SEARCH · Engineering Papers
Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.
Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.
Why this utility? After years of upgrading the Java Runtime Environment (JRE) or the Java Software Development Kit (JDK/SDK), a Windows computer becomes littered with so many old versions that the machine may become a security risk due to exploits targeted at those older versions. This utility helps mitigate those vulnerabilities by searching for, and removing, versions 1.3.x thru 1.7.x of the Java JRE and/or JDK/SDK.
This paper will describe a practical methodology for understanding the cyber risk of a digital asset. This research attempts to gain a greater understanding of the cyber risk posed by a hardware-based computer asset by considering it as a sum of its hardware and software based sub-components.
The secure transport of sensitive materials across U.S. road networks pose unique challenges for local, state, and federal agencies. Threats range from random events (e.g., accidents, medical emergencies, mechanical failures) to opportunistic or organized tactical assaults. Although the probability of such attacks is very low, the consequences of material loss to foreign states or terrorists can be catastrophic, qualifying these scenarios as “grey swan” events—low-probability, high-impact occurrences that are predictable but difficult to quantify. Traditional risk assessments struggle in these contexts, necessitating a shift toward subjective risk perception to inform planning. Risk perception in transport planning is shaped by various factors, including knowledge of adversarial capabilities, vehicle defenses, manifest details, and geographic features along the route. Geographic features such as bridges, tunnels, roadside elevation, and gaps in cellular coverage introduce vulnerabilities, while mitigative features include safe havens, police stations, and medical services. Temporal variables such as congestion, accidents, and weather further complicate route planning. Despite their importance, existing routing tools like Google Maps and commercial software do not explicitly account for geographic risk features, requiring planners to rely on personal familiarity with routes—a time-intensive, non-scalable approach. This work addresses these gaps by: (1) developing datasets that catalog geographic risk features along U.S. roadways, (2) eliciting risk perceptions from experienced transportation security experts, and (3) linking these perceptions to roadway conditions and geographic data. We implement these capabilities within Secure Route a novel mapping tool for classifying route segment risks associated with roadway conditions. This system provides transportation planners with an intuitive interface to assess and contextualize risk along potential routes, improving decision-making for secure transport. We present current progress in this effort and identify next steps.
Sharing of power grid feeder models faces significant challenges due to the potential risk of exposing sensitive operational information. Traditional anonymization techniques have shown notable limitations in other sensitive domains, as evidenced by documented re-identification attacks that combine supposedly anonymized datasets with auxiliary information, raising concerns that similar vulnerabilities could affect power grid data. Consequently, there is a pressing need for a more rigorous privacy protection strategy that not only delivers formal mathematical guarantees but also preserves the analytical value of the shared models. To address this challenge, we have enhanced the Grid Kitchen framework by implementing differential privacy mechanisms within the distribution model dehydration pipeline. This implementation carefully calibrates and applies noise to sensitive attributes in feeder models according to configurable privacy levels—low, moderate, and high—each offering different balances between data utility and privacy protection. Our approach uses established noise functions (Gaussian for continuous data and Discrete Laplace for integer values) with parameters carefully calibrated so that the impact of individual data points is effectively masked in the final output. The integration leverages our Noise Catalog, which we developed to categorize feeder model properties by component type, data type, and sensitivity. This catalog guides the application of appropriate noise functions and privacy parameters ($\varepsilon$ and $\delta$) to each attribute, ensuring consistent privacy protection across the model while maintaining its structural integrity and analytical usefulness. This implementation also includes evaluation tools that allow model owners to assess the impact of privacy-preserving transformations before sharing data with external parties. This report provides documentation for the differential privacy capabilities added to the Grid Kitchen project. It includes a primer on differential privacy concepts and their importance in modern data sharing, details the architecture of our implementation, explains the privacy modes and parameter configurations, and offers practical guidance on using the code for applying differential privacy to grid feeder models. Through examples and code snippets, we demonstrate the effective application of these privacy-enhancing technologies, enabling utility operators and researchers to confidently share grid data while protecting sensitive information.
EyeON: Eye on Operational technology Software Supply Chain attacks have risen drastically over the past few years, none more well-known and impactful than the SolarWinds compromise. Criminal organizations inserted an attack vector into a specific version of the source code, giving themselves an air of credibility. Once news broke on SolarWinds, identifying compromised sites was very difficult, even knowing the culprit update. Software Bills of Materials (SBOM) have been touted as the solution to reclaiming control of your software supply chain. Deployment of SBOMs has been slow, however, due to conflicting standards, opaque storage requirements, and vendor adoption. Additionally, the path from obtaining an SBOM and securing your supply chain is unclear; how can an SBOM library be leveraged to provide insight to your attack surface? The EyeON tool, sponsored by Department of Energy Cybersecurity, Energy Security, and Emergency Response (DoE CESER), aims to address these gaps by providing an encapsulated solution to tracking which updates have been installed in an enterprise, and alerting system administrators to vulnerabilities as they become known. Similar to a virus scanner, EyeON is a command line tool to parse either a single file, nested directory structure, or filesystem. It collects data such as signature (hashes), version information, VirusTotal tags, compiler, compilation date, and code signing information. Users will anonymously submit scan data periodically to DoE CESER, who will then compile a database of known software products employed by Critical Infrastructure and broadcast alerts based on discovered flaws as they arise.
This paper describes the model of the EMU with a human body in the circuit that has been used by NASA to evaluate the low positive voltage hazard. The model utilizes the electron collection characterization from on orbit Langmuir probe data as representative of electron collection to a positive charged surface with a wide range of on orbit plasma temperature and density conditions. The data has been unified according to non-linear theoretical temperature and density variation of the electron saturated probe current collection theory and used as a model for the electron collection at EMU surfaces. Vulnerable paths through the EMU connecting through the crewman s body have been identified along with electrical impedance of the exposed body parts. The body impedance information is merged with the electron collection characteristics in circuit simulation software (SPICE). The assessment shows that currents can be on the order of 20 mA for a 15 V exposure and of order 4 mA at 3V. These currents formally violate NASA protocol for electric current exposures however the human factors associated with subjective consequences of noxious stimuli from low voltage exposure during the stressful conditions of EVA are an area of active inquiry.
Supply chain cyber-attacks, such as the SolarWinds Orion attack, are occurring with greater frequency. These attacks compromise a digital device before it is sent to customers, bypassing traditional security controls to remain persistent and undetected in operational environments. While supply chain attacks are prevalent, methods for analyzing the risk of these attacks are currently unavailable. This paper proposes new supply chain cyber-attack difficulty and risk metrics to evaluate the relative risk of an attack throughout the supply chain lifecycle. Difficulty metrics for each stakeholder in a digital device’s supply chain (e.g., hardware manufacturing, firmware development, software development, storage, and distribution entities) are calculated using scores from cybersecurity maturity questionnaires in a Bayesian Network leaky Noisy-MAX model. These difficulty metrics are then used to calculate an overall supply chain cyber-attack risk. Vulnerability and recoverability metrics are also proposed to evaluate the relative stakeholder influence in the attack risk. These proposed relative risk metrics enable continuous supply chain monitoring, provide decision-makers with information necessary for improved supplier selection, and help drive improvements in the cybersecurity posture of the stakeholders in their supply chain.
Implemented security protocols are basically pieces of software which are used to (a) authenticate the other communication partners, (b) establish a secure communication channel between them (using insecure communication media), and (c) transfer data between the communication partners in such a way that these data only available to the desired receiver, but not to anyone else. Such an implementation usually consists of the following components: the protocol-engine, which controls in which sequence the messages of the protocol are sent over the network, and which controls the assembly/disassembly and processing (e.g., decryption) of the data. the cryptographic routines to actually encrypt or decrypt the data (using given keys), and t,he interface to the operating system and to the application. For a correct working of such a security protocol, all of these components must work flawlessly. Many formal-methods based techniques for the analysis of a security protocols have been developed. They range from using specific logics (e.g.: BAN-logic [4], or higher order logics [12] to model checking [2] approaches. In each approach, the analysis tries to prove that no (or at least not a modeled intruder) can get access to secret data. Otherwise, a scenario illustrating the &tack may be produced. Despite the seeming simplicity of security protocols ("only" a few messages are sent between the protocol partners in order to ensure a secure communication), many flaws have been detected. Unfortunately, even a perfect protocol engine does not guarantee flawless working of a security protocol, as incidents show. Many break-ins and security vulnerabilities are caused by exploiting errors in the implementation of the protocol engine or the underlying operating system. Attacks using buffer-overflows are a very common class of such attacks. Errors in the implementation of exception or error handling can open up additional vulnerabilities. For example, on a website with a log-in screen: multiple tries with invalid passwords caused the expected error message (too many retries). but let the user nevertheless pass. Finally, security can be compromised by silly implementation bugs or design decisions. In a commercial VPN software, all calls to the encryption routines were incidentally replaced by stubs, probably during factory testing. The product worked nicely. and the error (an open VPN) would have gone undetected, if a team member had not inspected the low-level traffic out of curiosity. Also, the use secret proprietary encryption routines can backfire, because such algorithms often exhibit weaknesses which can be exploited easily (see e.g., DVD encoding). Summarizing, there is large number of possibilities to make errors which can compromise the security of a protocol. In today s world with short time-to-market and the use of security protocols in open and hostile networks for safety-critical applications (e.g., power or air-traffic control), such slips could lead to catastrophic situations. Thus, formal methods and automatic reasoning techniques should not be used just for the formal proof of absence of an attack, but they ought to be used to provide an end-to-end tool-supported framework for security software. With such an approach all required artifacts (code, documentation, test cases) , formal analyses, and reliable certification will be generated automatically, given a single, high level specification. By a combination of program synthesis, formal protocol analysis, certification; and proof-carrying code, this goal is within practical reach, since all the important technologies for such an approach actually exist and only need to be assembled in the right way.
Control system networks are increasingly being connected to enterprise level networks. These connections leave critical industrial controls systems vulnerable to cyber-attacks. Most of the effort in protecting these cyber-physical systems (CPS) has been in securing the networks using information security techniques and protection and reliability concerns at the control system level against random hardware and software failures. However, besides these failures the inability of information security techniques to protect against all intrusions means that the control system must be resilient to various signal attacks for which new analysis and detection methods need to be developed. In this paper, sensor signal attacks are analyzed for observer-based controlled systems. The threat surface for sensor signal attacks is subdivided into denial of service, finite energy, and bounded attacks. In particular, the error signals between states of attack free systems and systems subject to these attacks are quantified. Optimal sensor and actuator signal attacks for the finite and infinite horizon linear quadratic (LQ) control in terms of maximizing the corresponding cost functions are computed. The closed-loop system under optimal signal attacks are provided. Illustrative numerical examples are provided together with an application to a power network with distributed LQ controllers.
Smart grid solutions enable utilities and customers to better monitor and control energy use via information and communications technology. Information technology is intended to improve the future electric grid’s reliability, efficiency, and sustainability by implementing advanced monitoring and control systems. However, leveraging modern communications systems also makes the grid vulnerable to cyberattacks. Here we report the first use of quantum key distribution (QKD) keys in the authentication of smart grid communications. In particular, we make such demonstration on a deployed electric utility fiber network. The developed method was prototyped in a software package to manage and utilize cryptographic keys to authenticate machine-to-machine communications used for supervisory control and data acquisition (SCADA). This demonstration showcases the feasibility of using QKD to improve the security of critical infrastructure, including future distributed energy resources (DERs), such as energy storage.
The Los Alamos National Laboratory Environmental Remediation program has conducted extensive geomorphic surveys of sediment deposits in the canyon bottoms within and surrounding the facility. The goal of the geomorphic surveys was to provide basic information needed to characterize chemical inventories of the sediments downstream of historical release sites. Sediment units were mapped based on depositional setting and age. Representative characterization samples were collected for each unit and submitted for chemical analysis. Chemical inventories were estimated by calculating the total volume of each depositional unit and multiplying by average chemical concentration. This method of characterization provides a spatial distribution of chemical data based on fluvial processes. In general, for the canyon bottom sediments, the higher concentrations of industrial chemicals were associated with fine-grained floodplain deposits closest to the source. Since initial characterization, many of the reaches have undergone changes in response to post-wildfire floods and severe rain events. These events impacted the channel and floodplain deposits. Much of the elevated concentrations are confined to the over-bank deposits distal from the primary channel. In order to ensure that the sediment units containing elevated chemical concentrations are stable, repeat aerial light detection and ranging (LiDAR) surveys are conducted and changes are assessed using the Geomorphic Change Detection (GCD) plug-in for ArcGIS. These tools provide high confidence uncertainty estimates and extensive areal coverage. This is a valuable method for long-term monitoring of surface sediments with low-level but widespread contaminant distributions. All of the monitored canyon bottom reaches pass risk assessment and present technically infeasible sediment removal options. Following the 2014 monsoon season, aerial LiDAR data has been collected annually and the resulting digital elevation models (DEMs) processed using the GCD method. Changes are identified using GCD and are verified by field walk downs. If erosion is identified in areas which are vulnerable to mobilizing contaminated sediment, enhanced controls can be installed to stabilize banks or other areas with high erosion potential. Annual sediment monitoring samples are collected where there is evidence for flow and deposition within the past year. Since 2014, no severe floods have been catalogued using the LiDAR surveys and GCD software. The recent rainfall/runoff events have not caused major changes to the canyon bottom channels and floodplains. Geomorphic processes identified in the monitoring results include channel aggradation and incision that over the course of a monsoon season results in minor changes to the system. Other active processes contributing to observed changes are minor slides, flows, slumps, and falls of unconsolidated sediment on steep bedrock or soil surfaces. A comprehensive baseline has been established by geomorphic mapping and characterization sampling. Periodic monitoring consists of LiDAR surveys and GCD analysis which offers an effective and defensible methodology for documenting stability of surface sediments. (authors)
Purpose and Objectives: Neurologic deficits after brain radiation therapy (RT) typically involve decline in higher-order cognitive functions such as attention and memory rather than sensory defects or paralysis. We sought to determine whether areas of the cortex critical to cognition are selectively vulnerable to radiation dose-dependent atrophy. Methods and Materials: We measured change in cortical thickness in 54 primary brain tumor patients who underwent fractionated, partial brain RT. The study patients underwent high-resolution, volumetric magnetic resonance imaging (T1-weighted; T2 fluid-attenuated inversion recovery, FLAIR) before RT and 1 year afterward. Semiautomated software was used to segment anatomic regions of the cerebral cortex for each patient. Cortical thickness was measured for each region before RT and 1 year afterward. Two higher-order cortical regions of interest (ROIs) were tested for association between radiation dose and cortical thinning: entorhinal (memory) and inferior parietal (attention/memory). For comparison, 2 primary cortex ROIs were also tested: pericalcarine (vision) and paracentral lobule (somatosensory/motor). Linear mixed-effects analyses were used to test all other cortical regions for significant radiation dose-dependent thickness change. Statistical significance was set at α = 0.05 using 2-tailed tests. Results: Cortical atrophy was significantly associated with radiation dose in the entorhinal (P=.01) and inferior parietal ROIs (P=.02). By contrast, no significant radiation dose-dependent effect was found in the primary cortex ROIs (pericalcarine and paracentral lobule). In the whole-cortex analysis, 9 regions showed significant radiation dose-dependent atrophy, including areas responsible for memory, attention, and executive function (P≤.002). Conclusions: Areas of cerebral cortex important for higher-order cognition may be most vulnerable to radiation-related atrophy. This is consistent with clinical observations that brain radiation patients experience deficits in domains of memory, executive function, and attention. Correlations of regional cortical atrophy with domain-specific cognitive functioning in prospective trials are warranted.
ResDesign project has developed integrated capabilities to help cyber physical system modelers and analysts to evaluate vulnerabilities and resilience of such systems using co-simulation-based attack testbed, graph-based visualization and monitoring tool, and Bayesian optimization-based co-design capability. The project demonstrates a collection of attack scenarios and use cases in an integrated software environment.
Savannah River Remediation (SRR) developed a new software application, Safety Requirement Management System (SRMS), to improve Documented Safety Analysis (DSA) safety requirement implementation in the Savannah River Site's Liquid Waste facilities. Technical Safety Requirement (TSR) Limited Conditions of Operations (LCOs) and related surveillances were previously tracked using four different applications. Due to their differences and their age, the applications introduced a number of operational challenges and vulnerabilities, including outdated platforms, usage demands beyond original design, and different organizational work processes. SRMS was developed to resolve these issues by using a single web-based approach that provides consistency, wider accessibility, simpler maintenance, and a platform for additional functionality. Other SRS facilities are evaluating the application for its applicability as a standard practice across the site. The new SRMS application decreased the administrative overhead for application maintenance, provided the needed TSR change management functionality, and reduced error precursors with the following advantages: - Consistent process/application across all SRR facilities - More efficient way to track and communicate compliance with DSA time-related requirements (i.e., TSR LCOs and surveillances). - Web-based search capability for LCO entries/exits and a record of surveillance performances. - TSR change management and independent reviews through electronic approvals. For example, the application provides the ability to bundle and stage LCO and surveillance changes associated with a TSR revision. The approval process involves multiple roles from the facility to ensure validity. - Formal configuration management program, fully supported by software life cycle documents. SRMS was implemented at Defense Waste Processing Facility (DWPF) in June 2017, with implementation in all Liquid Waste facilities expected by the end of 2017. Next, SRR plans to expand SRMS functionality to include a linking document database (LDD) to support the DSA requirements. (authors)
Software-defined networking (SDN) has enabled elastic networking and resource distribution in cloud computing. The centralization and separation of the Control Plane also offers a high degree of network configurability and management, which can be used to mitigate and manage threats to the network. Space communication networks have historically been restricted and circuit switching in these networks has been a manual process. This study evaluates the potential role of SDN in space communication networks from a networking security standpoint. The evaluation covers the networking security needs of spacecraft missions and their associated assets. The results from the evaluation lead to a risk assessment that identifies vulnerabilities in an SDN-based communications architecture. Security challenges introduced into the network from integrating SDN are also considered. A risk register summarizes the severity of the attack outcomes, as well as occurrence likelihood. The study identifies Denial-of-Service (DoS) attacks as a new threat (presently unmitigated by existing security controls) that would be prevalent in an SDN-based space communication environment. A Mininet-based emulation testbed is built to demonstrate the susceptibility of spacecraft flight software to a flooding DoS attack when on an interconnected SDN-managed network. This type of attack would be highly consequential to mission assets, and therefore SDN-based space communications would need to be resilient to such attacks. Future work will need to be performed to fully characterize DoS attack methods that can apply to the space communication scenario, as well as to devise a comprehensive DoS-resilient solution.
Quantum key distribution (QKD) provides a potent solution to securely distribute keys for two parties. However, QKD itself is vulnerable to denial of service (DoS) attacks. A flexible and resilient QKD-enabled networked microgrids (NMs) architecture is needed but does not yet exist. In this article, we present a programmable quantum NMs (PQNMs) architecture. It is a novel framework that integrates both QKD and software-defined networking (SDN) techniques capable of enabling scalable, programmable, quantum-engineered, and ultra-resilient NMs. Equipped with a software-defined adaptive post-processing approach, a two-level key pool sharing strategy and an SDN-enabled event-triggered communication scheme, these PQNMs mitigate the impact of DoS attacks through programmable post-processing and secure key sharing among QKD links, a capability unattainable using existing technologies. Through comprehensive evaluations, we validate the benefits of PQNMs and demonstrate the efficacy of the presented strategies under various circumstances. Extensive results provide insightful resources for building QKD-enabled NMs in practice.
The United States' power infrastructure is aging, underfunded, and vulnerable to cyber attack. Emerging smart grid technologies may take some of the burden off of existing systems and make the grid as a whole more efficient, reliable, and secure. The Pacific Northwest National Laboratory (PNNL) is funding research into several aspects of smart grid technology and grid security, creating a software simulation tool that will allow researchers to test power infrastructure control and distribution paradigms by utilizing different smart grid technologies to determine how the grid and these technologies react under different circumstances. Understanding how these systems behave in real-world conditions will lead to new ways to make our power infrastructure more resilient and secure. Demonstrating security in embedded systems is another research area PNNL is tackling. Many of the systems controlling the U.S. critical infrastructure, such as the power grid, lack integrated security and the aging networks protecting them are becoming easier to attack.
I. Information Security Background (Speaker = Kevin McDonald) Evolution of Medical Devices Living and Working in a Hostile Environment Attack Motivations Attack Vectors Simple Safety Strategies Medical Device Security in the News Medical Devices and Vendors Summary II. Keeping Radiation Oncology IT Systems Secure (Speaker = Bruce Curran) Hardware Security Double-lock Requirements “Foreign” computer systems Portable Device Encryption Patient Data Storage System Requirements Network Configuration Isolating Critical Devices Isolating Clinical Networks Remote Access Considerations Software Applications / Configuration Passwords / Screen Savers Restricted Services / access Software Configuration Restriction Use of DNS to restrict accesse. Patches / Upgrades Awareness Intrusion Prevention Intrusion Detection Threat Risk Analysis Conclusion Learning Objectives: Understanding how Hospital IT Requirements affect Radiation Oncology IT Systems. Illustrating sample practices for hardware, network, and software security. Discussing implementation of good IT security practices in radiation oncology. Understand overall risk and threats scenario in a networked environment.