Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “network security”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 631 records · Page 35

Optimal vocabulary selection approaches for privacy-preserving deep NLP model training for information extraction and cancer epidemiology

With the use of artificial intelligence and machine learning techniques for biomedical informatics, security and privacy concerns over the data and subject identities have also become an important issue and essential research topic. Without intentional safeguards, machine learning models may find patterns and features to improve task performance that are associated with private personal information. The privacy vulnerability of deep learning models for information extraction from medical textural contents needs to be quantified since the models are exposed to private health information and personally identifiable information. The objective of the study is to quantify the privacy vulnerability of the deep learning models for natural language processing and explore a proper way of securing patients’ information to mitigate confidentiality breaches. The target model is the multitask convolutional neural network for information extraction from cancer pathology reports, where the data for training the model are from multiple state population-based cancer registries. This study proposes the following schemes to collect vocabularies from the cancer pathology reports; (a) words appearing in multiple registries, and (b) words that have higher mutual information. We performed membership inference attacks on the models in high-performance computing environments. The comparison outcomes suggest that the proposed vocabulary selection methods resulted in lower privacy vulnerability while maintaining the same level of clinical task performance.

59 BASIC BIOLOGICAL SCIENCES↗

Use of IPsec by Manned Space Missions

NASA's Constellation Program is developing its next generation manned space systems for missions to the International Space Station (ISS) and the Moon. The Program is embarking on a path towards standards based Internet Protocol (IP) networking for space systems communication. The IP based communications will be paired with industry standard security mechanisms such as Internet Protocol Security (IPsec) to ensure the integrity of information exchanges and prevent unauthorized release of sensitive information in-transit. IPsec has been tested in simulations on the ground and on at least one Earth orbiting satellite, but the technology is still unproven in manned space mission situations and significant obstacles remain.

Pajevski, Michael J.↗

UAS Service Supplier Framework for Authentication and Authorization

The Unmanned Aircraft Systems (UAS) Traffic Management (UTM) Service Supplier (USS) Framework for Authentication and Authorization (UFAA) is the basis for secure and confident data exchanges between the Flight Information Management System (FIMS) and the USS Network and within the USS Network itself. UFAA is built upon the OAuth 2.0 approach to federated authorization, with details supplied by various Internet Engineering Task Force (IETF) Request for Comment documents (RFCs). Whenever possible, a specific standard is used to support a design decision within UFAA, and when an applicable standard is not found/used, the technical decision is explained as much as possible. This document describes UFAA in detail. It is intended to serve as a reference for other key UTM documents and should be useful to many UTM stakeholders. This is an informative document. The requirements stated or implied in this document will need to be fully vetted and reviewed by appropriate stakeholders before becoming operational. It is highly encouraged that in any design decisions for future applicable standards that are counter to or missing from the decisions presented herein be justified in that future standard.

UTM↗

Assembling a Cyber Range to Evaluate Artificial Intelligence / Machine Learning (AI/ML) Security Tools

In this case study, we will describe the design and assembly of a cyber security test range we have built at Oak Ridge National Laboratory in Oak Ridge, TN, USA. The range is designed to provide a flexible environment to evaluate cyber security tools—particularly those involving AI/ML—in a way that provides realistic environments and where we can control the experiments to determine the strengths and weaknesses of the tools. We have designed in the ability to repeat the evaluations, so additional tools can be evaluated and compared at a later time. The system is one that can be scaled up or down for experiment sizes. At the time of the conference we will have completed two full-scale, national, government challenges on this range. These challenges are evaluating the performance and operating costs for AI/ML-based cyber security tools for application into large, government-sized environments. These evaluations will be described, in order to provide motivation and context for various design decisions and adaptations we have made. The first challenge measured end-point security tools against 100K malware samples chosen across a range of types. The second is network detection of attempted penetration and exploitations with varying levels of covertness in a high-volume, business network. The scale of each of these challenges is requiring us to create automation systems to repeat the experiments identically for each tool. Preventing there being easy signs of malicious activity for the AI/ML tools to focus on has been a particularly interesting and challenging aspect of designing and executing these challenge events. After the events, the range continues to be used for other research such as adversarial machine learning where the repeatability, scale, and automation required for the national challenge events become essential elements for research.

Nichols, Jeff↗

Cyber-Resilient Automatic Generation Control for Systems of AC Microgrids

In this paper we propose a co-design of the secondary frequency regulation in systems of AC microgrids and its cyber security solutions. We term the secondary frequency regulator a Micro-Automatic Generation Control (μ AGC) for highlighting its same functionality as the AGC in bulk power systems. We identify sensory challenges and cyber threats facing the μ AGC. To address the sensory challenges, we introduce a new microgrid model by exploiting the rank-one deficiency property of microgrid dynamics. This model is used to pose an optimal μ AGC control problem that is easily implemented, because it does not require fast frequency measurements. An end-to-end cyber security solution to the False Data Injection (FDI) attack detection and mitigation is developed for the proposed μ AGC. The front-end barrier of applying off-the-shelf algorithms for cyber attack detection is removed by introducing a data-driven modeling approach. Finally, we propose an observer-based corrective control for an islanded microgrid and a collaborative mitigation scheme in systems of AC microgrids. We demonstrate a collaborative role of systems of microgrids during cyber attacks. Furthermore, the performance of the proposed cyber-resilient μ AGC is tested in a system of two networked microgrids.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Feasibility of critical infrastructure protection using network functions for programmable and decoupled ICS policy enforcement over WAN

Industrial control systems (ICS) represent a major component of our critical infrastructure. With the increasing need for more control and monitoring of such systems, ICS have seen an increase in connectivity to wide area networks (WAN) exposing aging equipment to rapidly evolving cybersecurity threats. Furthermore, the ICS data requires a reliability measure from the networks for critical functions for infrastructure monitoring and control. Especially when remote plant sites are involved such as pipelines, energy distribution networks, and transportation, WAN transport impairments most often provide a best effort delivery with no strict reliability guarantees. Network functions can provide a vendor agnostic, programmable critical infrastructure protection with a single maintenance, policy determination, and reliability assurance surface. A network function (NF) can be utilized for policy enforcement over the communication between remote entities and the main control office. This paper presents the research on transparent integration with existing ICS without disrupting communications, resulting in minimal downtime while decoupling the fast paced evolution of defensive security measures from the upgrade cycle of expensive long term hardware. We report our measurements on the resource requirements and overhead in the network for successful NF insertion under a wide variety of network impairments (network packet delay, reordering, and loss). Our paired NF implementation provides a policy enforcement platform extensible to cover myriad cybersecurity-related communication goals, including packet signing for verification, encryption for data privacy, packet filtering and data diode operation (i.e. protecting against eavesdropping, packet injection, and denial-of-service). Furthermore, bundling communication specifications into packet flows allows for tunability in applying policies as coarse- or fine-grained as the needs of the operator. We report on network function resource requirements in the form of required queue depth and network utilization overhead to inform the decision making against hardware cost constraints.

42 ENGINEERING↗

Manual Asset Inventory: NASA Kennedy Space Center

The National Aeronautics and Aerospace Administration (NASA) relies in the security and protection of the information and information systems to know the devices that are connected to the Agency networks whether these are business, mission, research, or engineering devices. The Agency uses different Information Technology resources in order to do this process automatically, however, there are some devices that need to be reported manually. As a result of this, every month the Agency distributes among its Information System Owners (ISOs) the Manual Asset Inventory, a document that consists of a Microsoft Excel spreadsheet with twenty field descriptions cells that has to be filled out by the ISO of every Security Plan in the Center [fifty three in total] and uploaded into the IT Security Enterprise Data Warehouse (ITSEC-EDW).

Presentation↗

Analyzing Infrastructure Interdependencies Using Network-Of-Networks Modeling

Infrastructure networks play a crucial role in our day-to-day lives, and modeling these infrastructure networks can help decisionmakers prepare for and respond to disruptions such as natural disasters or cyberattacks. Because these infrastructure networks depend on each other, it is not sufficient to model a single network in isolation. We build on previous single-network-modeling techniques to develop a methodology for modeling infrastructure interdependencies as a Network-of-Networks. Using distributionlevel data from a real U.S. city on the power grid, road geometry, and hospital locations, we show how to apply this methodology to modeling three of the U.S. Department of Homeland Security's Critical Infrastructure Sectors: Healthcare, Transportation, and Energy. We also analyze three primary metrics before and after a simulated disaster: 1) impact on hospital access; 2) road network impact with the change in betweenness centrality; 3) electric customer outage. We simulate three different disruptions: 1) road flooding from nearby rivers; 2) a malicious actor targeting the road networks; 3) a malicious actor targeting the electric grid. Finally, we discuss how our methodology can be applied to additional infrastructure networks and types of disruption, and how Artificial Intelligence (AI) techniques may be incorporated into this methodology for further research.

Scherrer, Evan [Drake University, Iowa]↗

Communication-efficient certificate revocation management for Advanced Metering Infrastructure and IoT Integration

Advanced Metering Infrastructure forms a communication network for the collection of power data from smart meters in Smart Grid. As the communication between smart meters could be secured utilizing public-key cryptography, however, public-key cryptography still has certain challenges in terms of certificate revocation and management particularly related distribution and storage overhead of revoked certificates. To address this challenge, in this work, we propose a novel revocation management approach by utilizing cryptographic accumulators which reduces the space requirements for revocation information significantly and thus enables efficient distribution of such information to all smart meters. We implemented the proposed approach on both ns-3 network simulator and a testbed. We demonstrated its superior performance with respect to traditional methods for revocation management.

97 MATHEMATICS AND COMPUTING↗

Bridging the Gap from Networking Technologies to Applications: Workshop Report

The objective of the Next Generation Internet (NGI) Federal program is threefold, encompassing development of networking technologies, high-performance network testbeds, and revolutionary applications. There have been notable advances in emerging network technologies and several nationwide testbeds have been established, but the integration of emerging technologies into applications is lagging. To help bridge this gap between developers of NGI networking technologies and developers of NGI applications, the NASA Research and Education Network (NREN) project hosted a two-day workshop at NASA Ames Research Center in August 1999. This paper presents a summary of the results of this workshop and also describes some of the challenges NREN is facing while incorporating new technologies into HPCC and other NASA applications. The workshop focused on three technologies - Quality of Service (QoS), advanced multicast, and security-and five major NGI application areas - telemedicine, digital earth, digital video, distributed data-intensive applications, and computational infrastructure applications. Network technology experts, application developers, and NGI testbed representatives came together at the workshop to promote cross-fertilization between the groups. Presentations on the first day, including an overview of the three technologies, application case studies and testbed status reports, laid the foundation for discussions on the second day. The objective of these latter discussions, held within smaller breakout groups, was to establish a coherent picture of the current status of the various pieces of each of the three technologies, to create a roadmap outlining future technology development, and to offer technological guidance to application developers. In this paper we first present a brief overview of the NGI applications that were represented at the workshop, focusing on the identification of technological advances that have successfully been incorporated in each application and technological challenges that remain. Next we present the technology roadmaps that were created at the workshop, summarizing the status of various mechanisms that are currently under development and forecasting when various advances are likely to occur within the next one-to-three-year time span. Then we identify issues that were raised at the workshop that might hinder technology development or that might impede integration into NGI applications. We also report some specific guidelines that were offered at the workshop to enable application developers to integrate and effectively use emerging NGI technology building blocks. Finally, we describe NREN activities to incorporate emerging technologies into NASA applications. These activities include support for other NASA High-Performance Computing and Communications Program areas such as IPG (Information Power Grid), support for NASA science enterprises such as Earth science and Mars program prototyping activities, support for satellite/terrestrial networking applications such as the TransAtlantic and TransPacific demonstrations and the Interplanetary Internet, support for NASA telemedicine applications such as the Virtual Collaborative Clinic, and participation in NGI advanced technology testbed initiatives such as the QBone and the NTON/Supernet. For each activity we highlight the primary technological challenge that is associated with it.

Johnson, Marjory J.↗

Inventory of Public Key Cryptography in US Electric Vehicle Charging

Electric vehicles (EVs) and charging infrastructure are networked systems, which employ high-level communications in support of charging and grid service decisions. Public key cryptography (PKC) underlies much of the security and privacy protections of the information exchange. We are entering a new epoch where quantum computing threats must be seriously considered. A sufficiently large quantum computer, so named Cryptographically Relevant Quantum Computer (QRQC), will be able to perform the mathematical operations to efficiently attack the underpinnings of traditional PKC, thus jeopardizing the digital foundations for trust, communications security, and data security. Estimates suggest a QRQC can break public key encryption and digital signatures in the manner of tens to hundreds of hours, compared to traditional computing that would demand more than 10 18 years in a brute force-style attack. A consensus belief of quantum theorists, quantum experimenters, and cryptographers suggest that the quantum threat will be likely realized in the next twenty years. To address the threat, post-quantum cryptography, which is cryptosystems that are designed to be secure against both traditional and quantum computing threats, must be adopted. Migration from traditional PKC to quantum-resilient cryptography is a global undertaking and likely represents the largest transition in computing history. The nascent state of EV public key infrastructure, combined with limited adoption of the vehicle secure charging features, presents an opportunity to establish a preference for quantum-resistant cryptography as a step on the migration path. Delays will stunt the efforts as rapidly accelerating EVs sales and huge infrastructure investments will create large growing bases of long-lived vehicles and infrastructure. Migration preparations can commence while NIST continues the process to standardize post-quantum cryptography (PQC), which are quantum-resilient algorithms designed to be secure against traditional and quantum computing threats. The first step in preparing EV charging is to identify the presence of traditional public key cryptography algorithms and applications. With this objective in mind, this report is intended to advise the vehicle manufacturers, charging station manufacturers, charging station operators, charge network providers and other EV charging stakeholders with information on traditional PKC application and the potential risks when PKC becomes insecure. This report, the first in a series of reports discussing the topics existing at the confluence of post-quantum cryptography adoption and EV charging, identifies traditional public key applications employed and identifies potential consequences of leaving EV charging infrastructure vulnerable to quantum computing. The focus remains squarely on the of EV charging and infrastructure with respect to PKC and is believed by the authors to complement the NIST SP 1800-38 Migration to Post-Quantum Cryptography. While the report is centered on infrastructure, there are implications to vehicles.

33 ADVANCED PROPULSION SYSTEMS↗

Holographic Optical Data Storage

Although the basic idea may be traced back to the earlier X-ray diffraction studies of Sir W. L. Bragg, the holographic method as we know it was invented by D. Gabor in 1948 as a two-step lensless imaging technique to enhance the resolution of electron microscopy, for which he received the 1971 Nobel Prize in physics. The distinctive feature of holography is the recording of the object phase variations that carry the depth information, which is lost in conventional photography where only the intensity (= squared amplitude) distribution of an object is captured. Since all photosensitive media necessarily respond to the intensity incident upon them, an ingenious way had to be found to convert object phase into intensity variations, and Gabor achieved this by introducing a coherent reference wave along with the object wave during exposure. Gabor's in-line recording scheme, however, required the object in question to be largely transmissive, and could provide only marginal image quality due to unwanted terms simultaneously reconstructed along with the desired wavefront. Further handicapped by the lack of a strong coherent light source, optical holography thus seemed fated to remain just another scientific curiosity, until the field was revolutionized in the early 1960s by some major breakthroughs: the proposition and demonstration of the laser principle, the introduction of off-axis holography, and the invention of volume holography. Consequently, the remainder of that decade saw an exponential growth in research on theory, practice, and applications of holography. Today, holography not only boasts a wide variety of scientific and technical applications (e.g., holographic interferometry for strain, vibration, and flow analysis, microscopy and high-resolution imagery, imaging through distorting media, optical interconnects, holographic optical elements, optical neural networks, three-dimensional displays, data storage, etc.), but has become a prominent am advertising, and security medium as well. The evolution of holographic optical memories has followed a path not altogether different from holography itself, with several cycles of alternating interest over the past four decades. P. J. van Heerden is widely credited for being the first to elucidate the principles behind holographic data storage in a 1963 paper, predicting bit storage densities on the order of 1/lambda(sup 3) with source wavelength lambda - a fantastic capacity of nearly 1 TB/cu cm for visible light! The science and engineering of such a storage paradigm was heavily pursued thereafter, resulting in many novel hologram multiplexing techniques for dense data storage, as well as important advances in holographic recording materials. Ultimately, however, the lack of such enabling technologies as compact laser sources and high performance optical data I/O devices dampened the hopes for the development of a commercial product. After a period of relative dormancy, successful applications of holography in other arenas sparked a renewed interest in holographic data storage in the late 1980s and the early 1990s. Currently, with most of the critical optoelectronic device technologies in place and the quest for an ideal holographic recording medium intensified, holography is once again considered as one of several future data storage paradigms that may answer our constantly growing need for higher-capacity and faster-access memories.

Timucin, Dogan A.↗

Decentralized Voltage optimization Method for Distribution Networks with Distributed PVs

In order to solve the voltage violations caused by high penetration distributed photovoltaics (PVs), this paper proposes a decentralized voltage optimization method for distribution networks. Through the optimal dispatch of distributed PVs and reactive power resources, it realizes the voltage security and economic operation of distribution systems and facilitates the integration of massive distributed PVs. The proposed method is inspired by the idea of locational marginal price (LMP) and feasible cutting plane. It separates the optimization of boundary bus voltage and power flow in adjacent regions and uses the interaction of boundary variables’ marginal prices to obtain the optimal solution. The effectiveness and accuracy of the proposed method are demonstrated via simulation test on a practical l0kV feeder in China.

Xue, Yaosuo↗

Impact of Blockchain Delay on Grid-Tied Solar Inverter Performance: Preprint

This paper investigates the impact of the delay resulting from a blockchain, a promising security measure, for a hierarchical control system of inverters connected to the grid. The blockchain communication network is designed at the secondary control layer for resilience against cyberattacks. To represent the latency in the communication channel, a model is developed based on the complexity of the blockchain framework. Taking this model into account, this work evaluates the plant’s performance subject to communication delays, introduced by the blockchain, among the hierarchical control agents. In addition, this article considers an optimal model-based control strategy that performs the system’s internal control loop. The work shows that the blockchain’s delay size influences the convergence of the power supplied by the inverter to the reference at the point of common coupling. In the results section, real-time simulations on OPAL-RT are performed to test the resilience of two parallel inverters with increasing blockchain complexity.

41 EE - Solar Energy Technologies Office (EE-4S)↗

Cybersecurity Considerations for Emerging Energy Technologies

AI, cloud computing, post-quantum cryptography, zero-trust architectures, microgrids, and virtual power plants. What do these things have in common? They are all emerging technologies in the clean energy space that will be a critical part of grid modernization efforts. As we work towards clean energy and decarbonization targets, these technologies, developed to solve real-world problems, will help us reach goals and achieve new efficiencies as the paradigm of grid operation shifts. However, there are growing concerns about the cybersecurity risks associated with these trending topics as they are used in critical infrastructure applications. This talk will cover gaps, challenges, and opportunities for the secure implementation of grid modernization solutions and novel energy applications of state-of-the-art networking and communications. Proactive risk mitigation strategies, including the application of cyber-informed engineering, will be discussed. Practical applications of these techniques will help provide countermeasures to the impact of cyberattacks on critical infrastructure technologies in a new, digitized grid landscape.

14 SOLAR ENERGY↗

Attack-resilient algorithms and testbed federation for wide-area protection and control in smart grid

Today’s energy infrastructure is undergoing a massive transformation across all generation, transmission, and distribution systems to provide reliability, efficiency, and sustainability to the power system network. During the past 10 years, there has been a remarkable enhancement in developing close-loop wide-area protection and control (WAPAC) applications, such as automatic generation control (AGC), wide-area protection scheme (WAPS), synchrophasor-based wide-area voltage control system (WAVCS), etc., in the energy management system (EMS) to provide an adequate situational awareness to control center operators during physical disturbances and natural events. The rapid digitalization, unencrypted communication, and numerous data-sharing devices have increased digital access points that have exposed the grid network to countless cyberattacks pertinent to the WAPAC cybersecurity. Given the amount of complex grid network coupled with legacy infrastructures, it is untrustworthy to completely rely on information technology (IT)-based conventional security measures to defend against evolving cyberattacks. Hence, there is a compelling need to go beyond the traditional paradigm of ‘security by obscurity’ and ‘bolt-on’ security measures, and develop a suite of innovative security solutions at multiple layers to transform the current “fault-resilient” grid into “fault and attack-resilient” grid of the future. This dissertation specifically focuses on developing application-specific attack-resilient solutions for critical WAPAC applications in the smart grid. The first part of the study, Attack-Resilient Wide-Area Protection Scheme, presents a cyber-physical attack-resilient system (CPARS) for WAPS, where two anomaly detection methods are proposed to detect multi-level cyberattacks followed by the rules-based intrusion mitigation system (RIMS) to initiate effective mitigation strategies, tailored to these attacks, to restore the normal grid operation after disturbances. The first anomaly detection component, Machine learning-based Anomaly Detection for Centralized WAPS, discusses a novel architecture and methodology for developing a machine-learning-based anomaly detection system (ADS) for the centralized wide-area protection system (CWAPS) by applying the variational mode decomposition (VMD) technique and decision tree (DT) algorithms using cyber logs and synchrophasor measurements. The second component, Multi-Agent-based Anomaly Detection for Decentralized WAPS, presents a two-level hierarchical multi-agent-based decentralized WAPS against the system-aware stealthy cyber-attacks. Finally, for the RIMS, the state transition diagram-based mitigation measures are defined based on the grid operation states and experimental testing and evaluation are presented in a cyber-physical testbed environment. The second part of the study, Attack-Resilient Wide-Area Voltage Control System, addresses the existing vulnerabilities in the wide-area voltage control system (WAVCS), presents the methodology for performing an impact analysis during data integrity attacks, and proposes a data-driven attackresilient system (DARS) by incorporating machine learning-based ADS and rules-based anomaly mitigation system (RAMS) to detect these attacks and provide necessary mitigation actions to maintain the transient voltage stability after disturbances. Finally, the third part, Networked Federation Testbed (NEFTSec) for Smart Grid Cybersecurity, focuses on developing an interconnected federated testbed through a common network like the internet, describes its conceptual architectures, and also presents its design components for experimental testing, validation, and evaluation. Further, it presents the co-simulation interface algorithm (CIA) to facilitate the geographically-dispersed real-time distributed simulation (GD-RTDS) during the cyber-physical federation. In general, this dissertation presents innovative attack-resilient solutions for WAPAC applications that are experimentally tested and evaluated using the PowerCyber testbed and NEFTSec platform to accelerate the transition of state-of-the-art research works to the real-field deployments.

24 POWER TRANSMISSION AND DISTRIBUTION↗

Digital Assurance Checklist for Homeowners and Installers

This document provides a comprehensive Digital Assurance Checklist for securing behind-the-meter energy assets, focusing on both installers and homeowners. As distributed energy resources (DERs) such as solar PV and battery storage become integral to residential energy systems, cybersecurity emerges as a critical component of reliability and safety. The guide outlines actionable steps for installers during pre-installation, commissioning, and post-installation phases, emphasizing practices like network segmentation, credential management, firmware validation, and homeowner education. For homeowners, the document introduces a tiered approach to cyber hygiene—from essential measures like strong Wi-Fi credentials and automatic updates to advanced strategies such as network segmentation, DNS filtering, and intrusion detection. By adopting these practices, stakeholders can mitigate cyber risks, safeguard energy infrastructure, and ensure resilient, secure operation of DER systems. Additional resources and references to industry standards are included to support implementation.

99 - GENERAL AND MISCELLANEOUS↗