Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Attack surface management”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

41 records · Page 3

Sticky roots--implications of widespread, cryptic, viral infection of plants in natural and managed ecosystems for soil carbon processing in the rhizosphere

Plants strongly influence soil properties through rhizodeposition, in which exudates diffuse from roots, additional secretions are actively released, and root cells are sloughed into the soil. This contribution by plants of carbon compounds belowground is at the core of soil health, water holding capacity, and the soil carbon storage that pulls carbon dioxide out of the atmosphere. Once in soil, organic matter can bind with minerals such as iron hydroxides, where it can be protected from microbial attack for millenia, preserving very large terrestrial soil carbon pools. However, those same compounds contributed by roots to soil may also destabilize the long-term protective associations of SOM with minerals, making that soil organic matter (SOM) more vulnerable to microbial attack and decomposition. Plant roots thus influence both the buildup and breakdown of soil carbon pools. DOE’s E3SM Land Model (ELM) includes a representation of soil carbon storage on minerals, but the potential vulnerability of SOM–mineral associations to effects of rhizodeposition is not yet represented in ELM. To begin testing for this effect of rhizodeposition on soil carbon storage and decomposition, we worked to develop a novel approach during this TES Exploratory project DE-SC0019142 – we harnessed the power of plant viral infection. We examined whether plant virus infection can serve as a tool to intensify rhizodeposition at the root surface, and therefore possibly intensify mobilization of SOM from minerals making it visible to our analytical techniques. Viral infection is widespread in terrestrial ecosystems; 25-70% of plants have virus infection, yet the influence of such infection on root traits and terrestrial soil carbon dynamics remains largely unexplored. We used two plant hosts: the annual Avena sativa (oats) and the genetically tractable, model grass Brachypodium distachyon. These grasses were infected with the broad host range virus Barley Yellow Dwarf Virus (BYDV) via aphids (Rhopalosiphum padi). BYDV infects at least 150 grass species in agricultural and natural ecosystems, and in previous experiments, oats infected with BYDV had roots that were very sticky to the touch, strongly suggesting that infection altered rhizodeposition. We developed this new experimental approach mostly in a one virus (Barley Yellow Dwarf Virus)–one plant (Avena sativa) system. (Several effects of infection in a Brachypodium-BYDV system were similar in nature to effects on Avena sativa, but were more variable.) In the BYDV-Avena system, we developed protocols for consistently infecting target plants (and avoiding infection of control plants) using aphid caging on leaves. We measured that infected plants exhibited reduced photosynthesis, plant (including root) biomass, and root:shoot ratio, as well as simplified root system architecture. We established procedures for sampling the organic compounds carried specifically in phloem (vascular tissue) of leaves and roots, using aphid stylectomy. We used FTICR-MS, Orbitrap GC-MS, and LC-MS/MS to analyze organic compounds in phloem, liquid around roots of plants grown hydroponically, and pore water around roots in soil, and found differences in the compounds in solution bathing roots when infected and uninfected plants were grown hydroponically. Finally, we synthesized isotopically-labeled mineral–organic matter (MAOM) associations in the lab and developed assays using them in solution and in soil. Assays quantified the extent and rate of mineralization of labeled MAOM that was mobilized by functionally distinct rhizodeposits and then attacked by microbes. Two mechanisms for MAOM mobilization emerged, with distinct dynamics. During “direct” mobilization, rhizodeposits such as the strong ligand oxalic acid could drive rapid dissolution of minerals, mobilizing MAOM. During “indirect” mobilization, rhizodeposits such as the simple sugar glucose did not attack minerals directly but instead intensified microbial activity, which led to mobilization via changes in e.g. pH, Eh, and microbial metabolite production (Li et al. 2021). Mechanistic understanding derived from these data and our ongoing experiments using these techniques will inform future development of ELM. Plant roots not only contribute newly fixed organic compounds to soils, but also root activities can drive mineralization of the carbon and nutrients mobilized off minerals via “indirect” or “direct” mechanisms. Using viral infection as a new tool, ongoing combined experimentation and modeling will explore the strength and larger-scale significance of the cascade of processes from rhizodeposition to MAOM mobilization for soil carbon storage and nutrient cycling in terrestrial ecosystems. And if viral infection leads quite generally to “sticky roots”, our perception of the potential importance of prevalent virus infection in terrestrial landscapes will be transformed.

54 ENVIRONMENTAL SCIENCES↗

NASA’s Secured Airspace for Urban Air Mobility (UAM)

The Urban Air Mobility (UAM) architecture is leveraged from the Unmanned Traffic Management (UTM) concept of operations. Within the UAM environment, UAM operators work collaboratively to manage aerial vehicles in the urban environment. Providers of Services for UAM (PSU), UAM operators, and Supplemental Data Service Providers (SDSP) provide services to support flight operations within that environment. As a recognized need, various views of UAM flight information are provided to the public and public safety entities. To accomplish this, among other goals, the Federal Aviation Administration (FAA) can coordinate flight information between the FAA controlled National Airspace System (NAS) and the UAM environments through the FAA-Industry Data Exchange Protocol (FIDXP). This concept of UAM proposes to develop short-range, point-to-point transportation systems in metropolitan areas using vertical take-off and landing (VTOL) or short take-off and landing (STOL) aircraft to overcome increasing surface congestion. To garner the support of UAM and to realize its potential, an assurance of cybersecurity is critical for public acceptance. Understanding the various components communicating with one-another cybersecurity, like in other industries, has come to the forefront highlighting the need to protect these networks and systems from cyberattacks. With the planned growth and reach of UAM systems, it’s clear that the associated data exchange and service interactions will be at risk due to numerous types of cybersecurity attacks. Consequently, as these threats evolve, the UAM cybersecurity capabilities must adapt to these changes as well. While learning is always the goal, the overall intent of this workshop is to make recommendations on the following: (1) how future UAM environments can be protected against cyber-attacks, and (2) what mechanisms should be put in place to detect attacks against UAM environments.

UAM↗

A Cybersecurity Threat Profile for a Connected Lighting System

In anticipation of improved energy performance and cost savings, cities and building owners are increasingly considering “smart lighting initiatives” that aim to convert their collection of simple luminaires (i.e., lighting fixtures) into an intelligent connected lighting system (CLS) capable of remotely monitoring energy consumption and fault conditions, and possibly implementing adaptive lighting schemes. The U.S. Department of Energy (DOE) has set an national goal of tripling the energy efficiency and demand flexibility of the buildings sector by 2030, relative to 2020 levels 1. It is forecast that connected lighting systems can contribute to that goal by delivering 125 TWh of annual energy savings by 2035 2, equivalent to the annual output of 50 typical (500 MW) power plants. However, these energy savings and the DOE goal are put at significant risk if connected technologies are not adopted due to real or perceived cybersecurity concerns. Connected IoT devices such as these have historically been rife with vulnerabilities which sometimes put security considerations secondary to functionality and operability. What are the cybersecurity threats that will impact these systems, as formerly banal luminaires transition into intelligent connected devices that collect information about themselves, their surrounding environment, and possibly us? In this paper we analyze a threat profile performed on a fault-detection use case for streetlights. A threat profile establishes security requirements, justifies security measures, yields actionable controls, and effectively communicates risk to stakeholders. This effort provides critical information for making threat-based decisions to increase security at a reasonable cost, and can effectively be used by development teams, software architects, and managers to make cybersecurity a part of their ongoing culture of awareness, training, and prevention. This leads to more secure systems and better-understood security. On-premise, cloud, and hybrid architectures with different authentication mechanisms were modeled and later categorized using the Microsoft STRIDE framework. An analysis of the recommended controls for each threat was performed to determine which controls could and should be put in place by manufacturers or third-party suppliers, and which controls need to be left up the end-user to implement. Fifty-seven threats were identified. Among our key findings: (1) 65% (37/57) of the threats did not involve the luminaires, but rather the other components needed to communicate with and manage them; (2) 63% (36/57) of the threats could have been mitigated through manufacturer-implemented defensive techniques or “controls”; and (3) 23% (13/57) of the threats were dependent on the network configuration. Recommendations based on the results of this work are made to key stakeholder groups. Notably, lighting technology developers are advised to address all threats that can be reasonably controlled with baked-in technology solutions (e.g., encryption or authentication controls), and employ some form of secure supply chain management and tracking where other parts (e.g., sensors, microprocessors) of a luminaire must also be built and manufactured with the proper security controls in place. Developers should also review threats involving assets not developed in-house to understand how connectivity with other devices will affect their product during system operation and determine if a compensating control for a defense-in-depth strategy will be needed. Finally, those interested in deploying CLS should compare the differences between cloud and on-premise models to determine which is more suitable for their needs and the abilities of their security team.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗

Information Systems Coordinate Emergency Management

The rescue crews have been searching for the woman for nearly a week. Hurricane Katrina devastated Hancock County, the southernmost point in Mississippi, and the woman had stayed through the storm in her beach house. There is little hope of finding her alive; the search teams know she is gone because the house is gone. Late at night in the art classroom of the school that is serving as the county s emergency operations center, Craig Harvey is discussing the search with the center s commander. Harvey is the Chief Operating Officer of a unique company called NVision Solutions Inc., based at NASA s Stennis Space Center in Bay St. Louis, only a couple of miles away. He and his entire staff have set up a volunteer operation in the art room, supporting the emergency management efforts using technology and capabilities the company developed through its NASA partnerships. As he talks to the commander, Harvey feels an idea taking shape that might lead them to the woman s location. Working with surface elevation data and hydrological principles, Harvey creates a map showing how the floodwaters from the storm would have flowed along the topography of the region around the woman s former home. Using the map, search crews find the woman s body in 15 minutes. Recovering individuals who have been lost is a sad reality of emergency management in the wake of a disaster like Hurricane Katrina in 2005. But the sooner answers can be provided, the sooner a community s overall recovery can take place. When damage is extensive, resources are scattered, and people are in dire need of food, shelter, and medical assistance, the speed and efficiency of emergency operations can be the key to limiting the impact of a disaster and speeding the process of recovery. And a key to quick and effective emergency planning and response is geographic information. With a host of Earth-observing satellites orbiting the globe at all times, NASA generates an unmatched wealth of data about our ever-changing planet. This information can be captured, analyzed, and visualized by geographic information systems (GIS) to produce maps, charts, and other tools that can reveal information essential to a wide variety of applications including emergency management. Knowing precise, real-time information about the size, location, environmental conditions, and resulting damage of an event like a flood or wildfire as well as the location and numbers of emergency responders and other resources contributes directly to the effectiveness of disaster mitigation. The need for such information is also evident when responding to homeland security threats, such as a terrorist attack. Recognizing the value of its geospatial information resources for this and other purposes, in 1998 Stennis and the state of Mississippi partnered to form what became the Enterprise for Innovative Geospatial Solutions (EIGS) industry cluster, supporting the growth of remote sensing and GIS-based research and business. As part of EIGS, several companies partnered with NASA through dual use and Small Business Innovation Research (SBIR) contracts. Among those was NVision.

Source record↗

Cybersecurity for Distance Relay Protection

This project is a DOE follow-up effort on the CREDC workshop held on September 13, 2018 in Cambridge, MA to discuss cybersecurity of distance relays, which considered the benefits, vulnerabilities and risk mitigations for the use of communication systems in power system protection. The objectives of this project are to define the taxonomy of relay protection and associated communications; define use cases describing approaches to reduce the cyber-attack surface on those protective relays; and evaluate the loss of operational functional capability from changes to communication coverage. Mitigating controls will also be evaluated to understand if there are other approaches to reduce attack surfaces while maintaining communications or partial communications. Distance relays are used to protect transmission lines of approximately 10 to 300 miles in length, by detecting short circuits (i.e., faults) on the lines and then tripping circuit breakers in the substation. Such protection systems are a subset of the power system and they incorporate sensing, logic and communication functions. Protection system exposure to cyberattack could be drastically limited by disconnecting relays from all vulnerable communication systems, but this may adversely impact overall power system performance in the absence of cyberattack. This project began with a use case analysis of protection systems with communications, as summarized in this report. It continued with modeling, testing and evaluation in a miniature power system (MPS), located in the Western Area Power Administration (WAPA) Electric Power Training Center (EPTC). The project also incorporated feedback from two industry meetings held in February and September 2019. The suggested next steps account for and complement the work already underway with DOE/CESER funding: 1. Study the performance of LCD and PC vs. PUTT, which is less reliant on communication system performance and GPS timing references. The PUTT scheme could prove to be more resilient to cyberattack or communications-related disruption. It could also be more tolerant of message re-routing with SDN/SDR communication systems. On the other hand, it will be more vulnerable to false tripping during dynamic events or to loss of the voltage signal. The optimum choice of scheme may depend on the specific power system and risk assessment. This study could provide a new template for evaluation based on business functions. 2. Research and develop new methods to detect and monitor distributed physical attacks, possibly using drones, video sensors, thermal sensors, machine learning and other advanced techniques. This will help mitigate the impact of cyberattack on the protection system, and will also help mitigate the impact of wild fires. 3. Implement a scalable PKI for use in electric utility protection systems. This will encourage widespread adoption of secure authentication methods that are already available, but not widely used at present. This will help secure engineering access to the relays. 4. Investigate the use of SDN in combination with SDR to achieve better cybersecurity and electromagnetic security of the network, incorporating path variability. This would help secure both engineering access and peer-to-peer GOOSE messaging. 5. Perform additional testing, with operator evaluation of “red button” scenarios, PUTT vs. LCD, relay mis-operations, and other cyberattacks in the EPTC. This is an important advantage of testing in the EPTC rather than by computer simulation or even hardware-in-the-loop simulation; the EPTC is already dedicated to managing the situational awareness, operator response times and other human impacts. One of the project objectives was to settle on a common nomenclature for this problem space. We have concluded that the OSI layer model, supplemented by ANSI device numbers and other IEEE standards, is already well-accepted by the industry. The IEEE PSRC knowledge base provides a great deal of public information

24 POWER TRANSMISSION AND DISTRIBUTION↗