CICI: SSC: Real-Time Operating System and Network Security for Scientific Middleware

使用防火墙和用户密码保护对工业控制系统的远程监控。通过防火墙的网络攻击可以不受限制地访问指挥工业控制系统，这可能会损害受攻击系统附近的数字资产、环境资源和人类。为了防止和减轻科学工业控制系统中的此类危害，该项目增强了用于高能物理、天文学和空间科学的开源网络基础设施的安全性。该项目的成果提高了用于粒子加速器、大型望远镜、卫星和空间探测器的科学仪器的安全性。对科学和公众的好处包括对从这些科学仪器收集的实验数据的保真度更有信心，以及科学网络基础设施的可靠性增加，从而降低了与意外错误配置或恶意网络攻击相关的成本。该项目的目标是增强开源多处理器系统实时执行程序(RTEMS)实时操作系统以及实验物理和工业控制系统(EPICS)软件和网络的安全性；RTEMS和EPICS是控制科学仪器的广泛使用的网络基础设施。安全增强涉及八个相关项目活动：(1)作为持续集成的一部分的静态分析和安全模糊；(2)开源软件开发生命周期的加密安全；(3)远程管理科学仪器的安全引导和更新；(4)用于安全通信的开源加密库；(5)实时内存保护；(6)网络协议的正式建模和分析；(7)增强的安全事件记录；以及(8)科学工业控制系统的基于网络的入侵检测。项目成果提供了一个路线图，在促进网络基础设施软件工程和工业控制系统安全方面的最先进研究的同时，在开源、开放科学社区中培养网络安全最佳实践。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Remote monitoring and control of industrial control systems are protected using firewalls and user passwords. Cyberattacks that get past firewalls have unfettered access to command industrial control systems with potential to harm digital assets, environmental resources, and humans in proximity to the compromised system. To prevent and mitigate such harms in scientific industrial control systems, this project enhances the security of open-source cyberinfrastructure used for high energy physics, astronomy, and space sciences. The results of this project enhance the security of scientific instruments used in particle accelerators, large-scale telescopes, satellites, and space probes. The benefits to science and the public include greater confidence in the fidelity of experimental data collected from these scientific instruments, and increased reliability of scientific cyberinfrastructure that reduces the costs associated with accidental misconfigurations or malicious cyberattacks.The objective of this project is to enhance the security of the open-source Real-Time Executive for Multiprocessor Systems (RTEMS) real-time operating system and the Experimental Physics and Industrial Control System (EPICS) software and networks; RTEMS and EPICS are widely used cyberinfrastructure for controlling scientific instruments. The security enhancements span eight related project activities: (1) static analysis and security fuzzing as part of continuous integration; (2) cryptographic security for the open-source software development life cycle; (3) secure boot and update for remotely-managed scientific instruments; (4) open-source cryptographic libraries for secure communication; (5) real-time memory protection; (6) formal modeling and analysis of network protocols; (7) enhanced security event logging; and (8) network-based intrusion detection for scientific industrial control systems. The project outcomes provide a roadmap for enculturating cybersecurity best practices in open-source, open-science communities while advancing the state-of-the-art research in cyberinfrastructure software engineering and industrial control system security.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.