SEARCH · Engineering Papers

Results for “software security”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 307 records · Page 17

All sources NASA NTRS DOE OSTI

DOE OSTI2018

Web Extensible Display Manager

Jefferson Lab's Web Extensible Display Manager (WEDM) allows staff to access EDM control system screens from a web browser in remote offices and from mobile devices. Native browser technologies are leveraged to avoid installing and managing software on remote clients such as browser plugins, tunnel applications, or an EDM environment. Since standard network ports are used firewall exceptions are minimized. To avoid security concerns from remote users modifying a control system, WEDM exposes read-only access and basic web authentication can be used to further restrict access. Updates of monitored EPICS channels are delivered via a Web Socket using a web gateway. The software translates EDM description files (denoted with the edl suffix) to HTML with Scalable Vector Graphics (SVG) following the EDM's edl file vector drawing rules to create faithful screen renderings. The WEDM server parses edl files and creates the HTML equivalent in real-time allowing existing screens to work without modification. Alternatively, the familiar drag and drop EDM screen creation tool can be used to create optimized screens sized specifically for smart phones and then rendered by WEDM.

Slominski, Ryan↗

DOE OSTI2016

Architecture and Implementation of OpenPET Firmware and Embedded Software

OpenPET is an open source, modular, extendible, and high-performance platform suitable for multi-channel data acquisition and analysis. Due to the versatility of the hardware, firmware, and software architectures, the platform is capable of interfacing with a wide variety of detector modules not only in medical imaging but also in homeland security applications. Analog signals from radiation detectors share similar characteristics-a pulse whose area is proportional to the deposited energy and whose leading edge is used to extract a timing signal. As a result, a generic design method of the platform is adopted for the hardware, firmware, and software architectures and implementations. The analog front-end is hosted on a module called a Detector Board, where each board can filter, combine, timestamp, and process multiple channels independently. The processed data is formatted and sent through a backplane bus to a module called Support Board, where 1 Support Board can host up to eight Detector Board modules. The data in the Support Board, coming from 8 Detector Board modules, can be aggregated or correlated (if needed) depending on the algorithm implemented or runtime mode selected. It is then sent out to a computer workstation for further processing. The number of channels (detector modules), to be processed, mandates the overall OpenPET System Configuration, which is designed to handle up to 1,024 channels using 16-channel Detector Boards in the Standard System Configuration and 16,384 channels using 32-channel Detector Boards in the Large System Configuration.

46 INSTRUMENTATION RELATED TO NUCLEAR SCIENCE AND ↗

DOE OSTI2013

SOPHIA

Network traffic monitoring software.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2022

Module-OT: A Turnkey Solution for Securing Energy Systems

The Modular Security Apparatus for Managing Distributed Cryptography for Command-and-Control Messages on Operational Technology Networks (Module-OT) is a flexible and lightweight solution for grid-edge devices focusing on end-to-end security. It is a bump- in- the-wire solution acting as a secure conduit for data between devices or systems across a network. It improves the cybersecurity posture of DER systems by providing authentication, authorization, and data integrity to secure DER communications. Additionally, it performs key management, provides data security through whitelisting Internet Protocol addresses and ports, blocks unauthorized connections, controls user access, and allows serial or Ethernet connections for added flexibility. The core software is portable to various Linux-based operating systems and is developed to be customized by the developer and researcher communities. Module-OT has been validated in the lab, has been demonstrated at a 500-KW PV-plus-storage site, and has been proven ready to secure operational technology devices. Its core functionality meets current standards, including validation procedures of the NIST Cryptographic Algorithm Validation Program (CAVP) and the Federal Information Processing Standard (FIPS 140-2). Because of its capability to provide an accessible and affordable option for stepping up security across modern energy systems, Module-OT can serve as an effective technological option to standardize cybersecurity moving forward.

cryptography↗

DOE OSTI2024

Integration of the NCRC Database and Other INL Databases

The Nuclear Computational Resource Center provides a portal by which industry professionals, educational staff, students, national laboratory employees, and others may request access to certain engineering software tools. As the tools provided through the Nuclear Computational Resource Center portal are not open-source and freely available, a set of approvals are necessary before access is granted. All code recipients must be associated with an institution that has a license with Idaho National Laboratory for the code requested. Information about these licenses is controlled by Idaho National Laboratory’s Technology Deployment organization and housed in a Technology Deployment database. Those requesting code access who are not citizens of the United States must also have a security plan, mandated by Idaho National Laboratory policy. Security plans are managed by the International Access Program and are stored in an International Access Program database known as IFacts. Granting access to software thus depends on information stored in the Technology Deployment database and IFacts. In the past, no connection between the Nuclear Computational Resource Center portal and these databases existed, making checking the status of license agreements and security plans time consuming and error prone. This report demonstrates that the Nuclear Computational Resource Center portal now connects to both the Technology Deployment database and IFacts, greatly improving the ease of use of the Nuclear Computational Resource Center system for administrators, which leads to a better overall experience for those requesting code access.

99 GENERAL AND MISCELLANEOUS↗

DOE OSTI2022

Software Development for Data Visualization and Analysis of PN-Diodes & MOSFET Devices

The U.S. Department of Energy has a broad mission to ensure the nation’s security by addressing ongoing environmental challenges, developing novel energy production technologies, and mitigating nuclear security concerns. These efforts benefit from developing more effective semiconductor materials and devices. The research discussed in this report aims to further the development of these new electronics by improving implementations of vertical device structures, which offer theoretically better performance compared to lateral structures. Specifically, it reviews the background and development of a new and easy-to-use program for data processing and analysis from experiments run on vertical gallium nitride power devices. Current vertical structures fall short in critical performance metrics, such as On-Resistance and Breakdown Voltage, due to poor management of the device’s electric field. Junction termination extensions, or JTEs, are a field management technique that increases a device’s resilience to expected failure modes by controlling its surface electric fields. Each JTE design requires significant experimental validation, consisting of hundreds of tested devices, each outputting an enormous set of data points. The new software includes multiple methods of filtering large sets of device testing data to identify and remove flawed devices, automate device analyses, and provide statistical breakdowns for four metrics used to define the effectiveness of the JTE and the current carrying capacity of the device. These results can then be related back to fabrication techniques and device design, and in the future, be combined with processing simulations to further improve our understanding of the JTE mechanisms.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2014

Security analysis of boolean algebra based on Zhang-Wang digital signature scheme

In 2005, Zhang and Wang proposed an improvement signature scheme without using one-way hash function and message redundancy. In this paper, we show that this scheme exits potential safety concerns through the analysis of boolean algebra, such as bitwise exclusive-or, and point out that mapping is not one to one between assembly instructions and machine code actually by means of the analysis of the result of the assembly program segment, and which possibly causes safety problems unknown to the software.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2015

Continuous Security and Configuration Monitoring of HPC Clusters

Continuous security and configuration monitoring of information systems has been a time consuming and laborious task for system administrators at the High Performance Computing (HPC) center. Prior to this project, system administrators had to manually check the settings of thousands of nodes, which required a significant number of hours rendering the old process ineffective and inefficient. This paper explains the application of Splunk Enterprise, a software agent, and a reporting tool in the development of a user application interface to track and report on critical system updates and security compliance status of HPC Clusters. In conjunction with other configuration management systems, the reporting tool is to provide continuous situational awareness to system administrators of the compliance state of information systems. Our approach consisted of the development, testing, and deployment of an agent to collect any arbitrary information across a massively distributed computing center, and organize that information into a human-readable format. Using Splunk Enterprise, this raw data was then gathered into a central repository and indexed for search, analysis, and correlation. Following acquisition and accumulation, the reporting tool generated and presented actionable information by filtering the data according to command line parameters passed at run time. Preliminary data showed results for over six thousand nodes. Further research and expansion of this tool could lead to the development of a series of agents to gather and report critical system parameters. However, in order to make use of the flexibility and resourcefulness of the reporting tool the agent must conform to specifications set forth in this paper. This project has simplified the way system administrators gather, analyze, and report on the configuration and security state of HPC clusters, maintaining ongoing situational awareness. Rather than querying each cluster independently, compliance checking can be managed from one central location.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2019

ADVANCING THE TRANSPORTATION – SECURITY, TRACKING, AND REPORTING (T-STAR) SYSTEM

The Transportation – Security, Tracking and Reporting (T-STAR) System was developed by NNSA NA-21 Office of Radiological Security (ORS) to provide a transportation security system for use during transport of Category 1 and Category 2 radiological material to provide detection and tracking capability for shipments. While many off the shelf systems provide asset tracking of the conveyance, few offer detection of a breach into the cargo compartment or the removal of cargo from the conveyance. Systems that do offer such capability need to be permanently installed on the conveyance, requiring drilling of holes and running of cables throughout the conveyance itself. This means that dedicated shipping containers or vehicles are required, and this is not sustainable in many countries where ORS is building capacity for the security of radioactive materials in use, storage, and in transport. T-STAR is leveraging various ORNL technologies for improved communications capability and reduced power requirements; the multimode communications module developed by the Unmanned Aerial Systems group and the low power and extensible Authenticatable Container Tracking System (ACTS) tag developed for the US Department of Energy’s Packaging Certification Program provide a small footprint tracking system which can be installed quickly as needed. T-STAR uses a cellular and an Iridium modem to communicate configuration and alert information to a server used to monitor the shipment and incorporates a Z-wave © wireless security system allowing various intrusion detection sensors to be located in the conveyance. The Z-wave sensors are readily available, inexpensive, and power efficient, making them replaceable and low maintenance. The server software be configured as a standalone system installed on a light duty computer hosted by the competent authority, carrier, or response agency, or hosted as part of an Amazon Cloud Server (AWS) accessible via a secure login. The server has two functions, first is to handle messages to/from the T-STAR field unit, second is to host the user interface which can be accessed using a web browser on desktop or mobile device. The user interface implements roles to determine the level of access to shipment information, define geo-fences, and configure notifications. The user interface also supports multiple languages for display as well as notifications by using a simple lookup file which can be modified by the host country to ensure translations are correct and meaningful to responders receiving notifications and alerts. This paper will detail the overarching T-STAR capabilities, architecture and components, and provide insights on how it is deployed, used, and monitored during transportation of radioactive material.

Schultze, Michael↗

DOE OSTI2022

Overcoming Challenges to Continuous Integration in HPC

Continuous integration (CI) has become a ubiquitous practice in modern software development, with major code hosting services offering free automation on popular platforms. CI offers major benefits, as it enables detecting bugs in code prior to committing changes. While high-performance computing (HPC) research relies heavily on software, HPC machines are not considered “common” platforms. This presents several challenges that hinder the adoption of CI in HPC environments, making it difficult to maintain bug-free HPC projects, and resulting in adverse effects on the research community. Here we explore the challenges that impede HPC CI, such as hardware diversity, security, isolation, administrative policies, and non-standard authentication, environments, and job submission mechanisms. We propose several solutions that could enhance the quality of HPC software and the experience of developers. Implementing these solutions would require significant changes at HPC centers, but if these changes are made, it would ultimately enable faster and better science.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2019

Scalable Reasoning System (SRS)

SRS is a web-based and mobile toolkit for information visualization and collaboration. It includes server-side components in the form of web services that provide analytical functions such as data clustering and temporal analysis. The SRS client is accessed via a web browser and uses asynchronous javascript and XML (AJAX) to interact with and visualize the results of these web services. Users of SRS can query data sources that are connected to the SRS backend, and query results are presented in the form of coordinated visual displays in a web browser that depict temporal, topical, and spatial relationships in the results. SRS also includes an early stage graphical reasoning diagram interface that helps analysts express and test hypotheses. This software was developed with funding from the Science and Technology Directorate of the U.S. Department of Homeland Security.

Pike, William↗

DOE OSTI2015

Ultra-secure RF Tags for Safeguards and Security - SBIR Phase II Final Report

This is the Final Report for the DOE Phase II SBIR project “Ultra-secure RF Tags for Safeguards and Security.” The topics covered herein include technical progress made, progress against the planned milestones and deliverables, project outcomes (results, collaborations, intellectual property, etc.), and a discussion on future expectations of deployment and impacts of the results of this work. In brief, all planned work for the project was successfully completed, on or ahead of schedule and on budget. The major accomplishment was the successful development of a very advanced passive ultra-secure RFID tag system with combined security features unmatched by any commercially available ones. These tags have high-level dynamic encrypted authentication, a novel tamper-proofing mechanism, system software including graphical user interfaces and networking, and integration with a fiber-optic seal mechanism. This is all accomplished passively (with no battery) by incorporating sophisticated hardware in the tag which harvests the energy from the RFID readers that are interrogating the tag. Based on initial feedback (and deployments) at DOE’s Lawrence Livermore National Laboratory (LLNL), it is anticipated these tags and their offspring will meet DOE and international community needs for highly secure RFID systems. Beyond the accomplishment of those original objectives for the ultra-secure RF tags, major new spin-off thrusts from the original work were identified and successfully pursued with the cognizance of the DOE sponsor office. In particular, new classes of less sophisticated RFID tags were developed whose lineage derives from the core R&D thrusts of this SBIR. These RF “tag variants” have some, but not necessarily all, of the advanced characteristics described above and can therefore be less expensive and meet far wider markets. With customer pull from the DOE and its national laboratories, new RFID tags and systems (including custom readers and software) for government needs in asset management and tracking were developed. These were tested at a national laboratory and other government facilities, and resulted in immediate procurement actions by the government and deployment of these new systems. Thus, commercialization of the results of this Phase II DOE SBIR was already underway before the end of the SBIR itself. More importantly, operations involving asset management at selected DoE and government sites are already being impacted favorably and could have much broader impacts in the near future.

42 ENGINEERING↗

DOE OSTI2012

Demonstration of a Novel Synchrophasor-based Situational Awareness System: Wide Area Power System Visualization, On-line Event Replay and Early Warning of Grid Problems

Since the large North Eastern power system blackout on August 14, 2003, U.S. electric utilities have spent lot of effort on preventing power system cascading outages. Two of the main causes of the August 14, 2003 blackout were inadequate situational awareness and inadequate operator training In addition to the enhancements of the infrastructure of the interconnected power systems, more research and development of advanced power system applications are required for improving the wide-area security monitoring, operation and planning in order to prevent large- scale cascading outages of interconnected power systems. It is critically important for improving the wide-area situation awareness of the operators or operational engineers and regional reliability coordinators of large interconnected systems. With the installation of large number of phasor measurement units (PMU) and the related communication infrastructure, it will be possible to improve the operators’ situation awareness and to quickly identify the sequence of events during a large system disturbance for the post-event analysis using the real-time or historical synchrophasor data. The purpose of this project was to develop and demonstrate a novel synchrophasor-based comprehensive situational awareness system for control centers of power transmission systems. The developed system named WASA (Wide Area Situation Awareness) is intended to improve situational awareness at control centers of the power system operators and regional reliability coordinators. It consists of following main software modules: • Wide-area visualizations of real-time frequency, voltage, and phase angle measurements and their contour displays for security monitoring. • Online detection and location of a major event (location, time, size, and type, such as generator or line outage). • Near-real-time event replay (in seconds) after a major event occurs. • Early warning of potential wide-area stability problems. The system has been deployed and demonstrated at the Tennessee Valley Authority (TVA) and ISO New England system using real-time synchrophasor data from openPDC. Apart from the software product, the outcome of this project consists of a set of technical reports and papers describing the mathematical foundations and computational approaches of different tools and modules, implementation issues and considerations, lessons learned, and the results of lidation processes.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2017

ROS-DOE: Leveraging Open-Source Robotics Software for the DOE-EM Mission? - 17181

In order to establish a common software framework for its robotic systems, the United States Department of Energy - Environmental Management (DOE-EM) is considering the possibility of extending the Robot Operating System (ROS) open source robotics software to address the varied, complex challenges facing DOE-EM. The effort, preliminarily called ROS-DOE, would enhance the reliability, robustness, security, and user friendliness of ROS to meet the requirements of the nuclear waste remediation mission, and those of DOE as a whole. As envisioned, the ROS DOE program would also support rapid progress to mature cross-cutting capabilities including supervised autonomy, inter-operability with off-the-shelf industrial equipment, and physics-based robot simulation (i.e., Gazebo). This paper provides background context about the current state of ROS software and its supporting community, surveys DOE-EM needs and requirements for robotic solutions, and analyzes the gaps between the current state of ROS and those needed for DOE-EM robotics. It then identifies new capabilities that are recommended for ROS-DOE and outlines software development practices that could be leveraged to blend the best of the open-source world with high-reliability software development practices. (authors)

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

DOE OSTI2014

Re-designing the PhEDEx Security Model

PhEDEx, the data-placement tool used by the CMS experiment at the LHC, was conceived in a more trusting time. The security model provided a safe environment for site agents and operators, but offerred little more protection than that. Data was not sufficiently protected against loss caused by operator error or software bugs or by deliberate manipulation of the database. Operators were given high levels of access to the database, beyond what was actually needed to accomplish their tasks. This exposed them to the risk of suspicion should an incident occur. Multiple implementations of the security model led to difficulties maintaining code, which can lead to degredation of security over time. In order to meet the simultaneous goals of protecting CMS data, protecting the operators from undue exposure to risk, increasing monitoring capabilities and improving maintainability of the security model, the PhEDEx security model was redesigned and re-implemented. Security was moved from the application layer into the database itself, fine-grained access roles were established, and tools and procedures created to control the evolution of the security model over time. In this paper we describe this work, we describe the deployment of the new security model, and we show how these enhancements improve security on several fronts simultaneously.

Huang, C.-H.↗

DOE OSTI2021

Energy Material Network Data Hubs

In early 2015 the United States Department of Energy conceived of a consortium of collaborative bodies based on shared expertise, data, and resources that could be targeted towards the more difficult problems in energy materials research. The concept of virtual laboratories had been envisioned and discussed earlier in the decade in response to the advent of the Materials Genome Initiative and similar scientific thrusts. To be effective, any virtual laboratory needed a robust method for data management, communication, security, data sharing, dissemination, and demonstration to work efficiently and effectively for groups of remote researchers. With the accessibility of new, easily deployed cloud technology and software frameworks, such individual elements could be integrated, and the required collaboration architecture is now possible. The developers have leveraged open-source software frameworks, customized them, and merged them into a platform to enable collaborative energy materials science, regardless of the geographic dispersal of the people and resources. After five years in operations, the systems are demonstratively an effective platform for enabling research within the Energy Material Networks (EMN). This paper will show the design and development of a secured scientific data sharing platform, the ability to customize the system to support diverse workflows, and examples of the enabled research and results connected with some of the Energy Material Networks.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2024

Integrating AEAD Ciphers into Software-Defined-Storage Systems

The use of software-defined storage (SDS) systems to store sensitive data is becoming increasingly prevalent. However, these systems primarily implement security measures to ensure the confidentiality and availability of stored data, with limited consideration for the protection of its integrity. This paper outlines why this is a harmful development, as well as how integrity-protecting measures can be included into SDS systems. To demonstrate the practical challenges and opportunities of such measures, we integrated "authenticated encryption with associated data" (AEAD) ciphers into the widely used SDS system Ceph, specifically, into its block storage interface, to secure the integrity of stored data and metadata. Ultimately, we identify the characteristics that an SDS system should possess to adopt our methodology.

Mohren, David [University of New Brunswick, Canada↗

DOE OSTI2014

GridOPTICS Software System

GridOPTICS Software System (GOSS) is a middleware that facilitates creation of new, modular and flexible operational and planning platforms that can meet the challenges of the next generation power grid. GOSS enables Department of Energy, power system utilities, and vendors to build better tools faster. GOSS makes it possible to integrate Future Power Grid Initiative software products/prototypes into existing power grid software systems, including the PNNL PowerNet and EIOC environments. GOSS is designed to allow power grid applications developed for different underlying software platforms installed in different utilities to communicate with ease. This can be done in compliance with existing security and data sharing policies between the utilities. GOSS not only supports one-to-one data transfer between applications, but also publisher/subscriber scheme. To support interoperability requirements of future EMS, GOSS is designed for CIM compliance. In addition to this, it supports authentication and authorization capabilities to protect the system from cyber threats. In summary, the contributions of the GOSS middleware are as follows: A platform to support future EMS development. A middleware that promotes interoperability between power grid applications. A distributed architecture that separates data sources from power grid applications. Support for data exchange with either one-to-one or publisher/subscriber interfaces. An authentication and authorization scheme for limiting the access to data between utilities.

Akyol, BoraA↗