Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “source authentication”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 37 records · Page 2

Investigating Secondary Aerosol Processes in the Amazon through Molecular-level Characterization of Semi-Volatile Organics

In areas where biogenic emissions are oxidized in the presence of anthropogenic pollutants, it has become increasingly apparent that secondary organic aerosol (SOA) formation from biogenic volatile organic compounds (BVOCs) is substantially enhanced. The Amazon forest is the dominant source of BVOCs globally, and the forest is rapidly being converted to urban and agricultural uses. We participated in a collaborative field study located in the Amazon region around Manaus, Brazil, in 2014 (Green Ocean Amazon; GoAmazon). This study was designed to comprehensively examine how BVOC emissions (specifically, the most highly emitted non-methane hydrocarbon, isoprene, and lesser studied sesquiterpenes) and their interaction with anthropogenic pollution (i.e., nitrogen oxides, sulfur dioxide, and black carbon) alter the atmosphere’s oxidative capacity, influence secondary aerosol formation, atmospheric composition and, ultimately, affect the earth’s radiation balance and climate. We provide the first hourly, in-situ measurement of 30 sesquiterpenes and 4 diterpenes, roughly estimating that sesquiterpene oxidation contributes to 10-14% of ozone reactive loss by terpenes and at least 0.4–5% (median 1 %) of total submicron OA mass. However, this is likely a low-end estimate, as evidence for additional unaccounted sesquiterpenes and their oxidation products clearly exists. We also provide new perspectives on sulfate, NO x , and particle acidity influencing isoprene-derived SOA, comparing the central Amazon environment with Southeastern U.S.A. summer, representing clean to polluted conditions, respectively. We find that summed concentrations of isoprene-derived SOA tracers correlated with particulate sulfate spanning three orders of magnitude, suggesting that 1 μg m -3 reduction in sulfate corresponds with at least ~0.5 μg m -3 reduction in isoprene-derived SOA. We also find that SOA mass derived from isoprene oxidation in the presence of NO x is primarily comprised of aerosol sulfate bound with isoprene oxidation products (i.e. organosulfates), ~97% in the Amazon and ~55% in the Southeastern U.S. We infer under natural conditions in high isoprene emission regions, preindustrial aerosol sulfate was almost exclusively isoprene-derived organosulfates, which are traditionally thought as representative of anthropogenic influence. We further report the first field observations showing that particle acidity impacts the distribution of isoprene oxidation tracers in the gas and particle phases, providing physicochemical insight into isoprene SOA formation chemistry. Coupled with other co-located measurements by the DOE Atmospheric Radiation Measurement (ARM) team and collaborating PIs at our measurement site (called T3), on the G1 aircraft, and at additional field sites (T0, T1, T2) this data set has been used to understand emission, oxidation, and particle formation pathways at the molecular level, to elucidate how these pathways change when influenced by anthropogenic sources, and to evaluate their importance for the atmospheric budget of aerosols and the earth’s radiation balance on regional scales. Recommendations: Further constraint of the role of sesquiterpenes on ozone (O 3 ) reactivity and SOA formation is limited by the availability of authentic standards and synthesized compounds of sesquiterpenes and their oxidation products. Future research efforts should focus on making such standards available via custom synthesis to allow for accurate quantification and focused oxidation experiments that will fully elucidate the chemistry of these compounds in the atmosphere. Further, reductions in aerosol sulfate (via SO 2 emissions control) continues to be one of the most effective methods to reduce SOA formation from isoprene, but the concerted role of ammonia (NH 3 ) gas emissions from (agricultural) industry and other sources requires more investigation to better understand the role of aerosol acidity in SOA formation and potential controls. As GoAmazon particles can be more acidic compared to areas with greater anthropogenic NH 3 emissions, this promotes relatively greater organosulfate (OS) formation from isoprene even in the presence of NO x . Because OS and inorganic sulfate differ in water uptake properties, this implies preindustrial aerosol sulfate (albeit less abundant) may have been less reflective than current earth system models assume. Further research should investigate the radiative impacts of organic vs inorganic sulfate in aerosols to improve model representation. Finally, future work (currently underway) should include constraint of the contributions of monoterpene (C 10 H 16 ) BVOCs and biomass burning VOCs as precursors to SOA formation in the region as well as their impacts on radiative forcing in the climate system.

54 ENVIRONMENTAL SCIENCES↗

Simple, Secure, Internet Delivery of MOOSE-based Applications

Application packaging and distribution are the final steps for delivering software to end-users; both are frequently neglected when creating scientific software. Commercial businesses rely on electronic distribution systems that have rendered disk drives obsolete. Still, national laboratories continue to rely heavily on removable media to distribute and limit access to controlled applications. With increasing concerns of unauthorized copying of sensitive applications, a modern distribution system that utilizes cryptographically secure communication and authentication protocols has been developed. This new distribution system will secure the chain of custody for nuclear software while simultaneously simplifying access to these tools. This report summarizes four primary advancements made toward the secure distribution of Nuclear Energy Advanced Modeling and Simulation (NEAMS)-developed, Multiphysics Object Oriented Simulation Environment (MOOSE)-based applications: application installation, package distribution, automated package building, and distribution of documentation. NEAMS is currently developing more than ten separate applications based on the open-source MOOSE Framework. Distribution of these applications has primarily been accomplished by distributing source code, with end-users compiling the applications themselves. This work created a mechanism where MOOSE applications can be installed in a similar way to any other software. This allows both administrators and end-users simplified access to runnable executables. With this new installation capability, it was then possible to rethink distribution. A new, secure capability for delivering MOOSE-based applications over the internet has been created. This system requires unique cryptographic tokens for authentication, greatly securing the custody chain for software. Once granted access, installation of any NEAMS code can be accomplished with these terminal commands: "conda install ncrc" "ncrc install ncrc-bison." After these two commands (and authenticating) the BISON application will be securely down- loaded from Idaho National Laboratory (INL)’s servers, installed, and ready to use. To enable this new distribution capability to be successful, the open-source Continuous Integration, Verification, Enhancement, and Testing (CIVET) Continuous Integration (CI) capability was augmented to add Continuous Delivery (CD). CD enables the automated building and packaging of MOOSE-based applications as they are modified by development teams, ensuring that our customers can obtain up-to-date versions of the software at any time. The need for instruction on how to use these applications was addressed through modifications to the MOOSE documentation system. The MooseDocs capability, which enables robust documentation of MOOSE-based applications, has been extended to allow both for the installation of documentation and the packaging of documentation with installed applications. Together, these enhancements form the core of a new, secure distribution mechanism for nuclear simulation tools. In concert with the Nuclear Computational Resource Center (NCRC), NEAMS- developed applications will now be straightforward to obtain securely.

97 MATHEMATICS AND COMPUTING↗

ModuleOT

ModuleOT is an open hardware security platform which provides all features necessary for securing remote energy resources. The platform consists of a physical bump in-the wire device which runs a custom-built application built with Go and Python and leverages AES-NI Instruction set available on modern hardware for cryptographic acceleration. By combining these features, ModuleOT acts as an all-in-one low-cost solution to enable cryptographically secured communications to any critical remote servers or devices. Because the software application has been built using Golang, this source can be easily compiled for different hardware platforms. The module is designed to provide the following core features: (1) encrypted communications across an untrusted network, (2) certificate-based authentication with secure storage, (3) hardware cryptographic acceleration, (4) IP-based whitelisting, (5) local firewall management, and (6) legacy (RS485) device support.

Hasandka, Adarsh↗

Fermilab s Transition to Token Authentication

Fermilab is the first High Energy Physics institution to transition from X.509 user certificates to authentication tokens in production systems. All of the experiments that Fermilab hosts are now using JSON Web Token (JWT) access tokens in their grid jobs. Many software components have been either updated or created for this transition, and most of the software is available to others as open source. The tokens are defined using the WLCG Common JWT Profile. Token attributes for all the tokens are stored in the Fermilab FERRY system which generates the configuration for the CILogon token issuer. High security-value refresh tokens are stored in Hashicorp Vault configured by htvault-config, and JWT access tokens are requested by the htgettoken client through its integration with HTCondor. The Fermilab job submission system jobsub was redesigned to be a lightweight wrapper around HTCondor. For automated job submissions a managed tokens service was created to reduce duplication of effort and knowledge of how to securely keep tokens active. The existing Fermilab file transfer tool ifdh was updated to work seamlessly with tokens, as well as the Fermilab POMS (Production Operations Management System) which is used to manage automatic job submission and the RCDS (Rapid Code Distribution System) which is used to distribute analysis code via the CernVM FileSystem. The dCache storage system was reconfigured to accept tokens for authentication in place of X.509 proxy certificates. As some services and sites have not yet implemented token support, proxy certificates are still sent with jobs for backwards compatibility but some experiments are beginning to transition to stop using them. There have been some glitches and learning curve issues but in general the system has been performing well and is being improved as operational problems are addressed.

Dykstra, David↗

Fermilab's Transition to Token Authentication

Fermilab is the first High Energy Physics institution to transition from X.509 user certificates to authentication tokens in production systems. All the experiments that Fermilab hosts are now using JSON Web Token (JWT) access tokens in their grid jobs. Many software components have been either updated or created for this transition, and most of the software is available to others as open source. The tokens are defined using the WLCG Common JWT Profile. Token attributes for all the tokens are stored in the Fermilab FERRY system which generates the configuration for the CILogon token issuer. High security-value refresh tokens are stored in Hashicorp Vault configured by htvault-config, and JWT access tokens are requested by the htgettoken client through its integration with HTCondor. The Fermilab job submission system jobsub was redesigned to be a lightweight wrapper around HTCondor. The grid workload management system GlideinWMS which is also based on HTCondor was updated to use tokens for pilot job submission. For automated job submissions a managed tokens service was created to reduce duplication of effort and knowledge of how to securely keep tokens active. The existing Fermilab file transfer tool ifdh was updated to work seamlessly with tokens, as well as the Fermilab POMS (Production Operations Management System) which is used to manage automatic job submission and the RCDS (Rapid Code Distribution System) which is used to distribute analysis code via the CernVM FileSystem. The dCache storage system was reconfigured to accept tokens for authentication in place of X.509 proxy certificates. As some services and sites have not yet implemented token support, proxy certificates are still sent with jobs for backwards compatibility, but some experiments are beginning to transition to stop using them.

Dykstra, Dave [Fermilab] (ORCID:0000000326539015)↗

Verifying Cyber Implementation Best Practices With Malcolm

Network traffic analysis can reveal a lot about what's right or wrong with a network's cybersecurity footing. Using Malcolm, a powerful open-source network traffic analysis tool suite for network security monitoring, cyber analysts and asset owners can validate cybersecurity best practices and uncover red flags in network configuration, including: proper network segmentation east-west (cross-segment) and north-south traffic unsecure or outdated network protocols authentication using clear text credentials rogue devices and services unexpected protocols (e.g., IPv6, DNS, DHCP, update checks, etc.) suspicious file transfers

99 GENERAL AND MISCELLANEOUS↗

A Prototype Software to Demonstrate a Data Catalog for Hanford Environmental Datasets

Ensuring that data on long-term environmental remediation at the Hanford Site is high-quality, traceable, and easily accessible is an ongoing challenge, complicated by decades of data collection, multiple contractors maintaining data sources, and the wide range of data types. A centralized data catalog, known as the Hanford Environmental Information and Data Index (HEIDI), has been under development as part of the Hanford Environmental Data Management (HEDM) program to address these challenges. HEIDI fulfills a critical need to bring together a wide range of data types and sizes from multiple authoritative data sources, while documenting the data pedigree and quality information (i.e., traceable to the data source/originator). This document describes additional development and maturation of the HEIDI prototype. Key accomplishments included deploying the catalog software, Esri Geoportal Server, on a server accessible to Hanford Local Area Network users, conducting cybersecurity evaluations, investigating integrated authentication solutions, and conducting functional testing of the catalog prototype. The server-based deployment enabled targeted feedback, leading to enhancements including improved accessibility features and an expanded metadata schema. Specifications for the server-based deployment of the prototype catalog and the HEIDI metadata schema are provided in this document to support subsequent HEIDI deployment by the U.S. Department of Energy Richland Operations Office.

54 ENVIRONMENTAL SCIENCES↗

A multimodal and integrated approach to interrogate human kidney biopsies with rigor and reproducibility: guidelines from the Kidney Precision Medicine Project

Comprehensive and spatially mapped molecular atlases of organs at a cellular level are a critical resource to gain insights into pathogenic mechanisms and personalized therapies for diseases. The Kidney Precision Medicine Project (KPMP) is an endeavor to generate three-dimensional (3-D) molecular atlases of healthy and diseased kidney biopsies by using multiple state-of-the-art omics and imaging technologies across several institutions. Obtaining rigorous and reproducible results from disparate methods and at different sites to interrogate biomolecules at a single-cell level or in 3-D space is a significant challenge that can be a futile exercise if not well controlled. Here we describe a “follow the tissue” pipeline for generating a reliable and authentic single-cell/region 3-D molecular atlas of human adult kidney. Our approach emphasizes quality assurance, quality control, validation, and harmonization across different omics and imaging technologies from sample procurement, processing, storage, shipping to data generation, analysis, and sharing. We established benchmarks for quality control, rigor, reproducibility, and feasibility across multiple technologies through a pilot experiment using common source tissue that was processed and analyzed at different institutions and different technologies. A peer review system was established to critically review quality control measures and the reproducibility of data generated by each technology before their being approved to interrogate clinical biopsy specimens. The process established economizes the use of valuable biopsy tissue for multiomics and imaging analysis with stringent quality control to ensure rigor and reproducibility of results and serves as a model for precision medicine projects across laboratories, institutions and consortia.

59 BASIC BIOLOGICAL SCIENCES↗

ToF-SIMS evaluation of PEG-related mass peaks and applications in PEG detection in cosmetic products

Polyethylene glycols (PEGs) are used in industrial, medical, health care, and personal care applications. The cycling and disposal of synthetic polymers like PEGs pose significant environmental concerns. Detecting and monitoring PEGs in the real world calls for immediate attention. This study unveils the efficacy of time-of-flight secondary ion mass spectrometry (ToF-SIMS) as a reliable approach for precise analysis and identification of reference PEGs and PEGs used in cosmetic products. By comparing SIMS spectra, we show remarkable sensitivity in pinpointing distinctive ion peaks inherent to various PEG compounds. Moreover, the employment of principal component analysis effectively discriminates compositions among different samples. Notably, the application of SIMS two-dimensional image analysis visually portrays the spatial distribution of various PEGs as reference materials. The same is observed in authentic cosmetic products. The application of ToF-SIMS underscores its potential in distinguishing PEGs within intricate environmental context. ToF-SIMS provides an effective solution to studying emerging environmental challenges, offering straightforward sample preparation and superior detection of synthetic organics in mass spectral analysis. These features show that SIMS can serve as a promising alternative for evaluation and assessment of PEGs in terms of the source, emission, and transport of anthropogenic organics.

36 MATERIALS SCIENCE↗

Module-OT: A Hardware Security Module for Operational Technology

Increased penetration levels of renewable energy and other types of distributed energy resources (DERs) on the modern electric grid-combined with technological advancements for electric system monitoring and control-introduce new cyberattack vectors and increase the cyberattack surface of energy systems. According to the IEEE Std. 1547-2018, DERs must use Modbus, Distributed Network Protocol 3 (DNP3), or Smart Energy Profile 2.0 (SEP2) as their communication protocol. Previous research identified several vulnerabilities and security breaches in each one of these communication protocols; despite this, existing standards for DERs do not recommend cybersecurity measures. In order to reduce vulnerabilities in power distribution systems, this paper presents a novel open-source hardware security module that improves both information and operational security to better protect data and communications on the distribution grid. The security hardware is called “module for operational technology,” or simply Module-OT, and it has been validated and tested in an emulated distribution system application. Module-OT is integrated within a communication system in the transport layer of the Open Systems Interconnection (OSI) model. It improves system security through encryption, authentication, authorization, certificate management, and user access control. The main advancement of Module-OT is the addition of hardware cryptographic acceleration that improves the overall communication performance in terms of end-to-end latency.

70 PLASMA PHYSICS AND FUSION TECHNOLOGY↗

Oak Ridge National Laboratory Technical Input for the Nuclear Regulatory Commission Review of the 2017 Edition of ASME Section III, Division 5, ‘High Temperature Reactors’

To assist the Nuclear Regulatory Commission in its decision making on endorsement of the American Society for Mechanical Engineers Boiler and Pressure Vessel Code Section III, Division 5 (2017 Edition) for development of advanced non-light water reactors, the following Division 5 portions were reviewed: Article HBB-2000 Material; Article HCB-2000 Material; Article HGB-2000 Material; Mandatory Appendix HBB-I-14 Tables and Figures; and, Nonmandatory Appendix HBB-U Guidelines for Restricted Material Specifications to Improve Performance in Certain Service Applications. In addition to the 2017 Edition, the same parts of the 2019 Edition have also been reviewed as indicated in various sections of the report. This review was conducted by a collaboration of national laboratory and private sector participants with significant industrial experience, including some heavy lifting and deep diving from Clarus Consulting, LLC., all intended to achieve an objective, independent, and practical perspective. The report provides recommendations, descriptions of the evaluation methods, and the source references for the data used. To build confidence required for endorsement of the Code, this review was conducted as a verification and validation of the above Code contents. The objective of verification is to ensure that the Code is free of error – direct or implied; contains the information needed for its use, including proper coverage of the Code-specified materials for the intended application, and completeness and adequacy of references to other portions of the Code. The objective of validation is to authenticate that the Code tabulations and graphs represent design inputs consistent with what are determined using rules and methods specified by the Code. The authentication process used data that were assembled and/or generated independent of Code development, while the methods of analysis followed Code-specified methods where appropriate. The designated portions for this review cover the five alloys codified for high temperature reactor applications in Division 5, i.e. 316 SS, 304 SS, 800H, 2¼Cr-1Mo, and 9Cr-1Mo-V, regarding their general requirements, permitted specifications and design stress intensity values for pressure-retaining applications, deterioration in service, fatigue acceptance test, permissible weld materials, tensile and yield strength, expected minimum stress-to-rupture values (including for Alloy 718), weld stress rupture factors, permissible materials for bolting use, and restricted specifications in certain service applications. Additionally, stress intensity values for bolting materials including 316 SS, 304 SS and alloy 718 were reviewed. Analysis and discussion are also provided on contents outside of these designated Code portions where it was deemed relevant and necessary to develop a technically sound understanding of issues relating to the designated portions. Due to unavailability of sufficient test data on welds during the review period, the weld stress rupture factors in Tables HBB-I-10.14A to E, which cover a total of ten tables for the five alloys welded with twenty-eight different weld metals (some with similar properties), have been deferred to a future review effort. The review identified mainly two types of issues. The first type includes instances where the Code is found factually incomplete or incorrect, such as obsolete materials specifications listings, missing tabulation of stresses for bolting. Changes to the Code are recommended in these cases. The second type of issue includes instances where the Code tabulations and graphs are found to be less conservative than the review analysis results. In these cases, recommendations are made for further review and consideration where the difference in conservatism exceeds 10%, which is our threshold for questioning technical adequacy, meriting a risk assessment by the Nuclear Regulatory Commission and/or reactor designers. It is noted that this effort has been executed using all available data and established methods of analysis, including methods and criteria specified and used by the Code. As such, the findings that are presented in quantitative detail, in a format for convenient comparison with the Code, and with identification of where further review is recommended, should provide a sound technical basis for decisions about quantifying the implications of the reduced design margins and technical adequacy/inadequacy to form a basis for conditioning specific Code tabulation values on endorsement. Recommendations for specific changes to the Code, however, entail design conservatism considerations beyond the scope of this review effort, and are not made in this report.

22 GENERAL STUDIES OF NUCLEAR REACTORS↗

DeepLynx Ecosystem 2025

Poor data integration and governance continue to plague complex engineering projects, resulting in missed cost, schedule, and performance targets. Departments operate in isolated systems with manual data exchange, creating fragmented information that compounds errors and leads to significant delays and cost overruns. The DeepLynx ecosystem addresses these challenges through an open-source, modular data management platform that transforms fragmented project data into an integrated digital thread. Built on a federated microservice architecture, the ecosystem comprises seven specialized tools centered around DeepLynx Nexus, a unified data catalog with hierarchical organization and graph-based navigation capabilities. The ecosystem includes: DeepLynx Stream for real-time timeseries data ingestion from industrial sources; DeepLynx Ingest for governed data uploads with formal review workflows; DeepLynx Lattice for ontology-based entity and relationship extraction; DeepLynx Run for workflow orchestration and secure AI/ML compute; DeepLynx Visualize for 3D digital twin visualization; and DeepLynx Insight for AI-assisted document analysis with traceable, grounded responses. Deployable in cloud, on-premise, or hybrid environments using containerized Docker applications and Helm charts, the DeepLynx ecosystem provides flexible infrastructure that adapts to organizational requirements. By consolidating project data into a unified data lake with role-based access controls and OAuth2 authentication, DeepLynx enables digital thread and digital twin capabilities that improve decision-making, reduce risk, and support complex engineering workflows throughout the project lifecycle.

42 - ENGINEERING↗

Cyber–Physical System Security of Distribution Systems

The Information and Communications Technology (ICT) for control and monitoring of power systems is a layer on top of the physical power system infrastructure. The cyber system and physical power system components form a tightly coupled Cyber–Physical System (CPS). Sources of vulnerabilities arise from the computing and communication systems of the cyber–power grid. Cyber intrusions targeting the power grid are serious threats to the reliability of electricity supply that is critical to society and the economy. In a typical Information Technology environment, numerous attack scenarios have shown how unauthorized users can access and manipulate protected information from a network domain. The need for cyber security has led to industry standards that power grids must meet to ensure that the monitoring, operation, and control functions are not disrupted by cyber intrusions. Cyber security technologies such as encryption and authentication have been deployed on the CPS. Intrusion or anomaly detection and mitigation tools developed for power grids are emerging. Furthermore, this survey paper provides the basic concepts of cyber vulnerabilities of distribution systems and CPS security. The important ICT subjects for distribution systems covered in this paper include Supervisory Control And Data Acquisition, Distributed Energy Resources, including renewable energy and smart meters.

97 MATHEMATICS AND COMPUTING↗

Quantum Chemistry Calculations for Metabolomics

A primary goal of metabolomics and exposomics studies is to fully characterize the small molecule composition of complex biological and environmental samples. However, despite advances in analytical technologies over the past two decades, the majority of small molecules in complex samples are not readily identifiable due to the immense structural and chemical diversi-ty present within the metabolome and exposome. Current gold-standard identification methods rely on reference libraries built using authentic chemical materials (“standards”), which are not available for most molecules. Computational quantum chemis-try methods, which can be used to calculate chemical properties that are then measured by analytical platforms, offer an alter-native route for building reference libraries, i.e., in silico libraries for “standards-free” identification. In this review, we cover the major roadblocks currently facing metabolomics and discuss applications where quantum chemistry calculations offer a solu-tion. Several successful examples for nuclear magnetic resonance spectroscopy, ion mobility spectrometry, infrared spectros-copy, and mass spectrometry methods are reviewed. Finally, we consider current best practices, sources of error, and provide an outlook for quantum chemistry calculations in metabolomics and exposomics studies. We expect this review will inspire researchers in the field of small molecule identification to accelerate adoption of in silico methods for generation of reference libraries and to add quantum chemistry calculations as another tool at their disposal to characterize complex samples.

Metabolism↗

A Privacy-Preserving Cyber Threat Intelligence Sharing System

Cyber Threat Intelligence (CTI) is a key resource for developing defensive strategies against potential cyber adversaries. Entities typically access CTI through open-source platforms, national agencies, or specialized commercial services. However, the bi-directional exchange of CTI is hindered by organizational trust boundaries, which complicate the sharing processes between entities and CTI providers. Centralized CTI services benefit from receiving suspicious cyber observables such as IP addresses, domain names, and email addresses from various entities. The aggregation allows for the correlation of widespread adversarial activities to enhance the alert and response mechanisms across the network of involved parties. Despite these benefits, openly sharing such observables incurs potential legal, regulatory, and reputational risks for the disclosing entities.This paper introduces a system designed to facilitate the secure exchange of cyber observables across trust boundaries without compromising the anonymity of the sharing entities. Here, we propose an architecture that leverages common web protocols alongside zero-knowledge proofs to authenticate members while maintaining anonymity. Additionally, we outline a privacy model tailored for STIX (Structured Threat Information eXpression) cyber observables to minimize the risk of inadvertently disclosing private information. Through our threat models, we assess the privacy implications of our proposed system and demonstrate its potential to enhance collaborative cyber defense efforts without exposing entities to undue risk.

BBS+ Signatures↗

Secure Command Line Solution for Token-based Authentication

The WLCG is modernizing its security infrastructure, replacing X.509 client authentication with the newer industry standard of JSON Web Tokens (JWTs) obtained through the Open ID Connect (OIDC) protocol. There is a wide variety of software available using the standards, but most of it is for Web browser-based applications and doesn’t adapt well to the command line-based software used heavily in High Throughput Computing (HTC). OIDC command line client software did exist, but it did not meet our requirements for security and convenience. This paper discusses a command line solution we have made based on the popular existing secrets management software from Hashicorp called vault. We made a package called htvault-config to easily configure a vault service and another called htgettoken to be the vault client. In addition, we have integrated use of the tools into the HTCondor workload management system, although they also work well independent of HTCondor. All of the software is open source, under active development, and ready for use.

Dykstra, Dave↗

Latency Analysis of the Nexus Digital Twin Framework

Real-time digital catalogs are increasingly relied upon to track metadata and connect disparate data sources for cloud-based data integration efforts. One such tool, Deeplynx Nexus is supporting real-time digital twin efforts through event-driven data integration and time-series queries. Nexus’s usefulness for these applications depends critically on how quickly individual records can be uploaded and downloaded, since delays directly affect the responsiveness of any system built on top of it. However, the actual latency a user should expect from Nexus has not been systematically measured before, particularly for the small, frequent transactions typical of live sensor feeds. Here we show that single-record round-trip latency is 61.1 ms on a local Nexus instance and 391.7 ms on the hosted production infrastructure, a roughly 6.4x difference driven primarily by fixed per-request overhead rather than data volume. This overhead dominates at small scale: comparing single-record and ten-record trials suggests approximately 56 ms of each single-record request is fixed connection and authentication cost rather than data-transfer time, meaning batching even a handful of records is substantially more efficient than transmitting them individually. At large batch sizes, this pattern reverses for uploads, which converge to near parity between local and hosted environments by 25,000-50,000 records, while download latency remains persistently 5.7-6.4x slower on hosted infrastructure even at scale. These results suggest that Nexus deployments intended for real-time digital twin applications should prioritize record batching over single-record transactions, and that download-path optimization on hosted infrastructure offers the largest remaining opportunity to reduce latency at scale. We anticipate these baseline measurements will serve as a reference point for future digital twin projects evaluating whether Nexus’s latency profile meets their real-time requirements, and as a benchmark for tracking the effect of future infrastructure or API changes.

99 - GENERAL AND MISCELLANEOUS↗

Reanalysis of Water Withdrawal for Irrigation, Electric Power, and Public Supply Sectors in the Conterminous United States, 1950–2016

Accurately measuring water use by the economy is essential for developing reliable models of water resource availability. Indeed, these models rely on retrospective analyses that provide insights into shifting human population demands and adaptions to water shortages. However, accurate, methodologically consistent, empirically authentic, and spatiotemporally comprehensive historical datasets for water withdrawals are scarce. Herein, we present a reanalysis of annual resolution (1950–2016) historical data set on irrigation, electric power, and public supply water withdrawal within the conterminous United States (US) at the county-level, and, for power plants, at the site-level. To estimate electric power water use, we synthesized a historically comprehensive list of generators and historic patterns in generation across fuels, prime movers, and cooling technologies. Irrigation water use estimation required building a crop-demand model that utilized historical information on irrigated acreage for crops and golf courses, stage-specific crop water demand, and climate information. To estimate public water supply use, we developed a random forest model constructed from information on population, infrastructure, climate, and land cover. These estimates generally agree with total county and state water use information provided by the US Geological Survey (USGS) water use circular and estimates generated from independent studies for specific years. However, we also observed discrepancies between our estimates and USGS data that appear to be caused by inconsistencies in the methods used by the USGS's primary data sources at the state level over decades of data collection, highlighting the importance of reanalysis to yield spatiotemporally consistent and intercomparable estimates of water use.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗