CICI: SSC: Real-Time Operating System and Network Security for Scientific Middleware

工业控制系统的远程监视和控制使用防火墙和用户密码进行保护。通过防火墙的网络攻击可以不受限制地访问指挥工业控制系统，有可能损害数字资产、环境资源和受损系统附近的人员。为了防止和减轻科学工业控制系统中的此类危害，该项目增强了用于高能物理、天文学和空间科学的开源网络基础设施的安全性。该项目的成果增强了粒子加速器、大型望远镜、卫星和空间探测器等科学仪器的安全性。对科学和公众的好处包括对从这些科学仪器收集的实验数据的保真度有更大的信心，以及提高科学网络基础设施的可靠性，从而降低与意外错误配置或恶意网络攻击相关的成本。该项目的目标是增强开源多处理器系统实时执行器（RTEMS）实时操作系统和实验物理与工业控制系统（EPICS）软件和网络的安全性；RTEMS和EPICS是广泛应用于科学仪器控制的网络基础设施。安全增强包括八个相关的项目活动：(1)作为持续集成的一部分的静态分析和安全模糊测试；(2)开源软件开发生命周期的加密安全；(3)远程管理科学仪器的安全启动和更新；(4)用于安全通信的开源加密库；(5)实时内存保护；(6)网络协议的形式化建模与分析；(7)增强安全事件记录功能；(8)基于网络的科学工控系统入侵检测。项目成果为在开源、开放科学社区培养网络安全最佳实践提供了路线图，同时推进了网络基础设施软件工程和工业控制系统安全方面的最新研究。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Remote monitoring and control of industrial control systems are protected using firewalls and user passwords. Cyberattacks that get past firewalls have unfettered access to command industrial control systems with potential to harm digital assets, environmental resources, and humans in proximity to the compromised system. To prevent and mitigate such harms in scientific industrial control systems, this project enhances the security of open-source cyberinfrastructure used for high energy physics, astronomy, and space sciences. The results of this project enhance the security of scientific instruments used in particle accelerators, large-scale telescopes, satellites, and space probes. The benefits to science and the public include greater confidence in the fidelity of experimental data collected from these scientific instruments, and increased reliability of scientific cyberinfrastructure that reduces the costs associated with accidental misconfigurations or malicious cyberattacks.The objective of this project is to enhance the security of the open-source Real-Time Executive for Multiprocessor Systems (RTEMS) real-time operating system and the Experimental Physics and Industrial Control System (EPICS) software and networks; RTEMS and EPICS are widely used cyberinfrastructure for controlling scientific instruments. The security enhancements span eight related project activities: (1) static analysis and security fuzzing as part of continuous integration; (2) cryptographic security for the open-source software development life cycle; (3) secure boot and update for remotely-managed scientific instruments; (4) open-source cryptographic libraries for secure communication; (5) real-time memory protection; (6) formal modeling and analysis of network protocols; (7) enhanced security event logging; and (8) network-based intrusion detection for scientific industrial control systems. The project outcomes provide a roadmap for enculturating cybersecurity best practices in open-source, open-science communities while advancing the state-of-the-art research in cyberinfrastructure software engineering and industrial control system security.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.