Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “systems security”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 487 records · Page 27
All sourcesNASA NTRSDOE OSTI
DOE OSTI2021

Proof-of-work for securing IoT and autonomous systems

A first device in a network issues a proof-of-work challenge to a second device in the network. The second device computes a cryptographic function result to satisfy a criterion indicated in the challenge. The second device returns a challenge response comprising inputs to the cryptographic function that the second device used to compute the cryptographic function result satisfying the criterion. The first device, upon receiving the challenge response, verifies that the inputs to the cryptographic function yield a result satisfying the criterion. Responsive to verifying the challenge response, the first device updates a blockchain based upon the challenge response.

Chan, Calvin↗
DOE OSTI2024

Towards Provable Security in Industrial Control Systems Via Dynamic Protocol Attestation

Industrial control systems (ICSs) increasingly rely on digital technologies vulnerable to cyber attacks. Cyber attackers can infiltrate ICSs and execute malicious actions. Individually, each action seems innocuous. But taken together, they cause the system to enter an unsafe state. These attacks have resulted in dramatic consequences such as physical damage, economic loss, and environmental catastrophes. This paper introduces a methodology that restricts actions using protocols. These protocols only allow safe actions to execute. Protocols are written in a domain specific language we have embedded in an interactive theorem prover (ITP). The ITP enables formal, machine-checked proofs to ensure protocols maintain safety properties. We use dynamic attestation to ensure ICSs conform to their protocol even if an adversary compromises a component. Since protocol conformance prevents unsafe actions, the previously mentioned cyber attacks become impossible. We demonstrate the effectiveness of our methodology using an example from the Fischertechnik Industry 4.0 platform. We measure dynamic attestation's impact on latency and throughput. Our approach is a starting point for studying how to combine formal methods and protocol design to thwart attacks intended to cripple ICSs.

97 MATHEMATICS AND COMPUTING↗
NASA NTRS1988

A 4.8 kbps code-excited linear predictive coder

A secure voice system STU-3 capable of providing end-to-end secure voice communications (1984) was developed. The terminal for the new system will be built around the standard LPC-10 voice processor algorithm. The performance of the present STU-3 processor is considered to be good, its response to nonspeech sounds such as whistles, coughs and impulse-like noises may not be completely acceptable. Speech in noisy environments also causes problems with the LPC-10 voice algorithm. In addition, there is always a demand for something better. It is hoped that LPC-10's 2.4 kbps voice performance will be complemented with a very high quality speech coder operating at a higher data rate. This new coder is one of a number of candidate algorithms being considered for an upgraded version of the STU-3 in late 1989. The problems of designing a code-excited linear predictive (CELP) coder to provide very high quality speech at a 4.8 kbps data rate that can be implemented on today's hardware are considered.

Tremain, Thomas E.↗
DOE OSTI2016

Exe-Guard Project

The exe-Guard Project is an alliance between Dominion Virginia Power (DVP), Sandia National Laboratories (SNL), Dartmouth University, and Schweitzer Engineering Laboratories (SEL). SEL is primary recipient on this project. The exe-Guard project was selected for award under DE-FOA-0000359 with CFDA number 81.122 to address Topic Area of Interest 4: Hardened platforms and Systems. The exe-Guard project developed an antivirus solution for control system embedded devices to prevent the execution of unauthorized code and maintain settings and configuration integrity. This project created a white list antivirus solution for control systems capable of running on embedded Linux® operating systems. White list antivirus methods allow only credible programs to run through the use of digital signatures and hash functions. Once a system’s secure state is baselined, white list antivirus software denies deviations from that state because of the installation of malicious code as this changes hash results. Black list antivirus software has been effective in traditional IT environments but has negative implications for control systems. Black list antivirus uses pattern matching and behavioral analysis to identify system threats while relying on regular updates to the signature file and recurrent system scanning. Black list antivirus is vulnerable to zero day exploits which have not yet been incorporated into a signature file update. System scans hamper the performance of high availability applications, as revealed in NIST special publication 1058 which summarizes the impact of blacklist antivirus on control systems: Manual or “on-demand” scanning has a major effect on control processes in that they take CPU time needed by the control process (Sometimes close to 100% of CPU time). Minimizing the antivirus software throttle setting will reduce but not eliminate this effect. Signature updates can also take up to 100% of CPU time, but for a much shorter period than a typical manual scanning process. Control systems are vulnerable to performance losses if off-the-shelf blacklist antivirus solutions aren’t implemented with care. This investment in configuration in addition to constant decommissioning to perform manual signature file updates is unprecedented and impractical. Additionally, control systems are often disconnected or islanded from the network making the delivery of signature updates difficult. Exe-Guard project developed a white list antivirus solution that mitigated the above drawbacks and allows control systems to cost-effectively apply malware protection while maintaining high reliability. The application of security patches can also be minimized since white listing maintains constant defense against unauthorized code execution. Security patches can instead be applied in less frequent intervals where system decommissioning can be scheduled and planned for. Since control systems are less dynamic than IT environments, the feasibility of maintaining a secure baselined state is more practical. Because upgrades are performed in infrequent, calculated intervals, it allows a new security baseline to be established before the system is returned to service. Exe-Guard built on the efforts of SNL under the Code Seal project. SNL demonstrated prototype Trust Anchors on the project which are independent monitoring and control devices that can be integrated into untrustworthy components. The exe-Guard team started with the lessons learned under this project then designed commercial solution for white list malware protection. Malware is a real threat, even on islanded or un-networked installations, since operators can unintentionally install infected files, plug in infected mass storage devices, or infect a piece of equipment on the islanded local area network that can then spread to other connected equipment. Protection at the device level is one of the last layers of defense in a security-in-depth defense model before an asset becomes compromised. This project provided non-destructive intrusion, isolation and automated response solution, achieving a goal of the Department of Energy (DOE) Roadmap to Secure Control Systems. It also addressed CIP-007-R4 which requires asset owners to employ malicious software prevention tools on assets within the electronic security perimeter. In addition, the CIP-007-R3 requirement for security patch management is minimized because white listing narrows the impact of vulnerabilities and patch releases. The exe-Guard Project completed all tasks identified in the statement of project objective and identified additional tasks within scope that were performed and completed within the original budget. The cost share was met and all deliverables were successfully completed and submitted on time. Most importantly the technology developed and commercialized under this project has been adopted by the Energy sector and thousands of devices with exe-Guard technology integrated in them have now been deployed and are protecting our power systems today

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2019

PV Cyber Security Research (Final Report)

Extensive deployment of interoperable distributed energy resources (DER) on power systems is increasing the power system cyber security attack surface. National and jurisdictional interconnection standards require DER to include a range of autonomous and commanded grid support functions which can drastically influence power quality, voltage, and bulk system frequency. This project was split into two phases. The first provided a survey and roadmap of the cybersecurity for the solar industry. The second investigated multiple PV cybersecurity research and development (R&D) concepts identified in the first phase. In the first year, the team created a roadmap for improving cybersecurity for distributed solar energy resources. This roadmap was intended to provide direction for the nation over the next five years and focused on the intersection of industry and government and recommends activities in four related areas: stakeholder engagement, cyber security research and development, standards development, and industry best practices. At the same time, the team produced a primer for DER vendors, aggregators, and grid operators to establish a common taxonomy and describe basic principles of cyber security, encryption, communication protocols, DER cyber security recommendations and requirements, and device-, aggregator-, and utility-level security best practices to ensure data confidentiality, integrity, and availability. This material was motivated by the need to assist the broader PV industry with cybersecurity resilience and describe the state-of-the-art for securing DER communications. Lastly, an adversary-based assessment of multiple PV devices was completed at the Distributed Energy Technologies Laboratory at Sandia National Laboratories to determine the status of industry cybersecurity practices. The team found multiple deficiencies in the security features of the assessed devices. In the second year, a set of recommendations was created for DER communication protocols— especially with respect to the state-of-the-art requirements in IEEE 2030.5. Additionally, several cybersecurity R&D technologies related to communications-enabled photovoltaic systems were studied to harden DER communication networks. Specifically, the team investigated (a) using software defined networking to create a moving target defense system for DER communications, and (b) engineering controls that prevent misprogramming or adversary action on DER devices/networks by disallowing setpoints that will generate unstable power system operations.

14 SOLAR ENERGY↗
DOE OSTI2020

Cyber Security Analysis for Nuclear Reactor Control Systems (Final Technical Report)

This project investigated the cyber-security impacts of moving from an all analog, point-to-point, instrumentation and control (I&C) system to a digital I&C system based on Modbus and a shared communication medium. A formalism called a hybrid attack graph was expanded to support the nuclear research reactor system. The hybrid attack graph allows one to check a system for vulnerabilities, in this case cyber-security vulnerabilities, and to document the attack vectors (scenarios) causing those vulnerabilities. In parallel, a simulation of the system was developed to model both the physical reactor parameters and operations, as well as the network interconnects and communications. This simulation platform was modeled on the nuclear research reactor located at Washington State University. The simulation platform provided a sandbox to evaluate and quantify the impact of identified and proposed vulnerabilities in the system and to determine the effectiveness of countermeasures at stopping these attacks. The simulation and hybrid attack graph tools were integrated to provide a streamlined process of generating attack scenarios, playing those scenarios out in the simulation, and then analyzing the results to correlate system state to states in the hybrid attack graph. This process was used to (1) quantify the impact of attack scenarios and (2) to determine if the system moved through the hybrid attack graph as anticipated. The hybrid attack graph tool was extended and customized to produce a tool to automatically identify critical assets (CAs) and critical digital assets (CDAs) as defined by NRC Regulatory Guide 5.71. This tool was verified using the nuclear research reactor at Washington State University. Finally, a series of educational modules covering the findings of the different aspects of this research have been created.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

PAS: Privacy Algorithms in Systems

Today we face an explosion of data generation, ranging from health monitoring to national security infrastructure systems. More and more systems are connected to the Internet that collects data at regular time intervals. These systems share data and use machine learning methods for intelligent decisions, which resulted in numerous real-world applications (e.g., autonomous vehicles, recommendation systems, and heart-rate monitoring) that have benefited from it. However, these approaches are prone to identity thief and other privacy related cyber-security attacks. So, how can data privacy be protected efficiently in these scenarios? More dedicated efforts are needed to propose the integration of privacy techniques into existing systems and develop more advanced privacy techniques to address the complex challenges of multi-system connectivity and data fusion. Therefore, we have introduced Privacy Algorithms in Systems (PAS) at CIKM which provides a venue to gather academic researchers and industry researchers/practitioners to present their research in an effort to advance the frontier of this critical direction of privacy algorithms in systems.

Kotevska, Olivera↗
DOE OSTI2025

Cyber-Informed Engineering (CIE) Integration into Model- Based Systems Engineering (MBSE)

Engineering design in the field of industrial engineering, such as designing automated factories or warehouses, is critical for the effective operation of facilities. Any design flaws introduced early can result in significant capital expenses to correct. However, early-stage engineering design is inherently complex. The systems are not yet built, requiring designers to integrate various aspects, including digital engineering and cybersecurity, to support virtual representations throughout the design process. In this study, we propose an approach to integrate Cyber-Informed Engineering (CIE) principles into model-based systems engineering (MBSE). This approach facilitates the development of a digital thread for engineering systems, ensuring secure digital artifacts in the design of industrial engineering systems.

42 - ENGINEERING↗
NASA NTRS2010

Pyroelectric Materials for Uncooled Infrared Detectors: Processing, Properties, and Applications

Uncooled pyroelectric detectors find applications in diverse and wide areas such as industrial production; automotive; aerospace applications for satellite-borne ozone sensors assembled with an infrared spectrometer; health care; space exploration; imaging systems for ships, cars, and aircraft; and military and security surveillance systems. These detectors are the prime candidates for NASA s thermal infrared detector requirements. In this Technical Memorandum, the physical phenomena underlying the operation and advantages of pyroelectric infrared detectors is introduced. A list and applications of important ferroelectrics is given, which is a subclass of pyroelectrics. The basic concepts of processing of important pyroelectrics in various forms are described: single crystal growth, ceramic processing, polymer-composites preparation, and thin- and thick-film fabrications. The present status of materials and their characteristics and detectors figures-of-merit are presented in detail. In the end, the unique techniques demonstrated for improving/enhancing the performance of pyroelectric detectors are illustrated. Emphasis is placed on recent advances and emerging technologies such as thin-film array devices and novel single crystal sensors.

Aggarwal, M. D.↗
DOE OSTI2021

Solvability, Operability, and Security for Cyber-Physical Systems: New Computational Methods with Revised Assumptions

In this paper discusses the use and integration of disparate but complementary tools for dealing with solvability, operability, and security challenges in Cyber-Physical Systems (CPSs): the Koopman Operator (KO) for solvability, Disjunctive Programming (DP) for operability, and Multi-Level Optimisation (MLO) for security. These methods can obviate the need for some of the traditional assumptions used in modelling CPSs. This paper demonstrates the methods' capabilities and considers ways to advance each method individually. It concludes by discussing how to integrate the different methods and identify useful synergies generated by doing so.

koopman operator, disjunctive programming, multi-l↗
DOE OSTI2026

Direct Nonlinear Approximation for Security Region Boundary of Integrated Energy Systems: A Polynomial Chaos Expansion Solution

The strong interdependence of electricity, gas, and heating systems can facilitate fault propagation within integrated energy systems (IESs), posing significant challenges to secure operation. This paper proposes a polynomial chaos expansion (PCE)-based approximation method to accurately characterize the IES security region boundary (IES–SRB). By integrating the Karush-Kuhn-Tucker conditions with PCE theory, the IES-SRB approximation problem is reformulated as a set of nonlinear equations concerning the approximation coefficients. Using the Galerkin projection method, these equations are further transformed into a system of projection equations that govern the polynomial approximation coefficients in the IES-SRB approximation. To reduce computational complexity while maintaining high approximation accuracy, a piecewise polynomial approximation method is proposed. Numerical studies on the E39-G20-H6 and E118-G96-H52 IES test systems demonstrate that the proposed method can accurately and effectively construct IES security regions.

Wu, Chenghao [Northeast Electric Power University]↗
NASA NTRS1985

Protecting intellectual property in space; Proceedings of the Aerospace Computer Security Conference, McLean, VA, March 20, 1985

The primary purpose of the Aerospace Computer Security Conference was to bring together people and organizations which have a common interest in protecting intellectual property generated in space. Operational concerns are discussed, taking into account security implications of the space station information system, Space Shuttle security policies and programs, potential uses of probabilistic risk assessment techniques for space station development, key considerations in contingency planning for secure space flight ground control centers, a systematic method for evaluating security requirements compliance, and security engineering of secure ground stations. Subjects related to security technologies are also explored, giving attention to processing requirements of secure C3/I and battle management systems and the development of the Gemini trusted multiple microcomputer base, the Restricted Access Processor system as a security guard designed to protect classified information, and observations on local area network security.

Source record↗
DOE OSTI2025

Fully Homomorphic Encryption

This code implements a Fully Homomorphic Encryption (FHE) system, enabling secure computation on encrypted data without requiring decryption. It supports encryption, decryption, and homomorphic operations like matrix multiplication and addition. This code is adaptable for integrating FHE into linear-time invariant (LTI) systems, including digital control and filtering. With proper configuration from subject matter expertise, encrypted system parameters and signals can be manipulated to perform tasks like state updates, output calculations, and convolution in the encrypted domain. By preserving the structure of LTI systems while ensuring privacy, the framework facilitates secure applications in areas such as autonomous systems, signal processing, and industrial automation. The code initializes the encryption system using parameters provided in the env dictionary. These parameters include the ciphertext modulus, key dimension, plaintext fixed-point scaling factor, and noise bound. During initialization, a secret key is generated, which is essential for encrypting and decrypting data securely. The modular design allows users to tailor these parameters to specific use cases or security requirements. The code implements multiple cryptographic schemes. The learning with errors (LWE) encryption method encodes cleartext message to their plaintext fixed-point representation then encrypted into ciphertext space with additive noise. This noise ensures the security of the scheme, relying on the computational hardness of the LWE problem. The code also includes the Gentry-Sahai-Waters (GSW) scheme based off the LWE problem. Homomorphic matrix multiplication is performed between the LWE and GSW to encrypted data. This is achieved using a decomposition function on the LWE ciphertext during the multiplication operation. For higher-dimensional data, the code includes a method to encrypt entire matrices (GSWMat) using GSW encryption. These encrypted matrices can then be used for homomorphic matrix multiplications (MatMult). The decryption function uses the secret key to recover the original plaintext, removing the added noise and scaling that was originally applied during encryption.

Lois, Roberts [Idaho National Laboratory (INL), Id↗