SEARCH · Engineering Papers

Results for “Vulnerabilities”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

SourceResearch connectionFrom yearThrough year

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,189 records · Page 66

All sources NASA NTRS DOE OSTI

DOE OSTI2022

EFCOG Best Practice HPI for Knowledge Workers ISM-HPI-22-02

This document is a collection of these best practices as determined by team members. This best practice attempts to: Realize opportunities to break the myth where people believe that HPI does not apply to them as they perform no physical work. Recommend options to create an environment that promotes intellectual collaboration and trust, enabling candor and vulnerability. Explain how errors manifest differently from the same human fallibility. Knowledge workers (KW) have errors that take different perspectives to find and mitigate the unique manifestation of these conditions. Help KW identify the critical steps (or risk important steps) in their processes. Reduce risk/consequence from KW errors (limit latent errors as well as finding latent conditions), building resiliency into KW tasks. Mitigation strategies may be different.

96 KNOWLEDGE MANAGEMENT AND PRESERVATION↗

DOE OSTI2022

Autonomous System Subversion Tactics: Prototypes and Recommended Countermeasures

One of the fielding requirements for Advanced and Small Modular Reactors (AR/SMR) is the ability to support remote and autonomous operations. Autonomous Control Systems (ACS) are found on platforms such as Autonomous Space Vehicles, Cruise Missiles, and advanced driver-assistance systems. Each of these ACS implementations depends upon a set of decision support subsystems responsible for supporting Autonomous Mission Managers (names vary based upon field and author preferences). These Autonomous Mission Managers receive inputs from system sensors (e.g., LIDAR collection from an automobile travelling down a street; transients from a nuclear reactor), and perform a set of classifications (e.g., Red Traffic Light; Small Pedestrian at 10m; Load Rejection; Single Coolant Pump Trip), and then use these classifications in combination with recommendation algorithms to achieve platform goals (e.g., Stop the Vehicle at the Traffic Light, Avoid the Small Pedestrian; Trip the Reactor to prevent a Safety Event). The design, implementation, and fielding of an ACS capability will alter the cyber-attack surface such that existing risk management plans will need to be updated to include how to protect and defend against data-science and decision-support-system attack classes. These attack classes would include protection of the design and training environments where algorithm selection and testing and training data would be obvious attack vectors. These attack classes would also require an informed set of detection and response procedures to identify anomalous behaviors and document best practices for anomaly assessment and vulnerability mitigation and remediation. Last year we published a Cyber Threat Assessment Methodology for Autonomous and Remote Operations for AR/SMRs along with a companion publication on Cyber Attack and Defense Use Cases. The focus of the methodology was on describing and enumerating ACS processes, components, and functions such that security engineers could: evaluate subversion options against the target; identify threat actor attributes and capabilities derived from each subversion option; and identify security controls and response countermeasures. The Use Cases document offered detailed methodology examples including an assessment of a Military Base SMR, an Autonomous System Decision Loop, and implementation of AR/SMR Machine Learning algorithms. Our proposal at the end of last year was to focus on implementation of subversion prototypes related to the last Use Case area: AR/SMR Machine Learning (ML) Algorithms. We included six attack scenarios in our Use Cases paper: a Poisoning Attack against ML functions implemented using an FPGA; a Trojaning Attack against ML classifiers exploiting the excitability of Nuclear Engineers; a Backdooring Attack against ML Training environments to ensure persistence of an attack vector; a False Positive Evasion Attack against multi-factor Access Control Systems using clever inputs; an Inference Attack against ML models by an Insider with access to the Operational environment; and an Adversarial Reprogramming Attack against a Material Access Control Video Surveillance System. At the beginning of this year these six attack scenarios were provided to our research teams at Georgia Tech and Idaho State University and each team successfully implemented a subversion attack against a ML implementation to include transient misclassifications. While this is a notable outcome from this type of research, this paper offers the reader insight into not only how to structure and execute these types of attacks, but into the thought process behind how the researcher investigated the problem space, performed initial algorithm implementation, and the trial-and-error behind arriving at the successful subversion prototypes. We include in this paper a set of associated Scenarios on how these subversion prototypes could be implemented and an initial set of guidance for AR/SMR architects, Nuclear Regulators, and Cyber Defenders to implement awareness and defense capabilities into their current operational portfolios.

42 ENGINEERING↗

DOE OSTI2022

Florida Alternative Transportation Fuel Resilience Plan

Hurricanes are increasing in frequency, intensity, duration, and are projected to continue increasing. Many counties and cities in Florida are developing resilience plans to help them minimize damage from hurricanes and accelerate recovery. The transportation portion of these plans tend to focus on bolstering road infrastructure, stockpiling diesel for strategic fleets, purchasing high-water vehicles, and placing evacuation shelters in safe areas. An Achilles heel of these plans is their dependence on diesel fuel, which is particularly vulnerable to hurricane-related disruptions since 90% of petroleum in Florida needs to be imported via maritime tanker. These tankers are restricted from accessing Florida ports before and during hurricanes because the risks of damage to the port facilities and tanker are too high. Therefore, transportation resilience can be fortified by diversifying the transportation fuels utilized in a hurricane.

33 ADVANCED PROPULSION SYSTEMS↗

DOE OSTI2023

Probabilistic Failure Criterion of SiC/SiC Composites Under Multiaxial Loading

Owing to its excellent mechanical properties and stability under high temperature and neutron irradiation conditions, SiC/SiC composites have emerged as a promising material for light water reactors (LWRs) in the development of accident-tolerant fuel (ATF) systems. Structural integrity and retention of hermeticity are two crucial requirements for SiC/SiC claddings during normal operations, and both of them are closely related to the proportional limit stress (PLS) of the material. Understanding the behavior of SiC/SiC composites under multiaxial stress states and developing a probabilistic approach for evaluating the structural vulnerability are of paramount importance for reliability-based analysis and design of SiC/SiC composite claddings. So far, there has been very limited effort towards experimental and analytical investigations of probabilistic failure of SiC/SiC claddings. This critical knowledge gap motivates this research. A probabilistic failure criterion for SiC/SiC composites under multi-axial loading is developed, and this criterion is incorporated into reliability analysis of the structural integrity of SiC/SiC fuel cladding. The research consists of two parts: 1) experimental investigation of multiaxial failure behavior of SiC/SiC composites, and 2) theoretical modeling of time-dependent probabilistic failure of SiC/SiC cladding. In the experimental investigation, the PLS is determined through the examination of stress-strain response, the acoustic emission measurement, as well as the X-ray computed tomography. The theoretical framework is derived by combin- ing the finite weakest-link statistical model and the subcritical damage growth model. This theoretical model captures the time-dependent failure mechanism of the material, which has a major consequence for predicting the lifetime distribution of the cladding. Meanwhile, the model also predicts that the failure statistics of the cladding depends strongly on the cladding length. The results of the multiaxial experiments reveal the level of statistical variation of the PLS of SiC/SiC materials under different stress states. The theoretical model provides a robust analytical tool for extrapolation of small-scale laboratory test results to the behavior of full-scale claddings. These findings establish a scientific foundation for the development of reliability-based design of SiC/SiC fuel claddings, which will play an essential role in improving the structural safety and integrity of LWRs.

42 ENGINEERING↗

DOE OSTI2023

Understanding and Predictability of Integrated Mountain Hydroclimate (Workshop Report)

Mountainous systems cover approximately 23% of Earth’s land and are distributed across all continents. They can capture and store atmospheric moisture that is then cycled through the terrestrial surface and subsurface system, released to downstream communities, and cycled back to the atmosphere. Mountain hydroclimate—characterized by steep gradients, geological, ecological, and biogeochemical diversity—is influenced by topographic forcing and elevated warming and susceptible to large subseasonal to multidecadal variability and rapid changes. Terrestrial hydrological and biogeochemical cycles also experience cascading effects from global warming impacts, such as multidecadal declines in mountain snowpack, longer growing seasons, and increased frequency and severity of extreme events like droughts and wildfires. However, little is known about the effects of these impacts and their feedbacks on climate systems and surface-subsurface compartments. Also unknown are the full implications of changing hydroclimate and extreme events on hydro biogeochemical cycles across atmosphere, terrestrial, and human systems in mountain regions and beyond. This knowledge gap is critical, given human reliance on mountain systems for stable water supply and quality. Mountain systems’ increasing vulnerability to climate change and human perturbations motivates the need to improve understanding of integrated mountain hydroclimate (IMHC) systems and their feedbacks and impacts on humans across scales. However, due to large heterogeneity and strong gradients, coupled natural-human processes in mountain regions present significant challenges for observations, modeling, predictions, and projections. Motivated by gaps in mountain hydroclimate understanding, observations, and modeling and the need for credible projections of future changes, the U.S. Department of Energy’s (DOE) Biological and Environmental Research (BER) program organized a virtual workshop on “Understanding and Predictability of Integrated Mountain Hydroclimate.” Sponsored by BER’s Earth and Environmental Systems Sciences Division (EESSD), the workshop aimed to inform and catalyze EESSD’s growing interests in enhancing predictive understanding of IMHC. Organizers structured the workshop to identify (1) knowledge gaps, (2) observational and modeling challenges, (3) short-term (1 to 3 years) and long-term (10 years and beyond) research opportunities, and (4) strategies for fostering collaboration and coordination. To address the outstanding challenges of IMHC, the workshop included two sessions organized by disciplinary, cross-disciplinary, and crosscutting science topics. The disciplinary and cross-disciplinary topics focused on essential IMHC elements: atmosphere, terrestrial, and human systems and their interactions. Breakout sessions on disciplinary and cross-disciplinary topics facilitated identification of crosscutting topics and central emerging themes. Session 1 focused on connecting existing DOE investments to accelerate progress related to scientific challenges in understanding mountain hydroclimate. In Session 2, participants further explored key Session 1 takeaways through the lens of multiagency collaborations and coordination.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2022

US Department of Energy, Office of Science High Performance Computing Facility Operational Assessment 2021: Oak Ridge Leadership Computing Facility

Oak Ridge National Laboratory’s (ORNL’s) Leadership Computing Facility (OLCF) continues to surpass its operational target goals of supporting users; delivering fast, reliable computational ecosystems; creating innovative solutions for high-performance computing (HPC) needs; contributing to the community to build the next generation HPC workforce, and managing risks, safety, and security associated with operating some of the most powerful computers in the world. The results can be seen in the cutting-edge science conducted by users and the praise from the research community. Calendar year (CY) 2021 saw continued excellence in research supported by the OLCF’s leadership-class computing resources, including Summit (the nation’s most powerful supercomputer), the global scratch file system Alpine, the Scalable Protected Infrastructure (SPI), the Exploratory Visualization Environment for Research in Science and Technology (EVEREST), and the archival mass-storage resource High-Performance Storage System (HPSS). While maintaining access and exceptional user support for Summit, the OLCF continued to make progress on the installation and deployment of Frontier, which will be the nation’s first exascale system when it comes online at the start of CY 2023. Users have already begun running and optimizing scientific codes on Crusher, the OLCF test and development system equipped with Frontier’s architecture. Throughout the year, the OLCF maintained a strong culture of operational excellence, including risk management, workplace safety, and cybersecurity. The OLCF’s rigorous risk management strategy anticipated and mitigated risks, and at this time there are no high-priority operational risks. Similarly, ORNL and the OLCF were committed to operating under the US Department of Energy’s (DOE’s) safety regulations that ensure a safe workplace. Technical staff tracked and monitored existing threats and vulnerabilities within the OLCF while continually developing tools and practices to enhance operations without increasing the facility’s risk. CY 2021 was filled with outstanding results and accomplishments, including a very high rating from users on overall satisfaction for the eighth consecutive year; a tremendous number of node hours delivered to 1,671 researchers on Summit; and the successful delivery of the allocation split of roughly 60%, 20%, and 20% of core-hours offered for the Innovative and Novel Computational Impact on Theory and Experiment (INCITE), Advanced Scientific Computing Research Leadership Computing Challenge (ALCC), and Director’s Discretionary (DD) programs, respectively (Section 2). COVID-19 research remained a focus in 2021, and the ALCC and DD programs allocated over 1 million Summit hours to the COVID-19 High Performance Computing Consortium. These accomplishments, coupled with the high utilization rates (i.e., overall and capability usage), represent the fulfillment of the promise of leadership class machines: efficient facilitation of leadership-class computational applications.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2023

Innovative Strategies for Long-Term Monitoring of Complex Groundwater Plumes at DOE’s Legacy Sites (Workshop Report)

Most remaining Department of Energy (DOE) sites will require extended periods of institutional control, especially at complex groundwater sites where attenuation-based strategies have been implemented to facilitate closure. The current practice of monitoring—obtaining and analyzing contaminant concentration in groundwater samples at numerous wells—will account for a large portion of the projected life-cycle at these DOE sites unless a new approach is adopted. State-of-the-art technologies are being developed, including in situ sensors, geophysics, radiation mapping, numerical modeling and AI/ML. These technologies can optimize monitoring strategies in space and time, provide spatially extensive information at vulnerable regions and/or provide more continuous monitoring at lower cost. As part of DOE’s Office of Environmental Management (DOE-EM’s) efforts to advance long-term monitoring systems, an in-person/virtual hybrid workshop was hosted by Savannah River National Laboratory (SRNL) on January 24 and 25, 2023, in Augusta, Georgia. Because DOE-EM’s complex sites will eventually be transferred to DOE’s Office of Legacy Management (DOE-LM), representatives of DOE-LM were important participants in the workshop. The purpose of the workshop was to identify challenges and opportunities for deploying advanced technologies for long-term monitoring at DOE sites. The key questions during the workshop were: 1) the regulatory acceptance of replacing a process that traditionally has used laboratory sampling and analysis of groundwater samples, and 2) the application of this strategy to the southwestern arid sites that include many of the remaining DOE-EM and DOE-LM complex groundwater plumes. Characteristics common to most arid sites present both limitations and opportunities for advanced technologies. DOE-EM has funded a National Laboratory team from SRNL, Lawrence Berkeley National Laboratory (LBNL), and Pacific Northwest National Laboratory (PNNL) to establish the overarching framework of long-term monitoring by systematically combining advanced hardware and software technologies. This project is titled “Advanced Long-Term Environmental Monitoring Systems (ALTEMIS)” and is sponsored by the DOE-EM Technology Development Program. The multi-laboratory team is currently developing and testing innovative monitoring strategies, including the use of in situ groundwater sensors, geophysics, drone/satellite-based remote sensing, reactive transport modeling, and artificial intelligence/machine learning (AI/ML). The project’s demonstration testbed is at the Savannah River Site (SRS) F-Area Seepage Basins, where a well-characterized complex groundwater plume composed of uranium and other radionuclides is in the latter stages of remediation. The workshop included more than 70 participants, presentations, a field visit to F-Area, breakout working groups, and large group discussion. Participants developed recommendations on five topics: in situ sensors, spatially integrative tools, challenges to regulatory acceptance, AI/ML strategies, and transitioning sites to DOE-LM.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗

DOE OSTI2023

Puerto Rico Historical Climate Analysis: A closer look at complex tropical terrain

Small tropical islands like Puerto Rico are especially vulnerable to climate change impacts, yet are often underrepresented in most datasets because the spatial resolution is too coarse to sufficiently cover their complex terrain. This study was done to better understand how the climate has changed in the various regions of Puerto Rico, which will support a transition to renewable energy and aid in projecting future climate impacts on the residents and land they live on. This study used multiple datasets including Daymet, a daily surface weather and climatological summary; European Centre for Medium-Range Weather Forecasts Reanalysis version 5 (ERA5); and station observations. The climate variables examined here include minimum and maximum near-surface air temperature, daily precipitation, incident shortwave radiation, and large-scale upper atmosphere conditions. The time periods cover the years 1950–2019. Results in both Daymet and station observations show long-term warming trends throughout every season. In particular, the minimum winter temperatures increased the most compared with maximum and mean air temperature. Northeast Puerto Rico, where the majority of the island’s population is located, experienced the largest warming. Summertime precipitation has decreased over time, and spring and fall precipitation has increased. The largest increase in fall is because there has been more available precipitable water, lower sea-level pressure, and favorable cyclonic circulations from the trade winds over the past seven decades. Overall, wet days are getting wetter, while dry days are getting drier. While there are good solar energy potential, we see a long-term decreasing trend in shortwave radiation over time in all seasons across entire island, possibly due to the increase of cloud cover.

54 ENVIRONMENTAL SCIENCES↗

DOE OSTI2023

Cyber-CHAMP White Paper

Cyber-CHAMP white paper intern school assignment. Worldwide there is a tremendous shortfall in the cybersecurity workforce. By 2021, researchers have forecasted a deficit of 3.5 million cyber professionals. As workforce capabilities diminished, the world's cybersecurity threats have continued to multiply. Industrial control systems (ICSs) and their operational technology (OT) components became more vulnerable to attack and compromise. When an ICS is compromised, attackers can cause widespread impacts on national security, public health, and safety. This capacity makes ICSs attractive targets, with 90% of surveyed OT organizations reporting a damaging cyberattack in the last two years. To address the risk to ICSs, personnel must be competent in operational best practices and the latest threats. While frameworks for information technology (IT) cybersecurity education have been developed, educational standards for OT cybersecurity are nonexistent.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2022

A Cybersecurity Threat Profile for a Connected Lighting System

In anticipation of improved energy performance and cost savings, cities and building owners are increasingly considering “smart lighting initiatives” that aim to convert their collection of simple luminaires (i.e., lighting fixtures) into an intelligent connected lighting system (CLS) capable of remotely monitoring energy consumption and fault conditions, and possibly implementing adaptive lighting schemes. The U.S. Department of Energy (DOE) has set an national goal of tripling the energy efficiency and demand flexibility of the buildings sector by 2030, relative to 2020 levels 1. It is forecast that connected lighting systems can contribute to that goal by delivering 125 TWh of annual energy savings by 2035 2, equivalent to the annual output of 50 typical (500 MW) power plants. However, these energy savings and the DOE goal are put at significant risk if connected technologies are not adopted due to real or perceived cybersecurity concerns. Connected IoT devices such as these have historically been rife with vulnerabilities which sometimes put security considerations secondary to functionality and operability. What are the cybersecurity threats that will impact these systems, as formerly banal luminaires transition into intelligent connected devices that collect information about themselves, their surrounding environment, and possibly us? In this paper we analyze a threat profile performed on a fault-detection use case for streetlights. A threat profile establishes security requirements, justifies security measures, yields actionable controls, and effectively communicates risk to stakeholders. This effort provides critical information for making threat-based decisions to increase security at a reasonable cost, and can effectively be used by development teams, software architects, and managers to make cybersecurity a part of their ongoing culture of awareness, training, and prevention. This leads to more secure systems and better-understood security. On-premise, cloud, and hybrid architectures with different authentication mechanisms were modeled and later categorized using the Microsoft STRIDE framework. An analysis of the recommended controls for each threat was performed to determine which controls could and should be put in place by manufacturers or third-party suppliers, and which controls need to be left up the end-user to implement. Fifty-seven threats were identified. Among our key findings: (1) 65% (37/57) of the threats did not involve the luminaires, but rather the other components needed to communicate with and manage them; (2) 63% (36/57) of the threats could have been mitigated through manufacturer-implemented defensive techniques or “controls”; and (3) 23% (13/57) of the threats were dependent on the network configuration. Recommendations based on the results of this work are made to key stakeholder groups. Notably, lighting technology developers are advised to address all threats that can be reasonably controlled with baked-in technology solutions (e.g., encryption or authentication controls), and employ some form of secure supply chain management and tracking where other parts (e.g., sensors, microprocessors) of a luminaire must also be built and manufactured with the proper security controls in place. Developers should also review threats involving assets not developed in-house to understand how connectivity with other devices will affect their product during system operation and determine if a compensating control for a defense-in-depth strategy will be needed. Finally, those interested in deploying CLS should compare the differences between cloud and on-premise models to determine which is more suitable for their needs and the abilities of their security team.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗

DOE OSTI2023

Implementing the National Initiative for the Advancement of Building Codes (NIABC)

On June 1, 2022, the White House launched the National Initiative to Advance Building Codes (NIABC): a whole-government initiative to assure alignment of, and minimum standards for, all building activity funded through federal agency programs. This includes ensuring the use of current consensus-based model building and energy codes and standards, with a focus on underserved and vulnerable communities. The initiative will accelerate the adoption of modern building codes to improve resiliency, create good-paying jobs, and lower energy bills.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗

DOE OSTI2021

Autonomous Tools for Attack Surface Reduction (Final Report)

The electric power grid is a complex critical infrastructure that forms the lifeline of modern society, and its secure and reliable operation is of paramount importance to national security and economic wellbeing. However, recent findings documented in authoritative sources indicate the threat of cyber-based attacks growing in numbers and sophistication. However, securing the grid against stealthy cyberattacks is a challenging task due to legacy nature of the infrastructure coupled with dynamic nature of threat landscape and ever-growing sophistication of the adversaries. Additionally, the grid’s attack surface continues to grow with the increased dependence on digital communications and control that now extends to each consumer through smart meters and distributed energy resources. Unfortunately, this expansive surface increases the grid’s vulnerability and further exposes critical control systems in both substations and control centers. To respond to this emerging need, we had successfully assembled an interdisciplinary team with academic- industry partnership to successfully conduct research, development, evaluation, demonstration, and commercialization of attack surface reduction tools, whose goal was to significantly reduce the cyber attack surface in the North American power grid. Our proposed project was a synergistic collaborative effort leveraging the synergistic expertise of the team members across power systems, cyber security and CPS security, testbeds, field deployments and demonstration, and successful commercialization. The following are the specific tasks that have been successfully completed two phases (2016-2020). Phase I: Task 1: Developed and implemented a robust Project Management and Data Management Plan, coupled with a well thought out Risk Mitigation Plan. Task 2.1: Developed a comprehensive framework that continually assesses and autonomously reduces the attack surface for the power grid control environment spanning across substations, control center and the SCADA network to significantly reduce the risks of cyber attacks. Task 2.2: Developed attack surface analysis techniques, metrics, and tools that assess the attack surface at multiple levels including the control center, substations, and the SCADA network. Task 2.3: Developed attack surface reduction techniques and tools that dynamically reduce attack surface and hence increase attacker’s cost without interfering in the critical functions of the system. Task 2.4: Prototyped, implemented, and quantitatively evaluated/validated the techniques and tools on a realistic industrial CPS security testbed environment by leveraging the unique resources of the team. Task 3: Developed Commercialization plan to transition the developed tools into power system industry stakeholders for a broader adoption by leveraging the expertise of our industrial members. Phase II: Task 4: Successfully completed field demonstration, verification, and evaluation of the effectiveness of the attack surface analysis and reduction techniques on a realistic utility testbed environment. This also involved the development of realistic scenarios, sound metrics, data sets, evaluation criteria, and documentation. Technology integration & Field demonstration: The project had significantly advanced the state-of-the-art research and practice in improving the cybersecurity of our nation’s power grid infrastructure against cyber threats. In particular, the proposed, designed, and deployed attack surface analysis and reduction algorithms and tools have contributed to significantly reducing the exposure and risk of the devices, substations, and the integrated SCADA/EMS/ DMS grid environment to cyber threat. Strong demonstration and evaluation techniques have verified the feasibility of the developed techniques on realistic cyber-physical testbeds and utility partner's real grid environment, and collaborative research and evaluation of attack surface reduction techniques (for wide-are monitoring and control) within a vendor (GE) EMS platform. The Attack Host Analyzer (AHA) tool that was developed through this project was made available through GitHub.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2022

Using Structured Intelligence Graph (STIG) to protect our critical infrastructure against cyber attacks [Poster]

STIG is a revolutionary cybersecurity tool developed by researchers at the U. S. Department of Energy's Idaho National Laboratory and it is a software that allows utility owners and operators to easily visualize, create, and edit cyberthreat intelligence information. STIG uses Structured Threat Information eXpression (STIX) and converts complex data on cybersecurity vulnerabilities into a visualization that is easy to understand and act on. With STIG, utility owners and operators have a common system for sharing threat intelligence information, thus increasing the chances of detecting and mitigating cyber exploits before they lead to a cyberattack.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2021

Universal Utility Data Exchange (UUDEX) – Security and Administration: Cybersecurity of Energy Delivery Systems (CEDS) Research and Development

A critical component of the Universal Utility Data Exchange (UUDEX) approach is the integrated security contained within its processing. This document describes how that security is designed and expected to be implemented by UUDEX Implementations (U-Implementations), including the UUDEX Server (U-Server) and UUDEX Clients (U-Clients). The UUDEX security hierarchy consists of three levels: 1. The UUDEX Instance (U-Instance) itself, which sits at the top of the hierarchy and contains the U-Server, the UUDEX Identity Authority (U-Identity Authority), and the UUDEX Administrator (U-Administrator) functions; 2. A group of one or more UUDEX Participants (U-Participants) that present “organizations” that participate in the U-Instance and contains the UUDEX Administrator Participant (U-U-Administrator Participant) function; 3. A group of one or more UUDEX Endpoints (U-Endpoints) that represent the individual UUDEX Publish Clients (U-Publish Client) responsible for supplying data to the U-Instance that is consumed by UUDEX Subscriber Clients (U-Subscriber Clients). U-Endpoints can be either autonomous devices that publish and subscribe data such as data exchange servers found in supervisory control and data acquisition and energy management systems, or they can be tied to users of applications that, for example, submit DOE OE-417 disturbance reports. U-Participants and U-Endpoints can be organized into UUDEX Groups (U-Groups). Any number of U-Participants or U-Endpoints can be members of a U-Group. A given U-Participant or U-Endpoint can be a member of multiple U-Groups, but a U-Group cannot contain other U-Groups. For example, a U-Group could be created to contain all U-Participant Transmission Operators within the purview of a Reliability Coordinator, and another U-Group could be created to contain all U-Participant Generator Operators within the purview of a Reliability Coordinator. U-Participants that are both Transmission Operators and Generator Operators would be members of both U-Groups. U-Participants, U-Endpoints, and U-Groups are used in the access control structures to provide access to individual UUDEX Subjects (U-Subjects). U-Groups are created by the U-Administrator and are managed by the U-Administrator or the designated U-Group Managers. U-Endpoints can be assigned UUDEX Roles (U-Roles) that can be used to further restrict access. U-Roles are assigned to individual U-Endpoints. For example, a U-Role of “Security Analyst” could be used to restrict which U-Endpoints can publish or subscribe security incident reports and vulnerability notifications, while a U-Role of “Transmission Planner” can be used to restrict which U-Endpoints can publish power system model updates. U-Role definitions are created by the U-Administrator, but the U-Roles are assigned to U-Endpoints by their respective UUDEX Participant Administrators (U-Participant Administrator). Because all information required to make security decisions is either included within the U-Endpoint’s X.509 digital certificate or stored in a datastore on the U-Server, all security decisions are performed and enforced within the U-Server. This reduces the complexity of the U-Client code and minimizes the chance for compromise of the integrity of the UUDEX security features.

97 MATHEMATICS AND COMPUTING↗

DOE OSTI2023

The Evaluation of Mechanical Properties of LB650 cavities

The PIP-II project’s LB650 cavities could potentially be vulnerable to mechanical deformation because of the geometric shape of the cavity due to reduced beta. The mechanical property of the niobium half-cell was measured following various heat treatments. The 5-cell cavities were tested in a controlled drop test fashion and the real-world road test. The result showed that the 900 C heat treatment was compatible with cavity handling and transportation during production. The test provides the bases of the transportation specification and shipping container design guidelines.

Holzbauer, J.↗

DOE OSTI2023

A Systematic Approach for Estimating High-Altitude Electromagnetic Pulse Coupling onto Power Generation Facility Equipment

A systematic approach is presented to evaluate the effects of high-altitude electromagnetic pulse (HEMP) signals on the equipment located inside a power generation facility. The approach uses a combination of practical measurement and simulation efforts to characterize the radio wave propagation behavior and the device immunity profile. Of particular interest in this work was estimating the vulnerability level of equipment that is connected to long cables. As an example application, a detailed study was conducted for one common class of facility equipment, and its frequency- and time-domain HEMP coupling properties were investigated as a function of terminal loading condition and cable attachment configuration. Overall, the proposed method can be generalized and applied to other electronic components and systems found in the facility environment.

42 ENGINEERING↗

DOE OSTI2023

Cybersecurity Anomaly Detection in SCADA-Assisted OT Networks Using Ensemble-Based State Prediction Model

The cybersecurity threats of power system gradually grow due to the increased sophisticated interactions between Information Technology (IT) and Operational Technology (OT) networks. False data injection attack (FDIA) that aims to compromise the Supervisory Control and Data Acquisition (SCADA) measurement and disturb the system operation is one of such cyber threats. Such attacks can potentially lead to significant operational issues at the control centers and substations, and hence, result in severe physical consequences. To avoid catastrophic failure across the power grid resulting from these attacks, it is essential to arm the OT network with real-time vulnerability assessment tools. To this end, this paper outlines various drawbacks of the Purdue architecture model to defend against cyberattacks in the OT network. Furthermore, a novel ensemble-based state prediction model is proposed to detect cybersecurity anomalies in SCADA assisted OT networks. The proposed model uses control center level generation and load forecasts, scheduled, and forced outages, power flow solutions, and the substation level historical data. The hypothesis of the proposed scheme relies on the fact that additional control center and substation data can hardly be accessed and compromised by attackers. One of the vital features of the proposed scheme is an hour-ahead prediction of the operational feasibility of the SCADA measurement range at the control center and substation in real time helps in detecting anomalies in measurements across both substation and the control center.

24 POWER TRANSMISSION AND DISTRIBUTION↗

DOE OSTI2023

COVID-19 Lead Time: Evaluating the timeliness and reliability of reported COVID-19 cases and hospitalizations as leading indicators of hospitalizations and death in the US

The COVID-19 pandemic prompted a reliance on real-time data sources to understand the global spread and impact of the SARS-CoV-2 virus. Reported cases were presumed leading indicators for hospitalizations, while hospitalizations were considered predictive of deaths. However, studies have questioned the consistency of reported cases as leading indicators. This study systematically assesses the reliability of United States (US) reported cases and hospitalizations as leading indicators for hospitalizations and deaths respectively, examining the first 2.5 years of the pandemic (January 2020 - June 2022) across different phases of the pandemic and states. Using correlation analysis, population data, and forecasting accuracy measures, we investigate the temporal relationships and identify possible determinants of lead time variability. Notably, we found that the average lead time between reported cases and hospitalizations across US states is relatively short at 1.76 days, implying that reported cases might not be as effective a leading indicator for hospitalizations as previously believed. Populations with higher comorbidity burdens, such as proportion of smokers, are expected on average to have shorter lead times, possibly due to shorter time to hospitalization among these vulnerable populations.

59 BASIC BIOLOGICAL SCIENCES↗