Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Information Security”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 73 records · Page 4
All sourcesNASA NTRSDOE OSTI
DOE OSTI2024

Trust Model Measurements for the Energy Grid of Things

Information security is essential for the reliable operation of an Energy Grid of Things (EGoT). In addition to basic information security protocols as defined by published standards, there is a need for a monitoring function that measures the trustworthiness of the various actors participating in an EGoT. We describe in this paper the implementation and evaluation of a Distributed Trust Model that was developed specifically for monitoring communication within an EGoT. We then show how the model parameters are set using statistical measures for hypothesis testing.

Energy Grid of Things, EGoT, Smart Grid Security, ↗
DOE OSTI2017

Fault Tolerant Key Generation and Secure Spread Spectrum Communication

This study presents a secure information transmission system compromised of two main parts. The first component makes use of the principle of reciprocity in frequency-selective wireless channels to derive a pair of keys for two legitimate parties. The proposed key generation algorithm allows for two asynchronous transceivers to derive a pair of similar keys. Moreover, we apply a unique augmentation - called strongest path cancellation (SPC) - to the keys and have validated through simulation and real-world measurements that this technique significantly boosts the security level of the overall design. In the second part of the secure information transmission system, we introduce the concept of artificial noise to multi-carrier spread-spectrum (MC-SS) systems. The keys generated in the first part are used as spreading code sequences for MC-SS and artificial noise is added to further enhance the security of this communication setup. Two different attacks on our proposed system are evaluated. First, a passive adversary who follows the exact same steps as the legitimate users to detect confidential information is considered. In the second attack, we evaluate the design in presence of an adversary with significant blind detection capabilities.

99 GENERAL AND MISCELLANEOUS↗
DOE OSTI2015

Finite Energy and Bounded Actuator Attacks on Cyber-Physical Systems

As control system networks are being connected to enterprise level networks for remote monitoring, operation, and system-wide performance optimization, these same connections are providing vulnerabilities that can be exploited by malicious actors for attack, financial gain, and theft of intellectual property. Much effort in cyber-physical system (CPS) protection has focused on protecting the borders of the system through traditional information security techniques. Less effort has been applied to the protection of cyber-physical systems from intelligent attacks launched after an attacker has defeated the information security protections to gain access to the control system. In this paper, attacks on actuator signals are analyzed from a system theoretic context. The threat surface is classified into finite energy and bounded attacks. These two broad classes encompass a large range of potential attacks. The effect of theses attacks on a linear quadratic (LQ) control are analyzed, and the optimal actuator attacks for both finite and infinite horizon LQ control are derived, therefore the worst case attack signals are obtained. The closed-loop system under the optimal attack signals is given and a numerical example illustrating the effect of an optimal bounded attack is provided.

Djouadi, Seddik M↗
DOE OSTI2019

Final Report for Industrial Base Cybersecurity Initiative (IBCI) Project (FY2019)

Information security issues impact all manufacturing sectors and are particularly troublesome when designs for advanced weapons systems are lost via attacks that propagate through the relatively unprotected lower tiers of the nation's supply chains. The US Manufacturing Industrial Base (MIB) consists of suppliers and distributors that range in size from large prime contractors with extensive cybersecurity resources to small shops with little or no in-house information technology capabilities. The acquisition and maintenance of the technologies, systems, and financial resources needed to assure secure collaborations can be an overwhelming challenge for many manufacturers yet the cost of poor cybersecurity practices can lead to the compromise of national security information worth hundreds of millions of dollars. The Department of Defense Manufacturing Industrial Base Policy organization and the Department of Energy, Energy Efficiency and Renewable Energy Advanced Manufacturing Office have chartered the Los Alamos National Laboratory (LANL) and the Oak Ridge Y-12 National Security Complex (Y-12) to design, develop, and demonstrate a Manufacturing Threat Evaluation Wargaming System (MTEWS). The MTEWS concept is based on the use of a virtual model of the computer networks and cybersecurity protocols used across the MIB that will be continuously updated to reflect the dynamic threat environment. The MTEWS cyber-physical test range will demonstrate a prototype wargaming system that analyzes the impact of new and existing cybersecurity threats while also providing the information needed to sustain the integrity of the MIB supply chains. A long-term goal is the establishment of an enduring national manufacturing operations center that proactively responds to the continuously changing attacks that threaten the MIB and US national security. LANL and Y-12 have formed an Industrial Base Cybersecurity Initiative Team (IBCI), consisting of partners from the public, private and academic sectors, that is developing the MTEWS. To date, most of the project tasks have been centered on the technologies required to create a representative model of the MIB because this is a foundational element for the entire project. Modeling activities at the University of North Carolina at Charlotte (UNC Charlotte) have demonstrated a VMware-based prototype system that can accommodate a network model with up to 350 nodes and includes features such as the option to incorporate network scanning information when building the model and the ability to down select the elements of duplicative networks to a statistically significant subset that avoids redundantly duplicating network configurations. Broad Ordering Agreements have been established with UNC Charlotte and the University of West Florida (UWF) that support a variety of cybersecurity for manufacturing tasks and wide-spread endorsement has been received from government, industry and academia sectors concerning the IBCI goals and technical direction.

45 MILITARY TECHNOLOGY, WEAPONRY, AND NATIONAL DEF↗
NASA NTRS2015

Cyber Security: Big Data Think II Working Group Meeting

This presentation focuses on approaches that could be used by a data computation center to identify attacks and ensure malicious code and backdoors are identified if planted in system. The goal is to identify actionable security information from the mountain of data that flows into and out of an organization. The approaches are applicable to big data computational center and some must also use big data techniques to extract the actionable security information from the mountain of data that flows into and out of a data computational center. The briefing covers the detection of malicious delivery sites and techniques for reducing the mountain of data so that intrusion detection information can be useful, and not hidden in a plethora of false alerts. It also looks at the identification of possible unauthorized data exfiltration.

computer security↗
NASA NTRS2017

Smashing the Stovepipe: Leveraging the GMSEC Open Architecture and Advanced IT Automation to Rapidly Prototype, Develop and Deploy Next-Generation Multi-Mission Ground Systems

Satellite/Payload Ground Systems - Typically highly-customized to a specific mission's use cases - Utilize hundreds (or thousands!) of specialized point-to-point interfaces for data flows / file transfers Documentation and tracking of these complex interfaces requires extensive time to develop and extremely high staffing costs Implementation and testing of these interfaces are even more cost-prohibitive, and documentation often lags behind implementation resulting in inconsistencies down the road With expanding threat vectors, IT Security, Information Assurance and Operational Security have become key Ground System architecture drivers New Federal security-related directives are generated on a daily basis, imposing new requirements on current / existing ground systems - These mandated activities and data calls typically carry little or no additional funding for implementation As a result, Ground System Sustaining Engineering groups and Information Technology staff continually struggle to keep up with the rolling tide of security Advancing security concerns and shrinking budgets are pushing these large stove-piped ground systems to begin sharing resources - I.e. Operational / SysAdmin staff, IT security baselines, architecture decisions or even networks / hosting infrastructure Refactoring these existing ground systems into multi-mission assets proves extremely challenging due to what is typically very tight coupling between legacy components As a result, many "Multi-Mission" ops. environments end up simply sharing compute resources and networks due to the difficulty of refactoring into true multi-mission systems Utilizing continuous integration / rapid system deployment technologies in conjunction with an open architecture messaging approach allows System Engineers and Architects to worry less about the low-level details of interfaces between components and configuration of systems GMSEC messaging is inherently designed to support multi-mission requirements, and allows components to aggregate data across multiple homogeneous or heterogeneous satellites or payloads - The highly-successful Goddard Science and Planetary Operations Control Center (SPOCC) utilizes GMSEC as the hub for it's automation and situational awareness capability Shifts focus towards getting GS to a final configuration-managed baseline, as well as multi-mission / big-picture capabilities that help increase situational awareness, promote cross-mission sharing and establish enhanced fleet management capabilities across all levels of the enterprise.

GMSEC↗
DOE OSTI2017

Risk informed cyber security for nuclear power plants - 342

Nuclear power plants are increasingly adding digital components for plant operation, safety, and security. These digital components fill a gap with legacy equipment where replacement components no longer exist. They also benefit operation of the plant by increasing efficiency in power generation, monitoring of equipment and plant parameters, as well as aiding operator control. However, the addition of digital components and systems also adds cyber risks with previously unanalyzed failure modes and attack vectors are introduced with these new systems. These risks are difficult to identify, analyze, and mitigate due to the increasingly complex nature of the digital components and the integration of these components with additional plant processes and communication networks. The research presented in this paper develops a new method that addresses the cyber risk to inform appropriate levels of protection. EPRI and Sandia are working under a Cooperative Research and Development Agreement to develop an effective method of evaluating the cyber risk in production nuclear power facilities. The Cyber Hazards Analysis Risk Methodology (CHARM) focuses on ensuring adequate controls are in place for appropriate cyber protection of the plant from radiological release or generation risk. Existing plant hazards analyses (e.g., PRA, FTA) do not account for software deficiencies or adversarial intent. This method leverages existing plant analyses and MIT's Systems Theoretic Process Analysis (STPA) to create cyber informed fault trees. These new fault trees will provide the basis for comprehensive cyber risk analysis and help ensure potential gaps in cyber security controls are identified and corrected. (authors)

22 GENERAL STUDIES OF NUCLEAR REACTORS↗
DOE OSTI2014

Security analysis of RSA cryptosystem algorithm and it’s properties

The information technology rapidly development and dramatically changed the life style people, in addition to shortening the distance of communication, but also promote the smooth exchange of information flows. However, derivatives to facilitate the relative safety of these issues, since into the digital information age, the majority of the practitioners of engineering and technical personnel and technical workers in terms of technology, information security is increasingly becoming an important issue. The RSA algorithm was published in 1978. It is a kind of very popular and widely application modem cryptosystem in the world. Even though there are lots of articles to discuss about how to break the RSA, but it is still secure today. In this paper, the authors would like to introduce a variant attack to RSA.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2019

Information-Theoretically Secure Distributed Machine Learning

A previously obscure area of cryptography known as Secure Multiparty Computation (MPC) is enjoying increased attention in the field of privacy-preserving machine learning (ML), because ML models implemented using MPC can be uniquely resistant to capture or reverse engineering by an adversary. In particular, an adversary who captures a share of a distributed MPC model provably cannot recover the model itself, nor data evaluated by the model, even by observing the model in operation. We report on our small project to survey current MPC software and judge its practicality for fielding mission-relevant distributed machine learning models.

97 MATHEMATICS AND COMPUTING↗
NASA NTRS2000

Challenges of Information Technology Security in the NASA Environment

A brief description of the NASA organization and how the CIO responsibilities are integrated into that organization followed by an introduction of the NASA ITS Program goals and objectives. An overview of the four major enterprises' cultures and how those cultures tie back to the Enterprises' missions. A description of the ITS challenges that exist stemming from the competing NASA Enterprises' requirements and how they have formed the basis of the NASA ITS Program. A talk will focus on policies and procedures and the technology being incorporated into the NASA infrastructure and how that technology ties back to the policies and procedures.

Santiago, S. S.↗
DOE OSTI2022

Licensing, Regulations and Developing Guidance for Nuclear Technology Deployment for Embarking countries in Africa

The African region is witnessing an increased number of countries at different stages of implementing or considering the introduction of peaceful nuclear power programs to meet the demand of their rapidly growing economies as well as clean energy needs. Grid size, cost, licensing, and regulations will be some of the challenges to deploying larger power reactors. A key element of the regulatory framework will be the inclusion of nuclear security information and assurance that security is integrated into the license review process.As each country continue to implement and consider different reactor designs from several vendors, the significance of customer knowledge of licensing, Regulations, and guidance document to facilitate the deployment and operational needs for nuclear technology cannot be over-emphasized. This special session will bring together a selected panel of key stakeholders and policymakers from embarking countries in Africa to participate in a panel discussion to share their experience in the licensing, regulations, and development of guidance for power plant deployment. The session will also consider and identify potential gaps that may affect the licensing and regulatory applications for the future nuclear infrastructure. As well, the panel will promote regional networking and communication to increase capacities in readiness for the potential deployment of additional technology, such as Small Modular Reactors.

Dahunsi, Stephen↗
DOE OSTI2014

Security Analysis of Selected AMI Failure Scenarios Using Agent Based Game Theoretic Simulation

Information security analysis can be performed using game theory implemented in dynamic Agent Based Game Theoretic (ABGT) simulations. Such simulations can be verified with the results from game theory analysis and further used to explore larger scale, real world scenarios involving multiple attackers, defenders, and information assets. We concentrated our analysis on the Advanced Metering Infrastructure (AMI) functional domain which the National Electric Sector Cyber security Organization Resource (NESCOR) working group has currently documented 29 failure scenarios. The strategy for the game was developed by analyzing five electric sector representative failure scenarios contained in the AMI functional domain. From these five selected scenarios, we characterize them into three specific threat categories affecting confidentiality, integrity and availability (CIA). The analysis using our ABGT simulation demonstrates how to model the AMI functional domain using a set of rationalized game theoretic rules decomposed from the failure scenarios in terms of how those scenarios might impact the AMI network with respect to CIA.

Agent Based↗
DOE OSTI2023

Vulnerabilities in Satellite Communications Underscore Threat to Critical Infrastructure

INL analysts assess critical infrastructure sectors leveraging satellite communications (SATCOM) are likely inadvertently increasing the attack surface caused by inherent vulnerabilities in equipment and communications pathways. A lack of ownership regarding security in SATCOM ecosystems creates pervasive information security risk, and the obfuscation of patching responsibility means the mitigation of publicly and privately disclosed vulnerabilities is difficult to track. With these factors in consideration, INL analysts assess the number of attacks against SATCOM is likely to increase in the next decade as threat actors exploit these vulnerabilities.

99 GENERAL AND MISCELLANEOUS↗