Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “network security”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 289 records · Page 16
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

Space-based quantum networks are an essential component of future architecture for distributed quantum computers and quantum-enhanced secure communication

Space-based quantum links show great promise for connecting and communicating between quantum computers over ultra-long distances without the high loss incurred through fiber. A successful US quantum satellite would require large investment, national priority, and a diverse set of expertise. But, it would deliver US-owned quantum links that would allow for quantum-enhanced secure communications and the ability to connect quantum computers over long distances.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

Module-OT: A Turnkey Solution for Securing Energy Systems

The Modular Security Apparatus for Managing Distributed Cryptography for Command-and-Control Messages on Operational Technology Networks (Module-OT) is a flexible and lightweight solution for grid-edge devices focusing on end-to-end security. It is a bump- in- the-wire solution acting as a secure conduit for data between devices or systems across a network. It improves the cybersecurity posture of DER systems by providing authentication, authorization, and data integrity to secure DER communications. Additionally, it performs key management, provides data security through whitelisting Internet Protocol addresses and ports, blocks unauthorized connections, controls user access, and allows serial or Ethernet connections for added flexibility. The core software is portable to various Linux-based operating systems and is developed to be customized by the developer and researcher communities. Module-OT has been validated in the lab, has been demonstrated at a 500-KW PV-plus-storage site, and has been proven ready to secure operational technology devices. Its core functionality meets current standards, including validation procedures of the NIST Cryptographic Algorithm Validation Program (CAVP) and the Federal Information Processing Standard (FIPS 140-2). Because of its capability to provide an accessible and affordable option for stepping up security across modern energy systems, Module-OT can serve as an effective technological option to standardize cybersecurity moving forward.

cryptography↗
DOE OSTI2021

Mapping SIEM Vulnerabilities in STIG

SIEM (Security Information and Event Management) tools monitor network traffic and allow users to quickly detect problems in their networks. Because of the valuable information processed by SIEM tools, it is important to understand their vulnerabilities. STIG (Structured Threat Intelligence Graph) is an application created at INL used to visualize data related to cyber threats. Using STIG can allow users to understand vulnerabilities related to their SIEM products and how to protect their systems.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2023

Reinforcement Learning for Intentional Islanding in Resilient Power Transmission Systems

Intentional islanding is the process of identifying and deliberately decomposing the transmission network to form self-sustained islands from an endangered network during disruptions to improve resilience and security. Most existing intentional islanding models are offline resilience decision tools and hence do not provide outage responses in a timely manner. In this paper, a reinforcement learning (RL) based model for intentional islanding is developed, which offers real-time switching control, online deployability, and adaptability to varying system conditions. The intentional islanding process is formulated as a Markov decision process, where the optimal transmission switching policy is learned using the RL approach. The control policy is learned over an environment that encompasses a Power System Simulator for Engineering (PSS/E) model of the transmission network, facilitated by an interface to the standard openAI Gym framework. The proposed RL-based methodology aims to form stable and self-sustainable islands by ensuring voltage stability while reducing the power mismatch in the formed islands. A proximal policy optimization algorithm is designed, which is suitable for controlling the on/off status of the switches with multi-layer perceptron as value and actor networks. The effectiveness of the proposed framework in the self-recovery of the grid by island formation is applied on the modified IEEE 39-bus test network and validated by dynamic simulations.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

A Review of Technologies that can Provide a 'Root of Trust' for Operational Technologies

The supply chain attack pathway is being increasingly used by adversaries to bypass security controls and gain unauthorized access to sensitive networks and equipment (e.g., Critical Digital Assets). Cyber-attacks targeting supply chain generally aim to compromise the environments, products, or services of vendors and suppliers to inject, add, or substitute authentic software and hardware with malicious elements. These malicious elements are deemed to be authentic as they arise from the vendor or supplier (i.e., the supply chain). This research aims at providing a survey of technologies that have the potential to reduce exposure of sensitive networks and equipment to these attacks, thereby improving tamper resistance. The recent advances in the performance and capabilities of these technologies in recent years has increased their potential applications to reduce or mitigate exposure of the supply chain attack pathway. The focus being on providing an analysis of the benefits and disadvantages of smart cards, secure tokens, and elements to provide root of trust. This analysis provides evidence that these roots of trust can increase the technical capability of equipment and networks to authenticate changes to software and configuration thereby increasing resilience to some supply chain attacks, such as those related to logistics and ICT channels, but not development environment attacks.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
DOE OSTI2024

End-to-End Encryption for Cyber-Physical Systems Using Fully Homomorphic Encryption

Cyber-physical systems require reliable, safe, and secure control of critical infrastructure, combining computational and networking capabilities, which heighten the risk of cyber attacks. These attacks can disrupt the physical process, causing unforeseen consequences. One solution is the use of fully homomorphic encryption (FHE) to protect the control loop, allowing for secure computations and communications without compromising signal and control system privacy. The challenge with FHE, however, is its requirement for inputs to be integers. This presentation introduces a modified Learning With Errors (LWE) FHE approach that encodes control system dynamics and signals into integers. Our proposed scheme leverages a generalized LWE encoding function and modifies the Gentry-Sahai-Waters gadget decomposition tool to encrypt the control system. Using the modified LWE scheme, we formalize a fully encrypted control system, supported by simulated results.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

Encrypted Control Using Modified Learning With Errors-based Schemes

Cyber-physical systems (CPSs) require reliable, safe, and secure control of critical infrastructure, combining computational and networking capabilities, which heighten the risk of cyber attacks. These attacks can disrupt the physical process, causing unforeseen consequences. One solution is the use of fully homomorphic encryption (FHE) to protect the control loop, allowing for secure computations and communications without compromising signal and control system privacy. The challenge with FHE, however, is its requirement for inputs to be integers. This paper introduces a modified Learning With Errors (LWE) FHE approach that encodes control system dynamics and signals into integers. Our proposed scheme leverages a generalized LWE encoding function and modifies the Gentry-Sahai-Waters (GSW) gadget decomposition tool to encrypt the control system. Using the modified LWE scheme, we formalize a fully encrypted control system, supported by simulated results.

42 - ENGINEERING↗
DOE OSTI2022

Radiation Detection System Integration Using Multiple-Input Multiple-Output Radios

This study describes the application development of multiple-input multiple-output radios to provide persistent mobile ad hoc network (MANET) for the Department of Homeland Security. By using Man Portable Unit (MPU5) fifth generation radios (manufactured by Persistent Systems) with the Android Team Awareness Kit (ATAK), an Android smartphone geospatial infrastructure and military situational awareness application, the Remote Sensing Laboratory has developed a MANET connectivity to monitor deployed nuclear/radiological search operation assets.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗
DOE OSTI2023

Securely Aggregated Coded Matrix Inversion

Coded computing is a method for mitigating straggling workers in a centralized computing network, by using erasure-coding techniques. Federated learning is a decentralized model for training data distributed across client devices. In this work we propose approximating the inverse of an aggregated data matrix, where the data is generated by clients; similar to the federated learning paradigm, while also being resilient to stragglers. To do so, we propose a coded computing method based on gradient coding. We modify this method so that the coordinator does not access the local data at any point; while the clients access the aggregated matrix in order to complete their tasks. Here, the network we consider is not centrally administrated, and the communications which take place are secure against potential eavesdroppers.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

PLC Vulnerabilities and Mitigations

Programmable Logic Controllers (PLCs) are used extensively in many high-importance industrial and nonindustrial settings including controlling elevators, manufacturing machines, and utility facilities such as power and natural gas, however cybersecurity protection for them has been neglected. Within recent years, PLCs have been put under more security scrutiny and experts have advocated for changes from the addition of protocol encryption and network segmentation to intrusion detection systems on the PLCs themselves. While PLC security is critical, a large portion of the PLCs available today will never receive these changes due to being legacy or the difficulty of overhauling the security on existing systems. Due to the infeasibility of applying many recommended security measures towards currently available machines, we aim to provide realistic and affordable best practices for hardening PLCs. We will first conduct security analysis and consider attack vectors within our target PLC. Once we’ve analyzed the device’s security, we will evaluate a variety of mitigation methods and create guidelines to effectively reduce the threat posed by PLC attacks with minimal disruption to operations.

42 ENGINEERING↗
DOE OSTI2023

Proactive Intrusion Detection and Mitigation System

SAND2023-05661O The proactive intrusion detection and mitigation system (PIDMS) provides grid-edge situational awareness for cybersecurity defense by capturing real-time distributed energy resource (DER) network traffic and performance data with a novel approach that improves the detection and prevention of cyber-physical attacks. The PIDMS addresses the grid-edge security gap with real-time analysis of both network traffic and photovoltaic performance data to deliver a novel, cyber-physical intrusion detection system (IDS) approach that increases the accuracy and effectiveness of detection and mitigation. This hybrid IDS analysis enables dual monitoring that increases the workload of the adversary; both cyber and physical data would have to be simultaneously spoofed to evade detection. Furthermore, monitoring and analyzing cyber data are insufficient in some cases. For example, in an insider threat aimed at disrupting inverter grid-support functions where proper credentials and authentication are achieved, only the altered PV performance would indicate abnormal behavior. All in all, the PIDMS provides novel capabilities for: • Distributed, real-time cyber-physical detection and mitigation analysis • Cybersecurity defense for grid-edge systems • Analysis framework that can provide situational awareness across the transmission, distribution, and DER systems The PIDMS sensor is designed to collect cyber-physical data, process the data using machine-learning algorithms, detect abnormal events, and deploy mitigations. With these goals, the main functional PIDMS objectives are: • Capability to collect cyber-physical data • Onboard storage of cyber-physical data • Peer-to-peer communication • Computationally efficient machine-learning algorithms • Online cyber-physical data analysis • Alerting/visualization capabilities • Mitigation deployment capability with bump-in-the-wire (BITW) implementation Each of these functional objectives enable PIDMS to perform effective cyber-physical intrusion detection and mitigation. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525.

Jones, Christian↗
DOE OSTI2020

Method for Assessment of Security-Relevant Settings in Anomaly-Based Intrusion Detection for Industrial Control Systems

Ensuring the integrity of Ethernet-based networks is a challenging and constantly evolving domain. This problem is exacerbated for those operational technology (OT) networks supporting industrial control systems (ICS) since much of that equipment was originally designed to be on a network that was isolated and generally considered free of malefactors. Increasing pressure to bridge these systems with traditional information technology (IT) networks has introduced a bevy of new threats. In response, both academia and industry have responded with security solutions tailored to ICS environments. Deploying these protection systems often involves several configuration choices. While some of these choices are clear (e.g., block/enable protocol X) others are far more subjective (e.g. alert threshold == 3.43). Further complicating the situation, while often similar to IT networks, OT networks have unique challenges and characteristics that make the task of protecting them simultaneously more difficult and straight forward.Extant solutions for quantifying the relative security of intrusion detection systems fail to effectively support the operators of said systems with understanding the impact of various configuration changes. Further, they assume that the attacks are static and not subject to manipulation or alteration in the face of defenses. In this paper, we present a threat-based method for quantifying the relative impact of various security settings for intrusion detection systems (IDSs) within ICS environments. This method provides operational staff with a clear understanding of the relative impact of their settings and assumes that the attacks levied against them are dynamic. The model is described in detail, we apply the model to a synthetic data set, and discuss the inferences that can be made and what types of decisions they could be used to support.

Gillen, Rob↗
DOE OSTI2022

A Solar-assisted Voltage Optimization Method for Transmission Solar Network Power System

This paper proposes a new formulation and solution algorithm that uses transmission level solar inverters to address the security-constrained optimal power flow (SCOPF) problem. The goal is to stabilize voltage fluctuations in transmission networks in base case and contingency scenarios, by using bulk solar power plant with a minimal number of post-contingency corrections. To achieve this goal, a two-stage volt/var optimization method is proposed to first correct all voltage violations with the volt-var alternating current optimal power flow (ACOPF) algorithm for a base case. Then a linearized SCOPF volt-var control algorithm is proposed to identify the corrective actions for all potential voltage violations in all contingency scenarios. The proposed method was tested and validated on a modified IEEE 118-bus system with solar photovoltaic (PV) data.

Photovoltaic, Volt/Var Control↗
DOE OSTI2023

ARENA: Adversary-Resistant Evolving Neural Architectures

Neural networks are becoming the cornerstone for national security prediction tasks. However, designing them requires significant research and trial/error, as they have many hyperparameters, including their computation graph (“architecture”). Neural architecture search (NAS) employs secondary optimizers to search for architectures maximizing objectives like accuracy. Evolutionary algorithms (EAs) are the most used class of optimizer for NAS. However, existing Python libraries for writing EAs limit the complexity of experiments a user can design. In this project, we built ARENA, a Python framework that encodes complex, hyper-realistic EAs. ARENA collects detailed information as it runs and is flexible enough to encode non-EA search algorithms. We tested ARENA on 4 toy optimization problems by encoding 3 search algorithms for each—random search, an EA, and simulated annealing. We also designed an EA that performs NAS on the MNIST dataset. Our experiments suggest the potential for immediate mission impact through solving lab-wide optimization problems.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2021

Proof-of-work for securing IoT and autonomous systems

A first device in a network issues a proof-of-work challenge to a second device in the network. The second device computes a cryptographic function result to satisfy a criterion indicated in the challenge. The second device returns a challenge response comprising inputs to the cryptographic function that the second device used to compute the cryptographic function result satisfying the criterion. The first device, upon receiving the challenge response, verifies that the inputs to the cryptographic function yield a result satisfying the criterion. Responsive to verifying the challenge response, the first device updates a blockchain based upon the challenge response.

Chan, Calvin↗
DOE OSTI2021

Tractable Learning in Underexcited Power Grids

Estimating the structure of physical flow networks, such as power grids, is critical to secure delivery of energy. This article discusses statistical structure estimation in power grids in the “underexcited” regime, where a subset of internal nodes has zero injection fluctuations. Prior estimation algorithms based on nodal voltages fail for such grids as the voltage covariance matrix is not invertible. Here, we propose a novel topology learning algorithm for learning underexcited general networks. Our algorithm uses physics-informed conservation laws to first identify the zero-injection buses and their neighbors, and then estimates the remaining edges in the grid. We prove the asymptotic correctness of our algorithm for grids with nonadjacent internal zero-injection nodes. More important, we theoretically analyze our algorithm’s efficacy under noisy measurements, and determine bounds on maximum noise under which asymptotically correct recovery is guaranteed. Our approach is validated through simulations with voltage samples generated on test distribution grids with real injection data and nonlinear power flow models.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2021

Tribal Colleges and Universities/Advanced Manufacturing Network Initiative (Phase II) (Q1 FY2021 Progress Report)

The National Nuclear Security Agency (NNSA) initiated the Minority Serving Institution Partnership Plan (MSIPP) to 1) align investments in a university capacity and workforce development with the NNSA mission to develop the needed skills and talent for NNSA’s enduring technical workforce at the laboratories and production plants, and 2) to enhance research and education at under-represented colleges and universities. Out of this effort, MSIPP launched a new consortium in early FY17 focused on Tribal Colleges and Universities (TCUs) known as the Advanced Manufacturing Network Initiative (AMNI). This consortium has been extended for FY20 and FY21. The following report summarizes the status update during this quarter.

42 ENGINEERING↗
DOE OSTI2024

Cyber-Secure and Safe Operation of Solar Photovoltaic Power Distribution Systems

Solar photovoltaic (PV)-rich power distribution systems are networked Cyber-Physical Systems (CPS). These are control systems where multiple computing nodes and diverse intelligent agents interact with the physical world in real-time. However, the presence of networked components renders them vulnerable to potential cyber-attacks, cyber-intrusions, and other malicious events. This is because these systems depend on the measurements reported from their heterogeneous sensors. This makes them vulnerable to potential cyber-attacks where malicious agents can compromise the sensors or the communication networks carrying the sensor measurements. This paper proposes a novel methodology for enhancing the cyber-security and cyber-resilient post-attack safe operation of solar PV-rich power distribution systems against potential cyber-attacks through the Dynamic Watermarking (DW), using online system identification. The resiliency of the proposed technique is tested and validated with several attack scenarios on both a lab-scale 3kW grid-connected PV inverter and a Hardware-in-the-Loop (HiL) system. The proposed approach can be applied to other types of power distribution systems to enhance their cyber-secure and cyber-resilient safe operation. This paper thereby contributes to the field of cyber-security of Cyber-Physical Energy Systems (CPES).

Kim, Jaewon↗