing the threshold voltage programmability of the FeFETs, run-time reconfigurable inverter-buffer logic, utilizing two FeFETs and an inverter, is enabled. Judicious placement of the proposed logic makes it act as a hardware encryption key and enable encoding and decoding of the functional output without affecting the critical path timing delay. Additionally, a peripheral programming scheme for reconfigurable logic by reusing the existing scan chain logic is proposed, obviating the need for specialized programming logic and circuitry for keybit distribution. Our analysis shows an average encryption probability of 97.43% with an increase of 2.24%/ 3.67% delay for the most critical path/ sum of 100 critical paths delay for ISCAS85 benchmarks.

42 ENGINEERING↗
DOE OSTI2022

RanCompute: Computational Security in Embedded Devices via Random Input and Output Encodings

An embedded device in an insecure environment is subject to additional security risk through capture and reverse-engineering by a capable adversary. If this device contains a microchip performing sensitive computations, capture of the chip may leak functionality to an adversary. In this paper we propose a novel method in which we randomly encode the input operands and the outputs of a computation, thus not revealing the arithmetic operations being performed. The operations are sequenced in a graph representing the overall application. Once the initialization values are overwritten and lost, the results of these computations are indecipherable by the device performing the calculations as well as by any adversary. The result is transmitted back to a secure server which has stored the initialization values and so can decode the results which appear random to the adversary.

Embedded computing↗
DOE OSTI2026

Assessing Energy Infrastructure Devices for Vulnerabilities

Industrial control systems prove to be vital to the health and security of the nation in our critical infrastructure. Critical infrastructure includes the most foundational systems to support modern civilization which includes water and wastewater systems, communications, and the electricity we use to name a few sectors. However, these devices' overall composition remains largely unknown and are untested from a cyber security perspective. As part of the Cyber Testing for Resilient Industrial Control Systems (CyTRICS) program, I analyzed one such energy infrastructure device to better understand how it functions, what hardware and software components are present within it, and assess it for security vulnerabilities. To achieve this, I reverse engineered binary files using Ghidra to understand system functionality and learned more about how to collaborate with other researchers on a shared Ghidra project. I learned more about how web sockets function and how to interact with them through Python to test if they are secure or not. This work led me to assess possible vulnerabilities in this device and provide a better understanding of its composition and function, which are essential to INL's mission of securing our nation's energy infrastructure.

99 - GENERAL AND MISCELLANEOUS↗
DOE OSTI2022

Memory forensic analysis of a programmable logic controller in industrial control systems

In industrial control systems (ICS), programmable logic controllers (PLCs) are used to automate physical processes such as nuclear plants and power grid stations, and are often subject to cyber attacks. As in conventional IT domain, the memory analysis of the PLCs can help answer important forensic questions about the attack, such as the presence of malicious firmware, injection of modified control logic (the program running on the PLC), and manipulation of I/O devices (e.g., sensors and actuators). Unlike conventional IT domain, PLCs have heterogeneous hardware architecture, proprietary firmware and control software, making it challenging to employ a unified framework for their memory forensics. For merely extracting artifacts of forensic importance, reverse-engineering the firmware is a tedious task, and the effort needs to be repeated for every PLC model. As a community, a step-wise approach to tackle this challenge is to analyze the memory of specific PLCs, and subsequently find a generic framework applicable to all PLCs. Our work is a step forward in this direction. By following a methodology that focuses on the functional layer of PLCs instead of reverse engineering the firmware, we analyze the digital forensic artifacts available in a common PLC, Allen-Bradley ControlLogix 1756-L61. Before diving into the memory dump, we analyze the PLC control software to create a list of important artifacts that are sure to exist in the PLC memory dump. The approach employs a setup where PLC control software RSLogix-5000 is connected to the PLC, and the memory dump can be obtained as and when needed. We create test cases that sequentially highlight each category of artifacts, followed by an examination of the resultant impact on memory. After attaining the listed artifacts, we employ conventional string and known data searches to extract interesting information present in this PLC's memory. The memory analysis profile, presented as a Python library and shared with the community, can help a forensic investigator to readily extract forensic artifacts from the same model's controller. The adopted approach may help researchers in creating memory profile of other PLCs, and ultimately formulating a generic PLC memory analysis framework.

Rais, Muhammad Haris↗
DOE OSTI2024

Ultrasound Interim cyber-physical research evaluation

Recent events have presented Medical Practitioners with concerns about safety and privacy implications associated with GE’s VScan MIot Ultrasound Device. Concerns relate to the devices potential risk to broadcast location data that can pose serious risks to device users and patients. This report was commission in collaboration with Augusta University to determine if device concerns pose real threat to operators and patients. In effort to ensure all potential threat vectors are targeted, the initial step was to analyze the supply chain. Here the devices are CT scanned to look for any hardware anomalies that could present threat vectors to users of these devices. (See SRNL-STI-2024-00225 for detailed analysis). No anomalies were found associated with the hardware utilized within the GE VScan Air.

42 ENGINEERING↗
DOE OSTI2017

Certification of RadICS FPGA-based platform under US NRC requirements - 386

The paper discusses approach, applicable to certify digital instrumentation and control (I and C) platform under US Nuclear Regulatory Commission (NRC) requirements. Currently, Radics LLC is certifying its Field-Programmable Gate Array (FPGA)-based RadICS Platform using Platform-based test specimen. The Platform has been recently certified under IEC 61508 to meet Safety Integrity Level (SIL) 3 requirements. Up to now Radics LLC has developed a number of FPGA-based I and C applications based on RadICS Platform. Those applications include applications based on customer's specification and reverse engineering applications (Fit, Form and Function reproduction of existing equipment). The life cycles of applications include independent verification and validation of FPGA-based I and C systems/components, Commercial Grade Dedication of components for FPGA-based I and C systems, turnkey implementation of I and C project, supply of hardware, engineering tools and application design process. The paper also describes in details certification approach, which is based on Digital I and C-ISG- 06 and includes the following stages: general agreement with the US NRC, Topical Report submittal, timely responses and successful audits, and timely issuance of approved Topical Report. Such approach is supported by 10 CFR 50 Appendix B Quality Management System, which is also discussed in the paper. In addition, an overview of RadICS Platform Topical Report is presented, including its overview and structure, certification scope and obligatory appendixes. (authors)

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2021

CAN-D: A Modular Four-Step Pipeline for Comprehensively Decoding Controller Area Network Data

Controller area networks (CANs) are a broadcast protocol for real-time communication of critical vehicle subsystems. Original equipment manufacturers of passenger vehicles hold secret their mappings of CAN data to vehicle signals, and these definitions vary according to make, model, and year. Without these mappings, the wealth of real-time vehicle information hidden in the CAN packets is uninterpretable, severely impeding vehicle-related research, including CAN cybersecurity and privacy studies, aftermarket tuning, efficiency and performance monitoring, and fault diagnosis to name a few. Guided by the four-part CAN signal definition, we present CAN-D (CAN-Decoder), a modular, four-step pipeline for identifying each signal's boundaries (start bit and length), endianness (byte ordering), signedness (bit-to-integer encoding), and by leveraging diagnostic standards, augmenting a subset of the extracted signals with meaningful, physical interpretation. En route to CAN-D, we provide a comprehensive review of the CAN signal reverse engineering research. All previous methods ignore endianness and signedness, rendering them incapable of decoding many standard CAN signal definitions. Incorporating endianness grows the search space from 128 to 4.72E21 signal tokenizations and introduces a web of changing dependencies. In response, we formulate, formally analyze, and provide an efficient solution to an optimization problem, allowing identification of the optimal set of signal boundaries and byte orderings. In addition, we provide two novel, state-of-the-art signal boundary classifiers—both of which are superior to previous approaches in precision and recall in three different test scenarios—and the first signedness classification algorithm, which exhibits a $>$ 97% F-score. Altogether, CAN-D is the only solution with the potential to extract any CAN signal that is also the state of the art. In evaluation on 10 vehicles of different makes, CAN-D's average $\ell ^1$ error is five times better (81% less) than all previous methods and exhibits lower average error, even when considering only signals that meet prior methods’ assumptions. Finally, CAN-D is implemented in lightweight hardware, allowing for an on-board diagnostic (OBD-II) plugin for real-time in-vehicle CAN decoding.

42 ENGINEERING↗
DOE OSTI2022

Computer Science Research Needs for Parallel Discrete Event Simulation (PDES)

Historically, scientific computing efforts have demonstrated the clear need for, and effective use of, supercomputing with traditional time-stepped simulations. Nevertheless, there are several areas in the mission spaces of the U.S. Department of Energy and other agencies waiting to tap advanced computing research using a different, discrete event style of modeling, simulation, and analysis. These span a wide spectrum of applications including energy grid resilience, urban planning and policy, transportation science, building technologies, emergency response and planning, environmental impact analysis, computational epidemiology, Internet communications, cyber security, and cyber-physical systems, to name only a few. Even within traditional scientific applications, the role of discrete event modes of execution is increasing in the form of new event-based mathematical solvers such as quantized state integration methods and discrete-continuous hybrid system solvers. Co-design of advanced supercomputing hardware systems is another area that exploits discrete event simulation at its core for effective analyses. Complex systems, entity behaviors and interconnections play a significant role in all these applications, which are mapped to large-scale models with discrete event formulations. To make advancements in all the aforementioned scientific areas, many technical aspects need to be more thoroughly studied and deeply understood in parallel discrete event simulation (PDES). The unique dynamics inherent in a discrete event modeling approach, by their very nature, intersect and influence the entire stack of the computing system, including (a) the unique nature of the instruction sets exercised in PDES workloads without a predominance of high-precision floating point operations, (b) virtual time-constrained multi-threaded execution of many logical processes per processor, (c) extremely variable and difficult to predict network traffic characteristics, (d) interfaces and inter-dependencies with machine learning and artificial intelligence codes at higher software layers, and (e) highly challenging load balancing needs, especially in effectively accounting for accelerated/extremely heterogeneous computing in current and future high-performance computing systems. Efficient and accurate parallel execution of PDES workloads is also dominated by challenges in dealing with their asynchronous concurrency fundamentally present at the model level. Conservative synchronization, optimistic/speculative synchronization, and their hybrid schemes open new questions in fundamental computer science with respect to reversibility of computation and prediction (lookahead) of behaviors inherent within model codes. On the implementation front, there are relatively few scalable, general-purpose parallel discrete event simulators in the world, and even fewer have been studied on emerging hardware platforms. To enable scientific advances using PDES, the research needs in computer science must also be pursued and met in the intersection of the algorithmic and hardware-aware aspects of scalable PDES engines. This report is aimed at capturing a computer science-oriented view of this important area of research in PDES, presenting a sample of important applications with their inherent discrete event technology elements. Needs are outlined in core areas of parallel discrete event research as well as cross-cutting directions in computer science research that positively impact scientific advancements across several important application areas. A selection of priority research opportunities in advanced computing for PDES is identified to serve as reference for key research topics and their order of importance for scientific advancements.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Options for Upgrading Low-Voltage Spot Network Protection to Increase DER Interconnection Capacity

Existing standards and policies for interconnecting distributed energy resources (DERs) into low voltage spot networks severely limits the amount of DER installed on those networks to avoid negative impacts on protection systems. This report investigates options for upgrading the protection systems of spot networks to allow for additional DER installations beyond the normal limits (i.e., no reverse power flows allowed onto the MV system). Eight potential upgrade options are discussed that span various methods for new network protector algorithms, hardware upgrades, and the addition of communication. Each method has tradeoffs in terms of accuracy of detecting faults, requirements to upgrade equipment in the spot networks, need for communication, and sensitivity to false trips—all of which are explored in this report.

42 ENGINEERING↗
DOE OSTI2013

Final Report on Development of Optimized Field-Reversed Configuration Plasma Formation Techniques for Magnetized Target Fusion

The University of New Mexico (UNM) proposed a collaboration with Los Alamos National Laboratory (LANL) to develop and test methods for improved formation of field-reversed configuration (FRC) plasmas relevant to magnetized target fusion (MTF) energy research. MTF is an innovative approach for a relatively fast and cheap path to the production of fusion energy that utilizes magnetic confinement to assist in the compression of a hot plasma to thermonuclear conditions by an external driver. LANL is currently pursing demonstration of the MTF concept via compression of an FRC plasma by a metal liner z-pinch in conjunction with the Air Force Research Laboratory in Albuquerque, NM. A key physics issue for the FRC's ultimate success as an MTF target lies in the initial pre-ionization (PI) stage. The PI plasma sets the initial conditions from which the FRC is created. In particular, the PI formation process determines the amount of magnetic flux that can be trapped to form the FRC. A ringing theta pinch ionization (RTPI) technique, such as currently used by the FRX-L device at LANL, has the advantages of high ionization fraction, simplicity (since no additional coils are required), and does not require internal electrodes which can introduce impurities into the plasma. However RTPI has been shown to only trap 50% of the initial bias flux at best and imposes additional engineering constraints on the capacitor banks. The amount of trapped flux plays an important role in the FRC's final equilibrium, transport, and stability properties, and provides increased ohmic heating of the FRC through induced currents as the magnetic field decays. Increasing the trapped flux also provides the route to greatest potential gains in FRC lifetime, which is essential to provide enough time to translate and compress the FRC effectively. In conjunction with LANL we initially planned to develop and test a microwave break- down system to improve the initial PI plasma formation. The UNM team would design the microwave optics and oversee the fabrication and assembly of all components and assist with integration into the FRX-L machine control system. LANL would provide a preexisting 65 kW X-band microwave source and some associated waveguide hardware. Once constructed and installed, UNM would take the lead in operating the microwave breakdown system and conducting studies to optimize its use in FRC PI formation in close cooperation with the needs of the LANL MTF team. In conjunction with our LANL collaborators, we decided after starting the project to switch from a microwave plasma breakdown approach to a plasma gun technology to use for enhanced plasma formation in the FRX-L field-reversed configuration experiment at LANL. Plasma guns would be able to provide significantly higher density plasma with greater control over its distribution in time and space within the experiment. This would allow greater control and ne-tuning of the PI plasma formed in the experiment. Multiple plasma guns would be employed to fill a Pyrex glass test chamber (built at UNM) with plasma which would then be characterized and optimized for the MTF effort.

70 PLASMA PHYSICS AND FUSION TECHNOLOGY↗
DOE OSTI2018

Memristive Ion Channel-Doped Biomembranes as Synaptic Mimics

Solid-state neuromorphic systems based on transistors or memristors have yet to achieve the interconnectivity, performance, and energy efficiency of the brain due to excessive noise, undesirable material properties, and nonbiological switching mechanisms. Here in this work, we demonstrate that an alamethicin-doped, synthetic biomembrane exhibits memristive behavior, emulates key synaptic functions including paired-pulse facilitation and depression, and enables learning and computing. Unlike state-of-the-art devices, our two-terminal, biomolecular memristor features similar structure (biomembrane), switching mechanism (ion channels), and ionic transport modality as biological synapses while operating at considerably lower power. The reversible and volatile voltage-driven insertion of alamethicin peptides into an insulating lipid bilayer creates conductive pathways that exhibit pinched current–voltage hysteresis at potentials above their insertion threshold. Moreover, the synapse-like dynamic properties of the biomolecular memristor allow for simplified learning circuit implementations. Finally, low-power memristive devices based on stimuli-responsive biomolecules represent a major advance toward implementation of full synaptic functionality in neuromorphic hardware.

36 MATERIALS SCIENCE↗
DOE OSTI2023

Hardware-in-the-loop Testing of Network Protectors for Low-Voltage Networks with Distributed Energy Resources

In this report, we developed and validated a network protector relay digital twin model and interfaced a commonly used network protector relay hardware with our real-time simulation system. Hardware-in-the-loop protection studies are performed to assess the impact of distributed energy resources (DER) and benchmark a rate-of-change-based mitigation strategy. Simulation results suggest that the network protector reverse trip and auto-reclose functions are negatively impacted by the high distributed energy resource penetration. To accommodate DER backfeed while remaining secure and reliable for faults on primary feeders, we recommend options for a rate-of-change-based blocking scheme and a protection setting change. Finally, future mitigation ideas and standard revisions are discussed.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2025

Tutorial: Machine-Learning-Based CREASE-2D Analysis of 2D SAXS Profiles to Characterize Anisotropic Nanostructures in Soft Materials

We present a tutorial to guide users on how to extend the Computational Reverse Engineering Analysis of Scattering Experiments-2D (CREASE-2D) framework to interpret their experimental two-dimensional small-angle scattering (SAS) data from soft materials (e.g., polymers, peptide amphiphiles, biomolecular fibrils). Unlike most traditional SAS analysis approaches, which typically rely on azimuthally averaged onedimensional (1D) profiles, CREASE-2D utilizes the complete 2D scattering profile to reveal information about anisotropy in the structure. In past applications, CREASE has provided insights into complex structural features, including the cross-sectional shapes of assembled nanostructures and dispersity in these features, which are difficult to discern with existing analytical models. While (1D- ) CREASE has been applied to SANS and SAXS data, this tutorial shares the steps for implementing CREASE-2D using an example of a dipeptide solution system, for which we have SAXS data. We present details for these steps involved in using CREASE-2D to interpret SAXS profiles: how to preprocess SAXS data, define relevant structural features, generate three-dimensional real-space structures for specific values of these features, train a machine learning (ML) surrogate model to predict scattering profiles for given structural features, and optimize these features using genetic algorithms (GA). Then, we use these steps to interpret complex 2DSAXS data collected from dipeptide solutions that, in microscopy images, exhibit nanoscale structures that could be elliptical tubes/ flat tapes/cylinders or a combination of these cross sections. Open-source codes, computational hardware, and software requirements, as well as the strengths and limitations of this protocol, are also presented. We expect researchers working with (soft) biomaterials, peptide amphiphiles, amphiphilic polymer solutions, polymer nanocomposites, and blends of particles/polymers will find this CREASE-2D method and this tutorial of use.

CREASE↗
DOE OSTI2021

Challenges in Firmware Re-Hosting, Emulation, and Analysis

System emulation and firmware re-hosting have become popular techniques to answer various security and performance related questions, such as determining whether a firmware contain security vulnerabilities or meet timing requirements when run on a specific hardware platform. While this motivation for emulation and binary analysis has previously been explored and reported, starting to either work or research in the field is difficult. To this end, we provide a comprehensive guide for the practitioner or system emulation researcher. Here, we layout common challenges faced during firmware re-hosting, explaining successive steps and surveying common tools used to overcome these challenges. We provide classification techniques on five different axes, including emulator methods, system type, fidelity, emulator purpose, and control. These classifications and comparison criteria enable the practitioner to determine the appropriate tool for emulation. We use our classifications to categorize popular works in the field and present 28 common challenges faced when creating, emulating, and analyzing a system from obtaining firmwares to post emulation analysis.

97 MATHEMATICS AND COMPUTING↗