Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “vulnerabilities”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 1,441 records · Page 80
All sourcesNASA NTRSDOE OSTI
DOE OSTI2022

Oak Ridge National Laboratory Pilot Demonstration of an Attestation and Anomaly Detection Framework using Distributed Ledger Technology for Power Grid Infrastructure

This report summarizes the design and pilot demonstration of a framework called Grid Guard that was created to provide increased data and device trustworthiness to electric grid devices by leveraging distributed ledger technology (DLT), specifically blockchain. Grid Guard contains a combination of core cryptographic methods such as the secure hash algorithm (SHA), and asymmetric cryptography, private permissioned blockchain, baselining configuration data, consensus algorithm (Raft) and the Hyperledger Fabric (HLF) framework. The system implements a low energy, fast, and robust enhancement to system trustworthiness within and across electric grid systems such as substations, control centers and metering infrastructures. Blockchain is a distributed database structured that provides a practically unalterable (immutable) timeline of stored transactions. By relying on hashing and the Raft consensus algorithm, if an entity tries to illegitimately alter a record at one instance of the database the other ledger nodes are not altered. They work to cross-reference each other and easily locate any incorrectly added data and remove it. The bulk raw data is stored in an off-chain storage (outside of the blockchain ledger) and a hash of this baseline data is stored in the Blockchain ledger via hashing windows of time-series and configuration data, after aggregation and filtering. The bulk off-chain data repository is then considered to be trust-anchored using the hashes stored in the blockchain. To secure the electric grid testbed devices and data, device configuration baselines were compared to those baselines that had been previously stored in the ledger. Statistical baselines for device configurations, network communication patterns, and high-speed sensor data are calculated and then stored off-chain and hashes stored in the ledger. Measurements such as three-phase voltage and current, frequency, breaker status, protection scheme settings, network configuration settings (and other device configuration artifacts) and network traffic features (packet interarrival times) are compared every minute or other selected time windows. During phase 1 of the Grid Guard DLT project different DLT technologies were studies, and an assessment was performed on DLT technology vulnerabilities, uses, and key characteristics. DLT consensus protocols were studies (e.g., RAFT, named after Reliable, Replicated, Redundant, And Fault-Tolerant). Also, cryptography, public, private and permissioned or permissionless systems were assessed. Grid Guard implements a permissioned private DLT. Consensus algorithm selection and choice of DLT implementation depended heavily on the use-case. For this use-case, parameters were selected to measure performance and existing tools for assessment. Benchmarking was performed theoretically and practically. During phase 2 hashed transactions/blocks were inserted into the ledger every second. During phase 2 of the Grid Guard DLT project, a prototype framework was developed and demonstrated for attestation of critical substation devices and data using precision timing systems that use PTP and IRIG-B protocols) on a testbed of operational devices that emulated a distribution substation, control center, and power metering infrastructure using real Operational Technology (OT). The testbed includes OT devices such as protective relays, human machine interfaces (HMI), and power meters. To determine when to collect and compare system and network baselines, an initial examination of an anomaly detection capability to identify malicious manipulation of data streams was conducted. The resulting anomaly detection was demonstrated in a set of experiments and leveraged to trigger device artifact attestation checks. Attestation checks occur against device configuration baselines when compared with the immutable blockchain-stored baselines, which provided a cryptographically supported means by which to store baselines. The electrical substation-grid testbed was created to test the Grid Guard framework. The testbed emulates the operations of a portion of a power grid and SCADA systems as closely as possible. The testbed integrates real protocols, mainly IEC 61850 standard protocols, such as the Sampled Value (SV) and the GOOSE protocols. The testbed also supports DNP3 and other layer 2 and layer 3 protocols such as Telnet, SSH, SFTP/FTP and other proprietary protocols needed to connect to industrial control system equipment. The testbed emulates real power conditions using the OpalRT hardware-in-the-loop (HIL) device which can create fault situations that cannot be easily tested on real systems. The electrical substation-grid testbed was created using real measurement, communication, and protection devices that electrical utilities commonly use.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Net-zero Microgrid Program Report: Microrred de la Montaña Feasibility Study (Executive Summary Extended)

This feasibility study provides the technical and economic rationale for the Microrred de la Montaña as a viable solution for supplying reliable and resilient electricity to an underserved region in Puerto Rico – a region that is the first to be disconnected from the grid and the last to be restored, enduring months long outages. It begins the process of the development of the microgrid through conceptual design, engineering, detailed electrical design, implementation, and operation. The Microrred de la Montaña is organized under the governance of the Cooperativa Hidroeléctrica de la Montaña (Cooperativa) which has legal status as a cooperative and power provider under the laws of Puerto Rico. The members are the municipalities of Adjuntas, Jayuya, Lares and Utuado with a combined population of 90,000. These municipalities are in central Puerto Rico – a mountainous region that is extremely vulnerable to weather events and excessive, long-duration power outages and are among the poorest and most disadvantaged regions in Puerto Rico. Funding from external sources is necessary to acquire the resources for a resilient power delivery system. Regulatory support is necessary to establish operational relationships with the incumbent power providers. The Microrred de la Montaña is envisioned as a resilient microgrid that manages distributed energy resources – local solar, storage, and hydroelectricity over an upgraded distribution network within the boundaries of four municipalities. This feasibility study provides the results of an extensive techno-economic analysis to form a sound basis for decision-making by community leaders, their constituents, funding and investment agencies, and regulators to realize the benefits that are achievable by fully implementing the design and planning recommended for the Microrred de la Montaña.

13 HYDRO ENERGY↗
DOE OSTI2022

Cyber-Physical Resiliency for Wind Power Generation

During the next three years, wind power generation is expected to add more generation capacity to the national electrical grid than any other energy sector. With new wind turbine designs rated power over 10 MW and wind farms reaching over 1 GW capacities, the consequences of cyber-attacks on wind power generation are becoming increasingly more critical. Moreover, the known vulnerabilities of wind turbine control systems and the potential damaging effects of intrusions, motivate an urgent protection improvement for the wind power generation sector. This program has developed a variety of new adaptive defense technologies that enable wind power generation systems to survive sophisticated cyberattacks by enhancing the control systems capabilities of detection, localization, and accommodation. The introduction of these technologies in the on-shore and the emerging off-shore market will result in a significantly more reliable and secure wind power infrastructure.

17 WIND ENERGY↗
DOE OSTI2022

Satellite Enveloped with STITCHED Engineering Sensors for Detection of Approaching Objects

Today as well as tomorrows spaceborne assets impact almost all areas of national and nuclear security. Spaceborne assets can not only collect and disseminate valuable data, well beyond just the visual, but also track terrestrial-based mobile assets in real-time, and active spaceborne platforms potentially pose serious risk to vulnerable earth-based systems and infrastructures. The capability to defend national spaceborne assets from attack/interference is critical for security interests. This effort supports this mission through the cost-effective preeminent detection of approaching threats to our nation’s vital resources, in order to help secure and trust these high-value assets against the threats of tomorrow. This project develops novel fabrication techniques for conformal, low-profile and lightweight leakywave antenna (LWA) detection/imaging systems, which fuses technical embroidery (TE) and laser ablation (LA) processes with LWA design. Technical embroidery is an emerging field in additive textile manufacturing where flexible materials and functionalized fabrics are created for a wide variety of uses and purposes, while laser ablation is the process of removing material from a solid surface by irradiating it with a laser beam. Here, thin, conformal antenna designs are designed, modeled and fabricated using both TE and LA, to create lightweight, flexible and conformal object detection and imaging radars. This novel development ensures our nation’s ability to field advanced lightweight and conformal technologies to protect spaceborne assets.

42 ENGINEERING↗
DOE OSTI2022

Advanced Serpentine Heat Exchangers to Minimize Number of Joints and Leakage in HVAC&R Systems

Refrigerant leakage has a significant impact on heating, ventilation, air conditioning and refrigeration (HVAC&R) industries in terms of both greenhouse gas (GHG) emissions and lost efficiency of the systems themselves. One of the major causes of refrigerant leakage is braze joints within a vapor compression system. The brazing process is often inconsistent and almost always imperfect. As a result, braze joints are left vulnerable to leaks and can be weaker than non-brazed tubing. Conventional tube-fin heat exchangers are manufactured using one brazed joint per tube. An alternative to the conventional approach is the use of a single continuous serpentine tube. An Advanced Serpentine Heat Exchanger was developed to provide a heat transfer solution that meets or exceeds performance while also significantly reducing the number of joints and, consequently, the potential for refrigerant leakage. The developed serpentine heat exchanger not only delivers on performance, but is also cost competitive with conventional heat exchangers on the market.

30 DIRECT ENERGY CONVERSION↗
DOE OSTI2022

EFCOG Best Practice HPI for Knowledge Workers ISM-HPI-22-02

This document is a collection of these best practices as determined by team members. This best practice attempts to: Realize opportunities to break the myth where people believe that HPI does not apply to them as they perform no physical work. Recommend options to create an environment that promotes intellectual collaboration and trust, enabling candor and vulnerability. Explain how errors manifest differently from the same human fallibility. Knowledge workers (KW) have errors that take different perspectives to find and mitigate the unique manifestation of these conditions. Help KW identify the critical steps (or risk important steps) in their processes. Reduce risk/consequence from KW errors (limit latent errors as well as finding latent conditions), building resiliency into KW tasks. Mitigation strategies may be different.

96 KNOWLEDGE MANAGEMENT AND PRESERVATION↗
DOE OSTI2022

Autonomous System Subversion Tactics: Prototypes and Recommended Countermeasures

One of the fielding requirements for Advanced and Small Modular Reactors (AR/SMR) is the ability to support remote and autonomous operations. Autonomous Control Systems (ACS) are found on platforms such as Autonomous Space Vehicles, Cruise Missiles, and advanced driver-assistance systems. Each of these ACS implementations depends upon a set of decision support subsystems responsible for supporting Autonomous Mission Managers (names vary based upon field and author preferences). These Autonomous Mission Managers receive inputs from system sensors (e.g., LIDAR collection from an automobile travelling down a street; transients from a nuclear reactor), and perform a set of classifications (e.g., Red Traffic Light; Small Pedestrian at 10m; Load Rejection; Single Coolant Pump Trip), and then use these classifications in combination with recommendation algorithms to achieve platform goals (e.g., Stop the Vehicle at the Traffic Light, Avoid the Small Pedestrian; Trip the Reactor to prevent a Safety Event). The design, implementation, and fielding of an ACS capability will alter the cyber-attack surface such that existing risk management plans will need to be updated to include how to protect and defend against data-science and decision-support-system attack classes. These attack classes would include protection of the design and training environments where algorithm selection and testing and training data would be obvious attack vectors. These attack classes would also require an informed set of detection and response procedures to identify anomalous behaviors and document best practices for anomaly assessment and vulnerability mitigation and remediation. Last year we published a Cyber Threat Assessment Methodology for Autonomous and Remote Operations for AR/SMRs along with a companion publication on Cyber Attack and Defense Use Cases. The focus of the methodology was on describing and enumerating ACS processes, components, and functions such that security engineers could: evaluate subversion options against the target; identify threat actor attributes and capabilities derived from each subversion option; and identify security controls and response countermeasures. The Use Cases document offered detailed methodology examples including an assessment of a Military Base SMR, an Autonomous System Decision Loop, and implementation of AR/SMR Machine Learning algorithms. Our proposal at the end of last year was to focus on implementation of subversion prototypes related to the last Use Case area: AR/SMR Machine Learning (ML) Algorithms. We included six attack scenarios in our Use Cases paper: a Poisoning Attack against ML functions implemented using an FPGA; a Trojaning Attack against ML classifiers exploiting the excitability of Nuclear Engineers; a Backdooring Attack against ML Training environments to ensure persistence of an attack vector; a False Positive Evasion Attack against multi-factor Access Control Systems using clever inputs; an Inference Attack against ML models by an Insider with access to the Operational environment; and an Adversarial Reprogramming Attack against a Material Access Control Video Surveillance System. At the beginning of this year these six attack scenarios were provided to our research teams at Georgia Tech and Idaho State University and each team successfully implemented a subversion attack against a ML implementation to include transient misclassifications. While this is a notable outcome from this type of research, this paper offers the reader insight into not only how to structure and execute these types of attacks, but into the thought process behind how the researcher investigated the problem space, performed initial algorithm implementation, and the trial-and-error behind arriving at the successful subversion prototypes. We include in this paper a set of associated Scenarios on how these subversion prototypes could be implemented and an initial set of guidance for AR/SMR architects, Nuclear Regulators, and Cyber Defenders to implement awareness and defense capabilities into their current operational portfolios.

42 ENGINEERING↗
DOE OSTI2022

Florida Alternative Transportation Fuel Resilience Plan

Hurricanes are increasing in frequency, intensity, duration, and are projected to continue increasing. Many counties and cities in Florida are developing resilience plans to help them minimize damage from hurricanes and accelerate recovery. The transportation portion of these plans tend to focus on bolstering road infrastructure, stockpiling diesel for strategic fleets, purchasing high-water vehicles, and placing evacuation shelters in safe areas. An Achilles heel of these plans is their dependence on diesel fuel, which is particularly vulnerable to hurricane-related disruptions since 90% of petroleum in Florida needs to be imported via maritime tanker. These tankers are restricted from accessing Florida ports before and during hurricanes because the risks of damage to the port facilities and tanker are too high. Therefore, transportation resilience can be fortified by diversifying the transportation fuels utilized in a hurricane.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2023

Probabilistic Failure Criterion of SiC/SiC Composites Under Multiaxial Loading

Owing to its excellent mechanical properties and stability under high temperature and neutron irradiation conditions, SiC/SiC composites have emerged as a promising material for light water reactors (LWRs) in the development of accident-tolerant fuel (ATF) systems. Structural integrity and retention of hermeticity are two crucial requirements for SiC/SiC claddings during normal operations, and both of them are closely related to the proportional limit stress (PLS) of the material. Understanding the behavior of SiC/SiC composites under multiaxial stress states and developing a probabilistic approach for evaluating the structural vulnerability are of paramount importance for reliability-based analysis and design of SiC/SiC composite claddings. So far, there has been very limited effort towards experimental and analytical investigations of probabilistic failure of SiC/SiC claddings. This critical knowledge gap motivates this research. A probabilistic failure criterion for SiC/SiC composites under multi-axial loading is developed, and this criterion is incorporated into reliability analysis of the structural integrity of SiC/SiC fuel cladding. The research consists of two parts: 1) experimental investigation of multiaxial failure behavior of SiC/SiC composites, and 2) theoretical modeling of time-dependent probabilistic failure of SiC/SiC cladding. In the experimental investigation, the PLS is determined through the examination of stress-strain response, the acoustic emission measurement, as well as the X-ray computed tomography. The theoretical framework is derived by combin- ing the finite weakest-link statistical model and the subcritical damage growth model. This theoretical model captures the time-dependent failure mechanism of the material, which has a major consequence for predicting the lifetime distribution of the cladding. Meanwhile, the model also predicts that the failure statistics of the cladding depends strongly on the cladding length. The results of the multiaxial experiments reveal the level of statistical variation of the PLS of SiC/SiC materials under different stress states. The theoretical model provides a robust analytical tool for extrapolation of small-scale laboratory test results to the behavior of full-scale claddings. These findings establish a scientific foundation for the development of reliability-based design of SiC/SiC fuel claddings, which will play an essential role in improving the structural safety and integrity of LWRs.

42 ENGINEERING↗
DOE OSTI2023

Understanding and Predictability of Integrated Mountain Hydroclimate (Workshop Report)

Mountainous systems cover approximately 23% of Earth’s land and are distributed across all continents. They can capture and store atmospheric moisture that is then cycled through the terrestrial surface and subsurface system, released to downstream communities, and cycled back to the atmosphere. Mountain hydroclimate—characterized by steep gradients, geological, ecological, and biogeochemical diversity—is influenced by topographic forcing and elevated warming and susceptible to large subseasonal to multidecadal variability and rapid changes. Terrestrial hydrological and biogeochemical cycles also experience cascading effects from global warming impacts, such as multidecadal declines in mountain snowpack, longer growing seasons, and increased frequency and severity of extreme events like droughts and wildfires. However, little is known about the effects of these impacts and their feedbacks on climate systems and surface-subsurface compartments. Also unknown are the full implications of changing hydroclimate and extreme events on hydro biogeochemical cycles across atmosphere, terrestrial, and human systems in mountain regions and beyond. This knowledge gap is critical, given human reliance on mountain systems for stable water supply and quality. Mountain systems’ increasing vulnerability to climate change and human perturbations motivates the need to improve understanding of integrated mountain hydroclimate (IMHC) systems and their feedbacks and impacts on humans across scales. However, due to large heterogeneity and strong gradients, coupled natural-human processes in mountain regions present significant challenges for observations, modeling, predictions, and projections. Motivated by gaps in mountain hydroclimate understanding, observations, and modeling and the need for credible projections of future changes, the U.S. Department of Energy’s (DOE) Biological and Environmental Research (BER) program organized a virtual workshop on “Understanding and Predictability of Integrated Mountain Hydroclimate.” Sponsored by BER’s Earth and Environmental Systems Sciences Division (EESSD), the workshop aimed to inform and catalyze EESSD’s growing interests in enhancing predictive understanding of IMHC. Organizers structured the workshop to identify (1) knowledge gaps, (2) observational and modeling challenges, (3) short-term (1 to 3 years) and long-term (10 years and beyond) research opportunities, and (4) strategies for fostering collaboration and coordination. To address the outstanding challenges of IMHC, the workshop included two sessions organized by disciplinary, cross-disciplinary, and crosscutting science topics. The disciplinary and cross-disciplinary topics focused on essential IMHC elements: atmosphere, terrestrial, and human systems and their interactions. Breakout sessions on disciplinary and cross-disciplinary topics facilitated identification of crosscutting topics and central emerging themes. Session 1 focused on connecting existing DOE investments to accelerate progress related to scientific challenges in understanding mountain hydroclimate. In Session 2, participants further explored key Session 1 takeaways through the lens of multiagency collaborations and coordination.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2022

US Department of Energy, Office of Science High Performance Computing Facility Operational Assessment 2021: Oak Ridge Leadership Computing Facility

Oak Ridge National Laboratory’s (ORNL’s) Leadership Computing Facility (OLCF) continues to surpass its operational target goals of supporting users; delivering fast, reliable computational ecosystems; creating innovative solutions for high-performance computing (HPC) needs; contributing to the community to build the next generation HPC workforce, and managing risks, safety, and security associated with operating some of the most powerful computers in the world. The results can be seen in the cutting-edge science conducted by users and the praise from the research community. Calendar year (CY) 2021 saw continued excellence in research supported by the OLCF’s leadership-class computing resources, including Summit (the nation’s most powerful supercomputer), the global scratch file system Alpine, the Scalable Protected Infrastructure (SPI), the Exploratory Visualization Environment for Research in Science and Technology (EVEREST), and the archival mass-storage resource High-Performance Storage System (HPSS). While maintaining access and exceptional user support for Summit, the OLCF continued to make progress on the installation and deployment of Frontier, which will be the nation’s first exascale system when it comes online at the start of CY 2023. Users have already begun running and optimizing scientific codes on Crusher, the OLCF test and development system equipped with Frontier’s architecture. Throughout the year, the OLCF maintained a strong culture of operational excellence, including risk management, workplace safety, and cybersecurity. The OLCF’s rigorous risk management strategy anticipated and mitigated risks, and at this time there are no high-priority operational risks. Similarly, ORNL and the OLCF were committed to operating under the US Department of Energy’s (DOE’s) safety regulations that ensure a safe workplace. Technical staff tracked and monitored existing threats and vulnerabilities within the OLCF while continually developing tools and practices to enhance operations without increasing the facility’s risk. CY 2021 was filled with outstanding results and accomplishments, including a very high rating from users on overall satisfaction for the eighth consecutive year; a tremendous number of node hours delivered to 1,671 researchers on Summit; and the successful delivery of the allocation split of roughly 60%, 20%, and 20% of core-hours offered for the Innovative and Novel Computational Impact on Theory and Experiment (INCITE), Advanced Scientific Computing Research Leadership Computing Challenge (ALCC), and Director’s Discretionary (DD) programs, respectively (Section 2). COVID-19 research remained a focus in 2021, and the ALCC and DD programs allocated over 1 million Summit hours to the COVID-19 High Performance Computing Consortium. These accomplishments, coupled with the high utilization rates (i.e., overall and capability usage), represent the fulfillment of the promise of leadership class machines: efficient facilitation of leadership-class computational applications.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2023

Innovative Strategies for Long-Term Monitoring of Complex Groundwater Plumes at DOE’s Legacy Sites (Workshop Report)

Most remaining Department of Energy (DOE) sites will require extended periods of institutional control, especially at complex groundwater sites where attenuation-based strategies have been implemented to facilitate closure. The current practice of monitoring—obtaining and analyzing contaminant concentration in groundwater samples at numerous wells—will account for a large portion of the projected life-cycle at these DOE sites unless a new approach is adopted. State-of-the-art technologies are being developed, including in situ sensors, geophysics, radiation mapping, numerical modeling and AI/ML. These technologies can optimize monitoring strategies in space and time, provide spatially extensive information at vulnerable regions and/or provide more continuous monitoring at lower cost. As part of DOE’s Office of Environmental Management (DOE-EM’s) efforts to advance long-term monitoring systems, an in-person/virtual hybrid workshop was hosted by Savannah River National Laboratory (SRNL) on January 24 and 25, 2023, in Augusta, Georgia. Because DOE-EM’s complex sites will eventually be transferred to DOE’s Office of Legacy Management (DOE-LM), representatives of DOE-LM were important participants in the workshop. The purpose of the workshop was to identify challenges and opportunities for deploying advanced technologies for long-term monitoring at DOE sites. The key questions during the workshop were: 1) the regulatory acceptance of replacing a process that traditionally has used laboratory sampling and analysis of groundwater samples, and 2) the application of this strategy to the southwestern arid sites that include many of the remaining DOE-EM and DOE-LM complex groundwater plumes. Characteristics common to most arid sites present both limitations and opportunities for advanced technologies. DOE-EM has funded a National Laboratory team from SRNL, Lawrence Berkeley National Laboratory (LBNL), and Pacific Northwest National Laboratory (PNNL) to establish the overarching framework of long-term monitoring by systematically combining advanced hardware and software technologies. This project is titled “Advanced Long-Term Environmental Monitoring Systems (ALTEMIS)” and is sponsored by the DOE-EM Technology Development Program. The multi-laboratory team is currently developing and testing innovative monitoring strategies, including the use of in situ groundwater sensors, geophysics, drone/satellite-based remote sensing, reactive transport modeling, and artificial intelligence/machine learning (AI/ML). The project’s demonstration testbed is at the Savannah River Site (SRS) F-Area Seepage Basins, where a well-characterized complex groundwater plume composed of uranium and other radionuclides is in the latter stages of remediation. The workshop included more than 70 participants, presentations, a field visit to F-Area, breakout working groups, and large group discussion. Participants developed recommendations on five topics: in situ sensors, spatially integrative tools, challenges to regulatory acceptance, AI/ML strategies, and transitioning sites to DOE-LM.

12 MANAGEMENT OF RADIOACTIVE AND NON-RADIOACTIVE W↗
DOE OSTI2023

Puerto Rico Historical Climate Analysis: A closer look at complex tropical terrain

Small tropical islands like Puerto Rico are especially vulnerable to climate change impacts, yet are often underrepresented in most datasets because the spatial resolution is too coarse to sufficiently cover their complex terrain. This study was done to better understand how the climate has changed in the various regions of Puerto Rico, which will support a transition to renewable energy and aid in projecting future climate impacts on the residents and land they live on. This study used multiple datasets including Daymet, a daily surface weather and climatological summary; European Centre for Medium-Range Weather Forecasts Reanalysis version 5 (ERA5); and station observations. The climate variables examined here include minimum and maximum near-surface air temperature, daily precipitation, incident shortwave radiation, and large-scale upper atmosphere conditions. The time periods cover the years 1950–2019. Results in both Daymet and station observations show long-term warming trends throughout every season. In particular, the minimum winter temperatures increased the most compared with maximum and mean air temperature. Northeast Puerto Rico, where the majority of the island’s population is located, experienced the largest warming. Summertime precipitation has decreased over time, and spring and fall precipitation has increased. The largest increase in fall is because there has been more available precipitable water, lower sea-level pressure, and favorable cyclonic circulations from the trade winds over the past seven decades. Overall, wet days are getting wetter, while dry days are getting drier. While there are good solar energy potential, we see a long-term decreasing trend in shortwave radiation over time in all seasons across entire island, possibly due to the increase of cloud cover.

54 ENVIRONMENTAL SCIENCES↗
DOE OSTI2023

Cyber-CHAMP White Paper

Cyber-CHAMP white paper intern school assignment. Worldwide there is a tremendous shortfall in the cybersecurity workforce. By 2021, researchers have forecasted a deficit of 3.5 million cyber professionals. As workforce capabilities diminished, the world's cybersecurity threats have continued to multiply. Industrial control systems (ICSs) and their operational technology (OT) components became more vulnerable to attack and compromise. When an ICS is compromised, attackers can cause widespread impacts on national security, public health, and safety. This capacity makes ICSs attractive targets, with 90% of surveyed OT organizations reporting a damaging cyberattack in the last two years. To address the risk to ICSs, personnel must be competent in operational best practices and the latest threats. While frameworks for information technology (IT) cybersecurity education have been developed, educational standards for OT cybersecurity are nonexistent.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2022

A Cybersecurity Threat Profile for a Connected Lighting System

In anticipation of improved energy performance and cost savings, cities and building owners are increasingly considering “smart lighting initiatives” that aim to convert their collection of simple luminaires (i.e., lighting fixtures) into an intelligent connected lighting system (CLS) capable of remotely monitoring energy consumption and fault conditions, and possibly implementing adaptive lighting schemes. The U.S. Department of Energy (DOE) has set an national goal of tripling the energy efficiency and demand flexibility of the buildings sector by 2030, relative to 2020 levels 1. It is forecast that connected lighting systems can contribute to that goal by delivering 125 TWh of annual energy savings by 2035 2, equivalent to the annual output of 50 typical (500 MW) power plants. However, these energy savings and the DOE goal are put at significant risk if connected technologies are not adopted due to real or perceived cybersecurity concerns. Connected IoT devices such as these have historically been rife with vulnerabilities which sometimes put security considerations secondary to functionality and operability. What are the cybersecurity threats that will impact these systems, as formerly banal luminaires transition into intelligent connected devices that collect information about themselves, their surrounding environment, and possibly us? In this paper we analyze a threat profile performed on a fault-detection use case for streetlights. A threat profile establishes security requirements, justifies security measures, yields actionable controls, and effectively communicates risk to stakeholders. This effort provides critical information for making threat-based decisions to increase security at a reasonable cost, and can effectively be used by development teams, software architects, and managers to make cybersecurity a part of their ongoing culture of awareness, training, and prevention. This leads to more secure systems and better-understood security. On-premise, cloud, and hybrid architectures with different authentication mechanisms were modeled and later categorized using the Microsoft STRIDE framework. An analysis of the recommended controls for each threat was performed to determine which controls could and should be put in place by manufacturers or third-party suppliers, and which controls need to be left up the end-user to implement. Fifty-seven threats were identified. Among our key findings: (1) 65% (37/57) of the threats did not involve the luminaires, but rather the other components needed to communicate with and manage them; (2) 63% (36/57) of the threats could have been mitigated through manufacturer-implemented defensive techniques or “controls”; and (3) 23% (13/57) of the threats were dependent on the network configuration. Recommendations based on the results of this work are made to key stakeholder groups. Notably, lighting technology developers are advised to address all threats that can be reasonably controlled with baked-in technology solutions (e.g., encryption or authentication controls), and employ some form of secure supply chain management and tracking where other parts (e.g., sensors, microprocessors) of a luminaire must also be built and manufactured with the proper security controls in place. Developers should also review threats involving assets not developed in-house to understand how connectivity with other devices will affect their product during system operation and determine if a compensating control for a defense-in-depth strategy will be needed. Finally, those interested in deploying CLS should compare the differences between cloud and on-premise models to determine which is more suitable for their needs and the abilities of their security team.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
DOE OSTI2023

Implementing the National Initiative for the Advancement of Building Codes (NIABC)

On June 1, 2022, the White House launched the National Initiative to Advance Building Codes (NIABC): a whole-government initiative to assure alignment of, and minimum standards for, all building activity funded through federal agency programs. This includes ensuring the use of current consensus-based model building and energy codes and standards, with a focus on underserved and vulnerable communities. The initiative will accelerate the adoption of modern building codes to improve resiliency, create good-paying jobs, and lower energy bills.

29 ENERGY PLANNING, POLICY, AND ECONOMY↗
DOE OSTI2021

Autonomous Tools for Attack Surface Reduction (Final Report)

The electric power grid is a complex critical infrastructure that forms the lifeline of modern society, and its secure and reliable operation is of paramount importance to national security and economic wellbeing. However, recent findings documented in authoritative sources indicate the threat of cyber-based attacks growing in numbers and sophistication. However, securing the grid against stealthy cyberattacks is a challenging task due to legacy nature of the infrastructure coupled with dynamic nature of threat landscape and ever-growing sophistication of the adversaries. Additionally, the grid’s attack surface continues to grow with the increased dependence on digital communications and control that now extends to each consumer through smart meters and distributed energy resources. Unfortunately, this expansive surface increases the grid’s vulnerability and further exposes critical control systems in both substations and control centers. To respond to this emerging need, we had successfully assembled an interdisciplinary team with academic- industry partnership to successfully conduct research, development, evaluation, demonstration, and commercialization of attack surface reduction tools, whose goal was to significantly reduce the cyber attack surface in the North American power grid. Our proposed project was a synergistic collaborative effort leveraging the synergistic expertise of the team members across power systems, cyber security and CPS security, testbeds, field deployments and demonstration, and successful commercialization. The following are the specific tasks that have been successfully completed two phases (2016-2020). Phase I: Task 1: Developed and implemented a robust Project Management and Data Management Plan, coupled with a well thought out Risk Mitigation Plan. Task 2.1: Developed a comprehensive framework that continually assesses and autonomously reduces the attack surface for the power grid control environment spanning across substations, control center and the SCADA network to significantly reduce the risks of cyber attacks. Task 2.2: Developed attack surface analysis techniques, metrics, and tools that assess the attack surface at multiple levels including the control center, substations, and the SCADA network. Task 2.3: Developed attack surface reduction techniques and tools that dynamically reduce attack surface and hence increase attacker’s cost without interfering in the critical functions of the system. Task 2.4: Prototyped, implemented, and quantitatively evaluated/validated the techniques and tools on a realistic industrial CPS security testbed environment by leveraging the unique resources of the team. Task 3: Developed Commercialization plan to transition the developed tools into power system industry stakeholders for a broader adoption by leveraging the expertise of our industrial members. Phase II: Task 4: Successfully completed field demonstration, verification, and evaluation of the effectiveness of the attack surface analysis and reduction techniques on a realistic utility testbed environment. This also involved the development of realistic scenarios, sound metrics, data sets, evaluation criteria, and documentation. Technology integration & Field demonstration: The project had significantly advanced the state-of-the-art research and practice in improving the cybersecurity of our nation’s power grid infrastructure against cyber threats. In particular, the proposed, designed, and deployed attack surface analysis and reduction algorithms and tools have contributed to significantly reducing the exposure and risk of the devices, substations, and the integrated SCADA/EMS/ DMS grid environment to cyber threat. Strong demonstration and evaluation techniques have verified the feasibility of the developed techniques on realistic cyber-physical testbeds and utility partner's real grid environment, and collaborative research and evaluation of attack surface reduction techniques (for wide-are monitoring and control) within a vendor (GE) EMS platform. The Attack Host Analyzer (AHA) tool that was developed through this project was made available through GitHub.

24 POWER TRANSMISSION AND DISTRIBUTION↗
DOE OSTI2022

Using Structured Intelligence Graph (STIG) to protect our critical infrastructure against cyber attacks [Poster]

STIG is a revolutionary cybersecurity tool developed by researchers at the U. S. Department of Energy's Idaho National Laboratory and it is a software that allows utility owners and operators to easily visualize, create, and edit cyberthreat intelligence information. STIG uses Structured Threat Information eXpression (STIX) and converts complex data on cybersecurity vulnerabilities into a visualization that is easy to understand and act on. With STIG, utility owners and operators have a common system for sharing threat intelligence information, thus increasing the chances of detecting and mitigating cyber exploits before they lead to a cyberattack.

24 POWER TRANSMISSION AND DISTRIBUTION↗