Satellites to test-fly new cyber software

As space systems face growing cyberattacks, the Aerospace Corp. and TriSept Corp. are preparing separate flight tests of software to alert satellite operators of anomalies detected onboard.

“One of the major things we want to demonstrate is that you can add security without creating additional risk or significant cost,” said Ryan Speelman, Aerospace’s Information Systems and Cyber Division principal director.

Beyond cyber hygiene, which is the day-to-day work organizations perform to secure their networks, Aerospace recommends an approach to satellite security called Defense in Depth.

Defense in Depth is an architectural approach that relies on multiple layers of security, including safeguarding supply chains and software development processes, adopting intrusion-detection mechanisms and training employees to be on the lookout for cyber threats.

Think of it like an onion. “We will try and stop you at the outer layer, but we assume that you can defeat some protections, and we will continue to try and stop you,” Speelman said.

Commercial satellite operators can tailor their Defense in Depth strategies to fit their business models. “Depending on what type of vendor you are and what threats you are susceptible to, you may pick and choose different layers,” he said.

A key element of any Defense-in-Depth strategy is software to detect unauthorized satellite access by continuously monitoring and logging satellite telemetry, commands and flight software configuration. Aerospace plans to test its Starshield intrusion-detection software on Slingshot, a 12-unit cubesat launching in September and built with modular components, open standards and plug-and-play interfaces.

“The software does more than encrypt the data because there are other threat vectors and attack surfaces that need to be protected,” said Benjamin Davidson, director of Aerospace’s Cybersecurity and Advanced Platforms Department.

Rather than designing the software to look for troublesome commands, Aerospace engineers have trained machine learning algorithms on what is expected. The software then flags anything unexpected.

After launch, Aerospace will test the software for a year or two to demonstrate that it provides additional security without interfering with traditional flight-control systems. In addition to flagging anomalies, the software could help satellite operators identify the culprit of a cyberattack.

“Anytime you’re doing additional logging, gathering additional data and flagging events earlier, you’re going to make the job of attribution easier and more accurate,” Speelman said. “That itself is a deterrent… because if their probability of getting caught goes up then their risk model and their decision-making process changes.”

In a parallel effort, TriSept is preparing a suborbital test in May and an orbital flight later this year of TriSept Security Enhanced Layer (TSEL), satellite security software the company developed with Old Dominion University engineering students.

“There are not many options for ensuring the integrity of the mission software,” said Steven Bjornaas, TriSept software development director. “We want to be able to detect, report on and prevent anomalies.”

TSEL alerts satellite operators to any changes in the operating system even if the change was prompted by hardware, because “you can’t always trust the hardware,” Bjornaas said. TSEL also logs events to create a record.

This article originally appeared in the April 2022 issue of SpaceNews magazine.