Toward Secure Operation and Management (O&M) of Satellite Constellations: Efficiency, Resilience, and Reliability in a Network Perspective

Abstract: Satellite constellations equipped with Inter-Satellite Links and onboard packet switching enable real-time Operation and Management across globally distributed satellites, but also broaden the attack surface and introduce unprecedented cybersecurity threats. Existing efforts mainly focus on cryptography for single-satellite point-to-point links, without considering constellation-level security. To address this gap, this article extends security research in two directions: from individual satellites to constellation-wide architectures, and from isolated cryptography to system-level security incorporating efficiency, resilience, and reliability. These extensions raise three key questions: how to design efficient security mechanisms for dynamic constellation topologies with adaptive onboard routing; how a constellation O&M system can recover resiliently under worst-case failures of onboard security functions; and how to improve the reliability of onboard security functions under stringent resource constraints. To address these challenges, we first construct a constellation-wide hybrid security framework that protects semantically sensitive content fields using End-to-End encryption, while safeguarding routing-related fields through Moving Target Defense. Next, we introduce a ciphered-mode and safe-mode management mechanism with an M-delayed fallback that balances recovery timeliness and exploitability. Finally, we propose security-aware routers that manage plaintext/ciphered modes and coordinate access to a shared pool of onboard cipher modules, enabling redundancy sharing across multiple endpoints and extending secure operation duration in ciphered mode. These solutions comply with existing standards defined by organizations including DVB and the CCSDS, while translating conceptual security principles into practical system-level mechanisms.

• The paper proposes a hybrid end-to-end encryption and moving-target defense scheme that protects sensitive O&M data while preserving onboard routing, adding no delivery-phase processing overhead and limiting update costs to asynchronous control messages.
• The paper introduces an M-delayed fallback mechanism that balances recovery speed and security by allowing ground operators to cancel forged safe-mode commands during a configurable delay window, reducing downgrade risks compared with plaintext backdoors.
• The paper demonstrates that pooled onboard cipher modules improve reliability, with simulations showing a peak absolute gain of 0.23 around year 4.5 and a relative improvement of approximately 140% over 50 years under the modeled conditions.

Motivation and problem statement

This article addresses the security of Operation and Management (O&M) traffic in satellite constellations equipped with Inter-Satellite Links (ISLs) and onboard packet switching. The authors argue that prior work on space-system security has concentrated on cryptographic optimization for single-satellite, point-to-point links—cipher selection under Size, Weight, and Power (SWaP) constraints, overhead reduction on Space-to-Ground Links (SGLs), and channel-error resilience—while neglecting how security should be composed at the constellation level. They expand the scope along two axes: from individual satellites to constellation-wide architectures, and from isolated cryptography to system-level security encompassing efficiency, resilience, and reliability, all in service of preserving the confidentiality–integrity–availability (CIA) triad for O&M flows between the Network Operations Control Center (NOCC) and satellite endpoints.

The system model distinguishes a Telemetry, Tracking, and Command (TT&C) layer, responsible for platform survivability, from an O&M layer performing configuration, coordination, and resource allocation across the constellation. ISL-based relaying of O&M data (beam pointing commands, routing configuration, payload mode changes) enables global control from a single ground station but simultaneously widens the attack surface to signaling hijacking, terminal impersonation, cross-domain attacks, traffic analysis, and denial-of-service (DoS). Both natural threats (e.g., Single Event Upsets (SEUs), Single Event Latchup (SEL)) and adversarial threats are considered. Intra-satellite channels are assumed trusted under a secure supply chain—an assumption that bounds the applicability of the results, as discussed below.

Hybrid protection: cryptography meets moving target defense

The first contribution targets efficient protection of O&M frames under dynamic topologies. Two classical options fail: Hop-by-Hop (H2H) encryption imposes decryption/re-encryption load at access satellites that scales with constellation size, while vanilla End-to-End (E2E) encryption of entire frames (as in NASA GSFC-STD-8012) prevents relay routers from reading routing fields, breaking onboard routing and hence availability. The proposed hybrid scheme partitions each frame into three fields: a PHY-related field (synchronization sequences, MODCOD parameters, CRC trailers) left in cleartext consistent with DVB TRANSEC practice; a high-sensitivity content field protected by E2E encryption between NOCC and target satellite; and a routing field protected by a spatio-temporal Moving Target Defense (MTD).

The MTD combines per-hop replacement—each router rewrites routing-field values according to its local interpretation table—with dynamic updating, whereby an NOCC-hosted MTD controller asynchronously disseminates new interpretations over E2E-encrypted channels. During transitions, old and new interpretations coexist temporarily to prevent frame loss. This design directly counters three attack classes: Transmission-Path Tracing (TPT), since no single-link observation reveals the full trajectory; Traffic Analysis (TA), since captured values lose meaning after remapping; and DoS via routing-field enumeration, since stale probing values are detected and discarded at the access router before consuming downstream resources.

A notable claim is that the mechanism is transparent to real-time data processing: onboard routers perform the same table lookups as in the baseline, so per-packet latency, computation, and communication overhead are zero during delivery; all cost is confined to the update phase, which involves only flow-table replacement onboard and compact, asynchronously schedulable update messages on SGLs. Onboard computation is node-local and independent of constellation size; ground-side controller workload grows linearly but is absorbed by ground infrastructure. Compared with per-hop MAC verification approaches such as EPIC, this substantially reduces onboard computational burden. The authors concede that the trade-off between update frequency (effectiveness) and overhead is not systematically explored and is left as open work.

Timely yet unexploitable fallback: the M-delayed mechanism

The second contribution addresses resilience against worst-case failures of onboard cipher functions. Complete cipher malfunction creates a circular dependency: recovery requires telecommands that can no longer be decrypted, locking the satellite in an abnormal ciphered mode. Two conventional escapes are analyzed: the failsafe timeout (automatic fallback after a preset window without valid commands, e.g., the CCSDS TC timer), which preserves security but delays recovery and exposes satellites to attitude disruption or loss of contact; and the plaintext backdoor command, which enables immediate fallback but, once disclosed, enables what the authors term the Safe-Mode Downgrade (SMD) Attack—mapped to the MITRE category "Exploit Reduced Protections During Safe Mode" and explicitly discouraged by CCSDS.

The proposed $M$-delayed fallback unifies both extremes: a delayed-fallback command opens an $M$-length window, during which NOCC attack detection can cancel forged requests via a cancellation telecommand; only if no cancellation arrives does the satellite switch to safe mode. With $M=0$ it reduces to the backdoor command; with $M$ equal to the timeout window it reduces to the failsafe timeout. Two formally defined metrics—timeliness (elapsed time from abnormal-mode onset to plaintext transition) and exploitability (likelihood of successful exploitation during normal ciphered operation)—quantify the trade-off: larger $M$ lowers exploitability by giving the ground segment more detection opportunities but degrades timeliness.

The underlying rationale is asymmetric: forging messages is easy, whereas blocking legitimate telemetry and cancellation commands throughout the entire window is hard, making fully coordinated SMD attacks unlikely to succeed. Against persistent attackers who force periodic cancellations, the authors suggest rotating the command source code or format to raise attacker effort—a defensive game they argue is biased toward the defender, though the detailed design remains future work. Safe mode itself need not be defenseless: timestamps or sequence numbers embedded in frames enable lightweight freshness checks against replay.

Reliability through pooled cipher modules

The third contribution improves reliability of onboard security functions under SWaP constraints. Conventional invocation-based encryption assigns each O&M endpoint dedicated cipher modules with private backups, scaling poorly because backups cannot be shared across physically independent endpoints. The proposed Unified and Pooled Onboard Cipher Module (UP-OCM) interacts directly with the onboard router rather than with endpoints, maintaining a shared pool of cipher units allocatable across flows. The router embeds three security functions: bypassing the UP-OCM in safe mode; distinguishing flows via the unencrypted routing field and coordinating encryption/decryption only for target-satellite O&M frames; and acting as the responsible entity for the $M$-delayed fallback. The architecture rests on the trusted-zone assumption at the target satellite—the authors state plainly that full satellite compromise invalidates it, and that distributed onboard routing would change the attack surface and require complementary defenses.

Simulation results quantify the reliability gain. Modeling module lifetimes with i.i.d. Weibull distributions ($\beta=0.6$, $\eta=10$, time in years, following empirical satellite reliability statistics), with $N_1=3$ endpoints and $N_2=2$ modules each, pooling the same $M$0 units yields an absolute reliability improvement peaking at 0.23 around year 4.5, and a relative improvement rising monotonically to approximately 140% over 50 years. MTTF analysis shows that redundancy helps most at small scales and low backup degrees; reliability decreases with scale because any single function failure fails the whole constellation, but the degradation rate slows and converges, indicating scalability of UP-OCM as O&M flows increase. The authors note the simulation abstracts SWaP as backup-module count and captures relative trends rather than exact failure times.

Limitations and open questions

Several assumptions bound the results. The trusted intra-satellite zone excludes fully compromised satellites; ISL attacks are assumed highly constrained by pointing and interception requirements; and the effectiveness–overhead trade-off of MTD update frequency is uncharacterized. The anti-SMD command obfuscation mechanism is sketched but not designed, and the choice of $M$1 for specific constellations (orbital period, required security level) is left to operator configuration without a systematic optimization procedure. The reliability study uses abstracted SWaP proxies rather than hardware-level parameters.

Conclusion

The paper offers a composable, standards-compatible framework—consistent with CCSDS and DVB—for securing constellation-level O&M across normal operation and fault response. Its three mechanisms (hybrid E2E-plus-MTD protection, $M$2-delayed fallback, and UP-OCM pooling) are orthogonal, scalable, and configurable, collectively translating conceptual security guidance into concrete system-level mechanisms for efficiency, resilience, and reliability of satellite constellation operations.