Ransomware is a prevailing concern across sectors, wreaking havoc on operations and causing cascading failures often cyber-physical in nature. The space sector has experienced ransomware attacks; however, the space vehicle has not been the target of these publicly disclosed incidents. A ransomware attack against a space vehicle would need to be carefully crafted to mitigate the risk of destroying the underlying functionality of the spacecraft, while still achieving its purpose - denying access until a ransom is paid. Through static code analysis, this paper proposes an approach for deploying a ransom attack against a space vehicle that engages NASA's core Flight System (cFS).
We present a compositional approach to modeling and analyzing space mission operation sequences with steps across multiple viewpoints. We consider different operation tasks such as communication, science observation, trajectory correction, and battery charging; and separate their interactions across discipline viewpoints. In each sequence step, these tasks are modeled as assume-guarantee contracts. They make assumptions on the initial state of a step, and if these assumptions are satisfied, they guarantee desirable properties of the state at the end of the step. These models are then used in Pacti, a tool for reasoning about contracts. We demonstrate a design methodology leveraging Pacti's operations: contract composition for computing the contract for the end-to-end sequence of steps and contract merging for combining them across viewpoints. We also demonstrate applying Pacti's optimization techniques to analyze the figures of merit of admissible sequences satisfying operational requirements for a CubeSat-sized spacecraft performing a small-body asteroid rendez-vous mission. We show that analyzing tens of thousands of combinations of sequences and operational requirements takes just over one minute, confirming the scalability of the approach. The methodology presented in this paper supports the early design phases, including requirement engineering and task modeling.
Access to space is increasingly fundamental to our modern world. Launch volume is rapidly increasing annually, requiring increasing spaceport and ground support capabilities. The design, ownership, and operation of spaceports are bespoke, where their cybersecurity considerations are always an afterthought. This paper focuses on the critical role spaceports play in the access to space and their vulnerabilities to cyber attacks. Further, it demonstrates that without strong cybersecurity, adversaries can easily deny access to space.
This paper describes the Autonomy System that flew on the Double Asteroid Redirection Test (DART) mission. A detailed description of the rules-based logic is provided, including the heritage of the system, how it was tailored to meet DART's fault management philosophy, build process, testing, and necessary in-flight updates. The purpose of the Autonomy software was to implement fault protection against components' off-nominal behaviors and to implement a safing strategy designed to place the spacecraft in a known, safe configuration in response to critical faults while Mission Operations worked on a resolution. Aside from maintenance and fault protection tasks, the onboard Autonomy software was key to guaranteeing the execution of time-critical sequences during the mission. The resulting system was also instrumental in being the tool of choice to address anomalies in other subsystems that were discovered as early as a month into flight and as late as a month before impact.
A ‘hybrid space architecture’ has been proposed to facilitate robust and resilient satellite data downlink, integration and analysis; however, the technical details for what may comprise a hybrid space architecture are severely lacking. Thus far, ‘hybrid’ principally entails the diversity of commercial providers. While diverse suppliers can contribute to hybrid space architectures, we argue that robustness and resilience will only be achieved through heterogeneous network and asset architectures. A connected satellite services ecosystem composed of the union of different networks with different characteristics would limit single points of failure, thereby generating high levels of redundancy, resilience and scalability. This research outlines parameters of a hybrid space architecture, documents satellite service reference architectures and provides a comparative analysis of the features for each architecture. Further, through a case study of existing satellite service providers, we propose how a hybrid space architecture could be piloted in Northern Europe and the High North.
Space flight software is no longer a closely guarded secret for space vehicle developers, owners and operators - it is open-sourced and available as a commercial-off-the-shelf module. Despite its wide availability, limited security research has been conducted on flight software in an unclassified environment. This paper proposes a research agenda that outlines critical challenges for space flight software and proposes a series of research and development efforts that could ultimately aid in developing inherently secure space vehicles.
The Modular Unified Space Technology Avionics for Next Generation (MUSTANG) is a small integrated Avionics system including Command and Data Handling (C&DH), Power System Electronics (PSE), Attitude Control System Interfaces (ACS), and Propulsion Electronics. The MUSTANG Avionics Architecture is built upon many years of knowledge capture and lessons learned at the Goddard Space Flight Center. With a motivation towards modularity and keeping board redesign costs to a minimum, MUSTANG offers flexibility in features with a backplane-less design and allows the user to choose the options (cards) needed for their system. It incorporates a distributed power system that provides secondary power to all its subcomponents reducing the number of primary services needed for an Avionics. MUSTANG can be integrated into one system or divided into several smaller components. MUSTANG supports redundancy and cross-strap ability for a more robust and reliable Avionics system. A variation of MUSTANG exists for Instrument Electronics called iMUSTANG and allows the user to select functionality applicable to the instrument electronics. MUSTANG is not meant to replace Avionics for all spacecraft. There are limitations due to its relatively compact size, but the MUSTANG design has proven broadly applicable on many spacecraft and instrument bus avionics architectures.
Hot spare processors improve availability, and cold spare processors improve system lifetime, but the same processor can’t be both at once, so there is a trade-space. But combinations of processors are useful and enable various fault tolerance tactics. This paper evaluates the availability and lifetime metrics of forty-eight different configurations o f 1 - 4 processors, with at east one processor designated as a prime, and the others, as hot or cold spares. Dual, Triple, and Quadruple Modular Redundancy are covered, along with some deployed spacecraft configurations, e.g. the Parker Solar Probe, and the Curiosity rover during its Entry/Descent/Landing (EDL) and Surface phases. Failure modes include transient failures such as Single Event Upsets (SEUs) and Single Event Functional Interrupts (SEFIs), and permanent failures. A few hypothetical designs are found to lie far outside the convex hull of previously-known configurations.
Over the last two decades, CubeSats which are nanosatellites with form factors based on units (U) of 10 x 10 x 10 cm3, have become more common in academia, enabling students to gain hands-on experience with satellite design, testing and deployment [15]. The use of Commercial-Off-TheShelf (COTS) components reduces development cost and time, making CubeSats an accessible and cost effective route to space. CubeSats are increasingly important for in-orbit demonstrations of new technologies. Further, their flexibility allows them to be configured for a wide range of science mission profiles, either as a standalone platform, as a communications relay for lunar and inter-planetary missions, such as NASA’s Mars Cube One (MarCO) satellites [14], or as a daughter spacecraft to study a near-Earth object such as LICIACube [2]. Several CubeSats for high energy astrophysics are currently in orbit and in development [9].
The Cyber Analysis Visualization Environment (CAVE) software system is a collaboration between the Systems Engineering and Mission Systems and Operations Divisions at JPL. CAVE is an easy to use, model-based cyber threat visualization, analysis, and assessment platform designed to respond to the growing threat of cyber attacks targeting space missions. CAVE was originally designed and developed as a Python-based desktop application with integrated 3D visualization, user interface, and a cyber analysis engine, before a recent redesign to the current client/server web-based application architecture. This new client/server web application architecture allows for multi-platform usage of CAVE, requiring minimal or no software installation on local systems while still allowing for customizability at the user level. CAVE's client/server architecture ensures that sensitive or proprietary data resides securely on the CAVE analysis server, avoiding the storage of sensitive data on the end user's local machine. At a high level, the CAVE web server exposes a REST API to allow the web GUI to communicate with the analysis engine. The web server has user authentication capabilities and restricts access to model data based on the assigned group of the authenticated user. The server is architected with a plugin structure in mind for analyses, so users opting to deploy the CAVE server can easily write and deploy additional model analyses. The client handles all interactions with the web server and provides feedback to users on the status of server requests. CAVE's web-browser user interface provides an intuitive, 3D presentation of complex network models, containing both physical and virtual network assets, which allows mission cybersecurity engineers to easily swap between a selection of visual layouts and execute a variety of cybersecurity analysis algorithms designed to help users better understand possible network vulnerabilities and defenses. This web-based user interface model allows for ease of expansion and potential future additions to the user experience, including real-time collaboration and sharing capabilities, and the interactive exploration of large cybersecurity datasets. In this paper we present CAVE's software architecture and use cases, and discuss CAVE's value as an intuitive tool for cyber threat identification and assessment.
Single-event-latchup (SEL) in a semiconductor device is an undesirably induced high current state, typically rendering the affected device to be non-functional and compromising its operating lifetime. The lower-current SEL phenomenon – the micro-SEL – is often difficult to detect, particularly when the normal operating current of the protected device is variable and the magnitude of micro-SEL currents is low, yet different under different operating conditions. In Machine-Learning (ML), the said variable current inadvertently affects the multiple features of the input current profile required for micro-SEL detection, thereby severely reducing the detection accuracy. In this paper, we propose a data pre-processing module to improve the accuracy of the ML-based micro-SEL detection under the aforesaid current conditions. The proposed pre-processing module encompasses the following. Prior to classification by ML, the input current profile is processed by a data pre-processing module employing a proposed background subtraction algorithm and proposed adaptive normalization algorithm. By filtering the irrelevant base current and normalizing the micro-SEL current based on the base current value, the data pre-processing module provides improved accurate features of the input current profile and widens the difference between normal samples and micro-SEL samples in the feature space. Ultimately, the proposed module facilitates ML algorithms to generate a more accurate decision boundary. The outcome is a worthy $\sim$ 13% accuracy improvement (from $\sim$ 79% to $\sim$ 92%) in the micro-SEL detection in a device operating with variable currents.
Autonomous Cyber-Physical Systems (CPS) play a substantial role in many domains, such as aerospace, transportation, critical infrastructure, and industrial manufacturing. However, despite the popularity of autonomous CPS, their susceptibility to errant behavior is a considerable concern for safety-critical applications. Testing and simulation is the most common method used in practice to ensure the correctness of autonomous CPS due to their ability to scale to complex systems. In many domains, CPS complexity and scalability have been exponentially growing and will continue to expand due to rapid integration with machine learning components and rising autonomy level such as unmanned aerial vehicles or selfdriving cars. Traditional software test methodologies which extensively depend on code coverage are expensive, require code instrumentation, and are ineffective in verifying CPS behavior. Moreover, these test methodologies suffer from lack of flexibility where dynamical CPS control requirements and plant parameters are evolving through continuous state space and time. We investigate ways to improve automated test case generation for autonomous CPS using coverage-guided state space exploration, which systematically generates trajectories to explore desired (or undesired) outcomes. We introduce a novel coverage metric notion and integrate this metric with various techniques, such as fuzz testing or model predictive control (MPC), to generate test cases(1).
NASA's Mars 2020 Mission is to study Mars' habitability and seek signs of past microbial life. The mission uses an X-ray fluorescence spectrometer to identify chemical elements at sub-millimeter scales of the Mars surface. The instrument captures high spatial resolution observations comprised of several thousand individual measured points by raster-scanning an area of the rock surface. This paper will show how different methods, including linear regression, k-means clustering, image segmentation, similarity functions, and Euclidean distances, perform when analyzing datasets provided by the X-ray fluorescence spectrometer to assist scientists in understanding the distribution and abundance variations of chemical elements making up the scanned surface. We also created an interactive map to correlate the x-ray spectrum data with a visual image acquired by an RBG camera.
Accurate mapping of software requirements to tests is critical for ensuring high software reliability. However, the dynamic nature of software requirements throughout various mission phases necessitates the maintenance of traceable and measurable requirements throughout the entire mission life cycle. During the development phase, a predictable and controlled deployment, testing, and integration of software systems can strongly support a mission's rapid innovation. Similarly, during the operation phase, timely application of patches and efficient evaluation and verification processes are vital. To address these challenges, we propose a novel method that combines Natural Language Processing (NLP) and Machine Learning (ML) to automate software requirement-to-test mapping. This method formalizes the process of reviewing the recommendations generated by the automated system, enabling engineers to improve software reliability, and reduce cost and development time.
Reinforcement Learning (RL) has become an increasingly important research area as the success of machine learning algorithms and methods grows. To combat the safety concerns surrounding the freedom given to RL agents while training, there has been an increase in work concerning Safe Reinforcement Learning (SRL). However, these new and safe methods have been held to less scrutiny than their unsafe counterparts. For instance, comparisons among safe methods often lack fair evaluation across similar initial condition bounds and hyperparameter settings, use poor evaluation metrics, and cherry-pick the best training runs rather than averaging over multiple random seeds. In this work, we conduct an ablation study using evaluation best practices to investigate the impact of run time assurance (RTA), which monitors the system state and intervenes to assure safety, on effective learning. By studying multiple RTA approaches in both on-policy and off-policy RL algorithms, we seek to understand which RTA methods are most effective, whether the agents become dependent on the RTA, and the importance of reward shaping versus safe exploration in RL agent training. Our conclusions shed light on the most promising directions of SRL, and our evaluation methodology lays the groundwork for creating better comparisons in future SRL work.
In recent years, the Aerospace Corporation has been developing machine learning systems to detect cyber anomalies in space system command and telemetry streams. However, to enable the use of deep learning in such high consequence environments, the models must be trustworthy. One aspect of trust is a model’s ability to accurately quantify the uncertainty of its predictions. Although many deep learning models output what seem to be confidence scores, current academic research has repeatedly shown that models often return high confidence even when very wrong and are unable to diagnose and respond appropriately to out-of-distribution inputs. This can result in catastrophic overconfidence when models are faced with adversarial inputs or concept drift. Even on routine inputs, without reliable uncertainty quantification, it is hard for human-machine teaming to take place as humans cannot trust the model’s reported confidence score. In short, all models are wrong sometimes, but models which know when they are wrong are considerably more useful. To this end, The Aerospace Corporation conducted a literature review and implemented current state of the art methods, including deep ensembles and temperature scaling for confidence calibration, to accurately quantify the uncertainty of deep learning model predictions. We further incorporated and tested these techniques within the existing cyber defense model framework for more trustworthy cyber anomaly detection models. We show that not only are these techniques successful, they are also easy to implement, extensible to many applications and machine learning model variants, and provide interpretable results for a wide audience. From this, Aerospace recommends further adoption of such techniques in high consequence environments.
Space agencies, educational institutions, and private companies have adopted CubeSat nanosatellites to do scientific research, training, technology demonstration, and space-based industries in the New Space era. The next step in this changing space sector corresponds to the assembly and operation of large satellite constellations consisting of hundreds or thousands of small- or nano-satellites. This context adds new requirements and challenges to the production and operation lines of these space projects. This work focuses on the agile operation of a large nanosatellite constellation with inter-satellite communications. We propose using the constellation contact topology to design contact plans using evolutionary algorithms and use the contact plan information to control the constellation operations. The contact plan is then used to create a Global Flight Plan table that summarizes all the operations required to execute a proposed task. Thus, satellites and ground station nodes only need a flight software capable of queuing, executing, and transferring Flight Plan commands. The evolutionary contact plan design approach shows promising scalability results opening the possibility of controlling satellite mega constellation of hundreds or thousands of nanosatellites.
Modern parallel computers could power the perception and compression algorithms small planetary rovers require to navigate long distances, construct detailed terrain maps, and communicate discoveries to Earth. This work identifies and comprehensively characterizes four algorithms important to planetary roving that are well-suited for parallel computing. Multiple implementations of dense stereo matching, multi-view stereo, image compression, and triangle mesh compression are evaluated using the NVIDIA Jetson family of high-performance embedded computers. Image and mesh inputs are derived from simulation and used to evaluate the performance, power consumption, and hardware utilization of each device as a function of time. Our results demonstrate the promising capacity for modern embedded computers to expand the range and pace of planetary rover exploration.
The effect of a link disruption on reliable data transmission of bundle protocol (BP) is currently under study. In this paper, a study of the effect of link disruption on BP's reliable data delivery in space communications is presented employing both analytical and experimental methods. The effect is studied from spatial and temporal perspectives, and it is modeled by considering the physical distance the bundle has traversed when the link disruption starts and ends, the duration of link disruption in time, and the physical span of the link disruption. The number of transmission attempts that fail due to link disruption and the total number of transmission attempts needed for successful bundle delivery in presence of a link disruption are estimated. The models are validated by realistic bundle delivery over a PC-based experimental testbed.
As the main data transport protocol of delay-disruption-tolerant networking (DTN) targeting deep-space communications, Licklider transmission protocol (LTP) is developed to provide reliable and highly efficient data delivery over unreliable communication channels that are characterized by very long delay and/or frequent and random link interruptions. A checkpoint (CP) segment of LTP is sent, with a timer set (or simply, CP timer) to check the arrival status of the entire data block at the receiver, and it is retransmitted upon the expiration of the CP timer prior to reception of an acknowledgment. In the previous work, an analytical model is built for the CP timer setting in such a way that reliable file delivery in deep space is ensured with a minimum number of retransmission attempts taken for energy-efficient deep-space communications. However, the model was not validated. In this paper, a packet-level analysis based on realistic file transfer experiments using a PC-based testbed is presented to validate the built model for LTP in deep-space communications characterized by a long latency and highly asymmetric channel rate.
