Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “firewall”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

36 records · Page 2

Blockchain-Based Man-in-the-Middle (MITM) Attack Detection for Photovoltaic Systems

Cybersecurity of photovoltaic (PV) systems entails a much larger scope than just encryption and firewall of communications. For instance, integrity of data in transit between inverters and a cloud server can be compromised by authorized third-party, devices, and internal network within security perimeter (i.e., man-in-the-middle (MITM) attack). To address this challenge, this paper proposes a blockchain-based MITM attack detection method for a PV system. A breakthrough method includes screening network data, network intrusion detection, and hash comparison of in-transit data using distributed ledgers. Furthermore, the proposed method is implemented in Internet-of-Thing (IoT) security modules as clients of a blockchain network and validated by experiments.

blockchain↗

Network Anomaly Detection Using Federated Learning

The internet is turning out to be an integral part of every-one's lives as more and more devices are being connected to serve societal needs. Our work is motivated by two ma-jor observations. Firstly, one drawback of connecting to the network is the threat of network attacks that can compromise users' private information, leading to data loss and adversely affecting productivity. There are several traditional security mechanisms to defend against these attacks, such as firewalls, virtual private networks (VPNs), demilitarized zones (DMZs), and vulnerability scanners. One way to prevent these attacks is early detection and prevention. However, these kinds of architecture do not scale very well because of their centralized nature. Secondly, we observe from heuristics and data set distributions that the majority of the requests made to a server are innocuous. Therefore, almost all server request data sets are highly imbalanced, weighted highly towards the harmless requests.

Marfo, William↗

Testbed and Experiments for Quantum-Conventional Networking

The realization of quantum networks requires the development of devices and methods unprecedented in conventional networks, and yet they critically depend on the latter for implementing foundational blocks and essential operations. We describe a testbed to support the development and testing of their functionality and performance by providing quantum and conventional data planes and devices, together with a secure conventional control plane. It incorporates a variety of entangled photon sources, qubit technologies, detector technologies, photonic components, and supporting conventional switches and workstations. It implements a novel fiber telescoping scheme that provides suites of connections using fiber spools and inground-aerial fiber loops. We briefly summarize a variety of experiments conducted over this testbed including: (i) flex-grid quantum connection experiments, (ii) quantum state and channel tomography, (iii) utilization of quantum key distribution keys to secure conventional encryption and firewall devices, (iv) comparative study of analytical capacity estimates and entanglement throughput, (v) deployed squeezing coexisting with conventional communications, and (iv) measurement of polarization time variation.

Rao, Nageswara [ORNL] (ORCID:0000000234085941)↗

ModuleOT

ModuleOT is an open hardware security platform which provides all features necessary for securing remote energy resources. The platform consists of a physical bump in-the wire device which runs a custom-built application built with Go and Python and leverages AES-NI Instruction set available on modern hardware for cryptographic acceleration. By combining these features, ModuleOT acts as an all-in-one low-cost solution to enable cryptographically secured communications to any critical remote servers or devices. Because the software application has been built using Golang, this source can be easily compiled for different hardware platforms. The module is designed to provide the following core features: (1) encrypted communications across an untrusted network, (2) certificate-based authentication with secure storage, (3) hardware cryptographic acceleration, (4) IP-based whitelisting, (5) local firewall management, and (6) legacy (RS485) device support.

Hasandka, Adarsh↗

Converting from NIS to Redhat Identity Management

The Jefferson Lab (Jlab) accelerator controls network has transitioned to a new authentication and network service interface. The new system uses the Redhat Identity Manager (IdM) as a single integrating front end to the Lightweight Directory Access Protocol (LDAP) and a replacement for NIS and the Kerberos authentication service. This system allows for integration of access and authentication across Unix and Windows environments and across different Jlab computing environments, including across firewalls. The decision making process, conversion steps, issues and solutions will be discussed.

McGuckin, T. S.↗

A technique to make an enterprise network a Darknet on the Internet, while providing required services to authorized users

In a well-designed and secure enterprise network, the hosts inside the network are not directly accessible from the Internet. The enterprise firewall blocks direct access to hosts inside the enterprise network and also blocks any attempts to probe or discover information about those hosts from the Internet. However, access to the enterprise network from the Internet is a must in today’s day and age. Hence, specialized mechanisms to allow secure access are implemented.

97 MATHEMATICS AND COMPUTING↗

Implementation and Demonstration of P4 Software for Improving ICS Protocol Visibility and Control [Slides]

No prior enabling funded work applicable to this proposal. Programming Protocol-independent Packet Processors (P4) is an open source, domain-specific programming language for network switching devices. P4 complements traditional Software Defined Networking (SDN) which is primarily concerned with the management of packets (e.g. routing/dropping decisions) rather than how each packet is processed. The introduction of P4 provided new capabilities (e.g. firewall, load balancing, enhanced security) but has primarily been deployed in data centers. This effort investigates ways to expand P4 into other niches such as ICS networks.

97 MATHEMATICS AND COMPUTING↗

Technical Bulletin 005: NTP Monitoring

The Center for Alternative Synchronization and Timing (CAST) views Precision Time Protocol (PTP) and Network Time Protocol (NTP) as critical elements of the grid, from generation to the grid edge. This tech bulletin discusses the operation of NTP. The document shows not only commercial but also open-source applications. In some cases, the commercial applications may already have existing feature sets to secure and monitor NTP streams. From a security standpoint, using subscription NTP is risky unless the open bidirectional ports on local firewalls and routers are properly monitored and controlled.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Zero Trust Strategies for Chemical, Biological, Radiological, and Nuclear Detection Systems: D.1 Cyber Scenarios

The evolving landscape of cybersecurity necessitates a paradigm shift to a Zero Trust (ZT) model, which assumes breaches and continuously verifies trust. This approach reshapes how trust boundaries are established, focusing on identities, devices, networks, applications, and data, rather than solely relying on perimeter defenses such as firewalls. Central to this transformation is the National Institute of Standards and Technology's (NIST) Special Publication 800-207, outlining the Zero Trust Architecture (ZTA), along with Executive Order 14028, which mandates federal agencies to adopt ZT principles. Complementary to these efforts, the Cybersecurity and Infrastructure Security Agency (CISA) developed the Zero Trust Maturity Model (ZTMM), providing a framework with five pillars and three cross-cutting capabilities to guide agencies toward enhanced cybersecurity maturity. In support of these initiatives, the DHS Countering Weapons of Mass Destruction Office (CWMD) is applying ZT principles to secure Chemical, Biological, Radiological, and Nuclear (CBRN) detection systems. Recognizing the diverse deployment models and network connectivity of these systems—from stationary, non-networked units to mobile, cloud-connected devices—the Pacific Northwest National Laboratory (PNNL) is developing cybersecurity scenarios specifically for CBRN environments. These scenarios examine various configurations and technological capabilities, offering insights into the application of ZTMM pillars in enhancing the security postures of CBRN devices. The cybersecurity scenarios presented by PNNL are hypothetical, crafted to explore theoretical situations and stimulate discussion on the potential use or compromise of CBRN detection systems in varied contexts. These narratives are illustrative and do not reference any real events or actual networks. Instead, they employ generalized reference models to highlight concepts and potential issues within CBRN security, focusing on how Zero Trust strategies can be adapted to address these challenges effectively.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗

Optimized V1G and V2G Electric Vehicle Fleet Management and Grid Transaction at Marine Corps Air Station Miramar in San Diego, CA

The overall technical goal of the project was to demonstrate an all-electric bi-directional non-tactical fleet at Marine Corps Air Station (MCAS) Miramar that was integrated and controlled with other distributed energy resources (DERs) (i.e., PV, stationary battery, and building loads) to provide resilience to critical electric loads in the event of grid outages, to minimize charging costs, and to provide economic energy resources to electricity markets. In this project, the specific, technical objectives were: 1. Demonstrate that bi-directional electric vehicles can provide critical complementary services to fixed storage batteries in microgrid applications while performing function as non-tactical vehicles. 2. Demonstrate participation of bi-directional (V2G) and unidirectional (V1G) PEVs for demand management and minimization of charging costs. 3. Demonstrate integration of multiple DERs for grid service participation. US Marine Corps Air Station (MCAS) Miramar in San Diego was the site of this electric vehicle-to-microgrid-utility grid test and demonstration project. Existing microgrid assets in this study included (1) a public works building; (2) a 30-kW rooftop photovoltaic (PV) system and (3) a separate 250 kW carport PV system. In this project, six bi-directional V2G vans were located at the MCAS Miramar’s showcase building-scale microgrid to develop and test technical capabilities that V2G can provide in microgrid applications (e.g., cost reduction and resiliency). These resources provided aggregated demand management and simulated participation in current retail DR programs. The vehicles used in this demonstration were selected because they provided functionality that MCAS Miramar needed, 15 passenger transport and facilities work cargo carrying capacity, and bi-directional charging capability that the research project required. All vehicles in this study were manufactured and distributed by VIA Motors, Inc. There were six vehicles total and each was VIA’s VTRUX eREV V2G model, a modified General Motors Chevrolet 2500 2WD van. Three of the vans were configured as passenger vans and the other three were configured as cargo vans. Each van had an on-board bi-direcrtional inverter/charger, Bel Power Solutions model 350INVCHGT150-120-240-8G nominally rated at +/-15 kW. The VIA van’s charging connector follows the J1772 charging protocol. The bi-directional EVSEs demonstrated in this study were manufactured by Coritech, Inc. Each VGI-80-AC charging station enabled enhanced V2G charging capability to a Clipper Creek CS-100 charging module. The enhanced capabilities included ethernet communication following the SEP2.0 protocol with a distributed energy resource function set and an operator screen displaying real-time SOC, voltage, and current. The VGI-80-AC charging stations are classified as level 2 with a maximum current output of 80 A or effectively 19 kW. The VIA van’s onboard charger limited the charging and discharging power to 15 kW in each direction. A control computer was installed in the EWOC and connected to an existing monitor. The V2G control communication network was a completely stand-alone closed system that did not have any connection to any other networks on the base. A cybersecure remote communication connection was created with a cellular modem, firewall hardware, and a virtual private network configuration.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Consideration of Decabromodiphenyl Ether Flame Retardant in Thermal and Radiation Aging of Crosslinked Polyethylene Cable Insulation

Decabromodiphenyl ether (decaBDE) has been used as a flame-retardant additive in nuclear-grade electrical cable insulation. However, decaBDE has been identified as a persistent, bioaccumulative and toxic (PBT) substance, leading to regulatory scrutiny. On January 6, 2021, the Environmental Protection Agency (EPA) published a final rule to phase out decaBDE. The 2021 rule set a two-year compliance deadline for “processing and distribution in commerce of decaBDE for use in wire and cable insulation in nuclear power generation facilities.” In recognition of industry concerns following a sudden discontinuation of decaBDE-containing Class 1E wire and cable essential for nuclear power operations and the time needed for qualifying the individual components using the alternative insulation technology, an extended compliance deadline was set in the finalized amendments to the 2021 rule as published by the Environmental Appeals Board on November 12, 2024. The 2024 rule set the compliance deadline for processing and distributing decaBDE-containing wire and cable insulation until the end of the service life of these materials. Since decaBDE has long been relied upon as the flame retardant in one of the most common cross-linked polyethylene (XLPE) nuclear cable insulation formulations, RSCC Firewall III insulation, questions have naturally arisen regarding whether changes in cable performance might be expected for XLPE containing a decaBDE alternative, especially for safety-related cables that must perform their safety function in a design basis event such as a loss of coolant accident.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

Holographic Space-Time and Quantum Information

The formalism of Holographic Space-time (HST) is a translation of the principles of Lorentzian geometry into the language of quantum information. Intervals along time-like trajectories, and their associated causal diamonds, completely characterize a Lorentzian geometry. The Bekenstein-Hawking-Gibbons-’t Hooft-Jacobson-Fischler-Susskind-Bousso Covariant Entropy Principle, equates the logarithm of the dimension of the Hilbert space associated with a diamond to one quarter of the area of the diamond’s holographic screen, measured in Planck units. The most convincing argument for this principle is Jacobson’s derivation of Einstein’s equations as the hydrodynamic expression of this entropy law. In that context, the null energy condition (NEC) is seen to be the analog of the local law of entropy increase. The quantum version of Einstein’s relativity principle is a set of constraints on the mutual quantum information shared by causal diamonds along different time-like trajectories. The implementation of this constraint for trajectories in relative motion is the greatest unsolved problem in HST. The other key feature of HST is its claim that, for non-negative cosmological constant or causal diamonds much smaller than the asymptotic radius of curvature for negative c.c., the degrees of freedom localized in the bulk of a diamond are constrained states of variables defined on the holographic screen. This principle gives a simple explanation of otherwise puzzling features of BH entropy formulae, and resolves the firewall problem for black holes in Minkowski space. It motivates a covariant version of the CKN [1] bound on the regime of validity of quantum field theory (QFT) and a detailed picture of the way in which QFT emerges as an approximation to the exact theory

tensor network↗

Deliver Signal Phase and Timing (SPAT) for Energy Optimization of Vehicle Cohort Via Cloud-Computing and LTE Communications

Predictive Signal Phase and Timing (SPAT) message set is one fundamental building block for vehicle-to-infrastructure (V2I) applications such as Eco-Approach and Departure (EAD) at traffic signal controlled urban intersections. Among the two complementary communication methods namely short-range sidelink (PC5) and long-range cellular radio link (Uu), this paper documents the work with long-range link: the complete data chain includes connecting to the traffic signals via existing backhaul communication network, collecting the raw signal phase state data, predicting the signal state changes and delivering the SPAT data via a geofenced service to requests over HTTP protocols. An Application Programming Interface (API) library is developed to support various cellular data transmission reduction and latency improvement techniques. An emulation-based algorithm is applied to predict the traffic signal state changes to provide adequate prediction horizon (e.g., at minimum 2 minutes) for the cohort energy optimization. In fact, the same connectivity and SPAT delivery methodology has been applied to traffic signalized intersections nationwide in the United States upon public agency approvals for access to their firewalled traffic control network and signal control systems or directly to individual controllers. This methodology proves its effectiveness and potential for rapid growth of such SPAT deliveries at mass production scale without needing infrastructure hardware retrofit or excessive communication means. To support the energy optimization of light and heavy-duty vehicle cohorts of mixed automation and propulsion systems (EV, ICE and hybrid), the connection and SPAT deliveries at two sites were completed, including public roads in Washtenaw County, Michigan and closed track test sites at American Center for Mobility (ACM) in Ypsilanti, Michigan. However, only closed test track results at ACM will be presented in this paper. A neuroevolution based optimizer is developed and implemented to control the speed of a vehicle cohort with different propulsion systems and automation levels. Closed track tests showed significant energy savings of the cohort operation.

99 GENERAL AND MISCELLANEOUS↗

Continuous Test and Transition Infrastructure for Quantum Networking for Science Complex

We propose a network architecture with a separate quantum dataplane and a conventional control plane: (a) Quantum Data Plane: The Quantum Data plane consists of links of dark fibers connecting quantum switches and repeaters, which in turn, connect to quantum computers, memory and sensors. Since the current reach is limited to local areas, it will begin as a collection of site networks at laboratories, (b) Conventional Control Plane: The Control plane provides management access to quantum devices for configuration and provisioning via control nodes with firewall and encryption capabilities. Continuous Test and Transition Infrastructure: We propose an infrastructure with a control plane connecting multiple sites via encrypted tunnels over conventional networks consisting of the following: (a) Site Quantum Networks: Individual site networks supported by their fiber plants connect laboratories that house and connect to their quantum devices for testing and interoperability.(b) Site Control Planes: Sites are connected over individual control planes with control hosts with Software Defined Networking capabilities, which can be peered with other networks via ESnet.(c) Progressive Expansion: Initially, sites will develop individual data planes with their specific quantum devices and fiber connections, and mechanisms to interface with conventional networks. They progressively expand and interconnect, under a wide-area ecosystem of peered control planes for device testing, interoperability development and roll off into production environments.

Rao, Nageswara S.↗

EVALUATING NUCLEAR SECURITY IMPLICATIONS OF THE SPLINTERNET

The internet, which for years has been viewed as a global online commons with standardized protocols but few regulations is, according to some experts, starting to mirror the contentious political and commercial contours of the physical world. Contributing to this is the rise in data breaches, cyber-enabled attacks on critical infrastructure, government surveillance operations, theft of intellectual property, manipulation of electoral processes, and perceived erosion of privacy, all of which are resulting in a growing skepticism that an open internet will naturally serve the best interests of users, communities, countries, and the global economy. In addition, the rapidly emerging and increasingly lucrative power of data has global superpowers scrambling to protect their informational sovereignty as an urgent matter of national security. Underscoring this urgency is the fact that, despite its global reach and cosmopolitan contributor base, internet infrastructure and governance of the World Wide Web remain largely under U.S. corporate auspices, which reinforces the perception of U.S. control. Whether fragmentation is politically, economically, or socially motivated, there appears to be a growing appetite for an internet that is partitioned and controlled at the national level. From “the Great Firewall of China” to the “Halal” internet of Iran, the trend towards a “Splinternet” has courts and governments embarking on what some call a "legal arms race" to impose a maze of national or regional rules, often conflicting, in the digital realm. The paper explores the emerging Splinternet phenomenon, analyses the implications of this trend on nuclear security, and identifies questions that present opportunities for future research.

Internet, Data Security, Cyber Security, Nuclear S↗

AI-based Detection and Defense Against Cyberattacks in Distributed Energy Resources

This study will provide comprehensive artificial intelligence (AI)-based solution tools for network security, malware prevention, and sensor data anomaly detection for distributed energy resource (DER) research, development, and demonstration. DER technologies are energy systems (e.g., solar panels, wind turbines, and energy storage systems) that are often connected to the internet and thus vulnerable to cyberattacks. Cybersecurity should be of primary concern for DERs, which is why we propose an integrated multi-layer cyber-defense system for DERs. This system encompasses risk assessments, network security, malware prevention, and detection of anomalies in the sensor data. Implementation of a comprehensive risk assessment with an overview of the model architecture should be the primary step, and should include the potential impact of experiencing, at a given time, one or more cyberattacks on the system. The second step is to ensure that the network security includes firewalls, intrusion detection, and malware prevention. The third step is to provide solution tools that enable sensor data anomaly detection for DERs. By incorporating these considerations into DER research, development, and demonstration, organizations can help ensure the safety and security of their systems and protect against potential cyberattacks.

20 FOSSIL-FUELED POWER PLANTS↗

Black hole cannibalism

Here, we consider a version of the Hayden–Preskill thought experiment in which the message thrown into the black hole is itself a smaller black hole. We then discuss the implications of the existence of a recovery channel for this black hole message at asymptotic infinity, resulting in a sharpening of the black hole information paradox for observers who never need to approach a horizon. We suggest decoherence mechanisms as a way of resolving this sharpened paradox.

72 PHYSICS OF ELEMENTARY PARTICLES AND FIELDS↗

Data Movement Categories

We have endeavored to classify the commonly seen data movement needs, as observed in data-intensive institutions (both commercial and non-profit), into four categories. Knowing how to map a data movement task into one of the four categories helps select proper data mover tools. For each category, how the data storage is involved, high-level examples and the nature of typical solutions are described. Finally, some general remarks are provided to help further orient readers new to this field - the 4th IT pillar.

99 GENERAL AND MISCELLANEOUS↗