Small Satellite Modeling and Defender Software

Small Satellite Modeling and Defender Software

Speakers: Kyle Murbach, Principal Research Engineer, University of Alabama in Huntsville, Center for Cybersecurity Research and Education (UAH/CCRE)

Conference: DEF CON 32

YouTube: https://www.youtube.com/watch?v=42OjQtrJQ5s

Overview

In an era where space access is becoming increasingly democratized through initiatives like SpaceX's rideshare rocket launches, the proliferation of small satellites presents both immense opportunities and significant cybersecurity challenges. Dr. Kyle Murbach, a Principal Research Engineer at the University of Alabama in Huntsville's Center for Cybersecurity Research and Education (UAH/CCRE), delivered a compelling talk at DEF CON 32, shedding light on the critical need for robust security in these compact orbital assets. His presentation, "Small Satellite Modeling and Defender Software," detailed a multi-year research project undertaken in partnership with the US Army Space and Missile Defense Command, aiming to build, analyze, and secure real-world small satellite systems against emerging cyber threats.

The core of this research revolves around developing a comprehensive testbed that accurately models a functioning small satellite, allowing researchers to identify vulnerabilities, craft attack scenarios, and engineer effective defensive countermeasures. This proactive approach is vital, as the cost reduction in launching payloads often leads to simplified hardware and software designs, potentially neglecting critical security mechanisms. Dr. Murbach's team has not only constructed a realistic simulation environment but has also developed a novel software solution, Small Satellite Defender (SSD), designed to harden these systems in orbit.

The significance of this work extends beyond academic research; it directly addresses a pressing national security concern. By understanding and mitigating potential cyberattacks on small satellites—which are increasingly vital for imagery, GPS, and communication services—this project contributes to safeguarding critical space infrastructure. The successful experimentation of SSD on a live Lockheed Martin LINUSS satellite further underscores the practical applicability and maturity of this pioneering cybersecurity research for the space domain.

Background

▶ Watch: Introduction to small satellite modeling and Defender software (0:00)

The journey into small satellite cybersecurity at UAH/CCRE commenced in the fall of 2019, driven by the realization that while space launch costs were plummeting, the focus on size reduction often came at the expense of robust security implementations. The overarching objective of the research was to construct and investigate real-world small satellite systems to pinpoint vulnerabilities, develop innovative mitigation strategies, and address potential attack scenarios. This required creating a testbed that could emulate a satellite's primary mission functions, such as operating a payload (e.g., imagery, GPS, or communications), alongside critical underlying operations like ground station communication, orbital movement and positioning, data processing, and battery management.

Initial hardware selection involved evaluating the Raspberry Pi 4 and the Pi Cubed V4 platforms. The Pi Cubed boards, specifically designed as nano-satellites, initially seemed promising. However, the team encountered significant obstacles: difficulty in writing to the boards, a severe lack of documentation, and the fact that the hardware was nearing its end-of-support (EOS) cycle, with a V5 released during their troubleshooting efforts. This led the team to pivot decisively to the Raspberry Pi 4 platform. The Raspberry Pi 4 offered several advantages: it was relatively easy to acquire and utilize, inexpensive, simple to modify and create payloads for, and compatible with a wide array of add-ons necessary to achieve satellite functionality. This strategic choice allowed the project to accelerate its development of a realistic, yet accessible, small satellite model.

Over five years, the project has seen numerous iterations, with student teams contributing under the guidance of CCRE staff. Key milestones included the successful identification, acquisition, and configuration of hardware and software to achieve real-world satellite functionality in the testbed. This foundational work laid the groundwork for the subsequent phases: identifying vulnerabilities, creating attack scenarios, implementing hardening measures, and ultimately developing the Small Satellite Defender (SSD) software. The project's progress has not been confined to the lab, having been presented at the US Cyber Command Cyber Recon Symposium and, notably, experimented on an actual orbiting satellite.

Key Findings

▶ Watch: Research purpose: defending satellites from cybersecurity threats (3:00)

The research project yielded several critical findings and contributions, primarily centered around the successful development and validation of a small satellite cybersecurity testbed and its associated defensive software.

Firstly, the team conclusively demonstrated the viability of using readily available, cost-effective commercial off-the-shelf (COTS) components, particularly the Raspberry Pi 4, to construct a highly functional and realistic small satellite testbed. This finding is crucial for democratizing space cybersecurity research, making it accessible to a broader range of institutions and researchers without requiring prohibitively expensive, specialized space-grade hardware. The Raspberry Pi 4, coupled with various add-ons, proved capable of simulating core satellite operations, including payload execution, communication, and environmental sensing.

Secondly, the project successfully progressed through the stages of vulnerability identification and attack scenario creation within the simulated environment. While the talk did not detail specific vulnerabilities or attack vectors, the methodology established allows for systematic exploration of potential weaknesses in small satellite systems. This capability is paramount for understanding how adversaries might compromise these assets, from disrupting communication to manipulating sensor data or disabling payloads.

A major contribution is the development of the Small Satellite Defender (SSD) software. This proprietary solution represents a novel approach to hardening small satellite systems against cyber threats. SSD was designed to provide in-situ defense capabilities, integrating directly with the satellite's operational software to monitor, detect, and potentially mitigate malicious activities. Its development signifies a tangible step towards proactive cybersecurity for space-based assets.

Finally, and perhaps most significantly, the research achieved real-world validation of the SSD software. The team successfully experimented with the Small Satellite Defender on an actual satellite orbiting Earth, in collaboration with Lockheed Martin, utilizing their LINUSS satellite. This invaluable experience moved the project beyond theoretical modeling and simulation into practical, operational testing, confirming SSD's potential effectiveness in a live space environment. This milestone underscores the maturity and practical applicability of the research, paving the way for future integrations with other small satellite platforms, such as the Interorbital Systems TubeSat kits, which are currently part of the team's ongoing efforts.

Technical Deep Dive

▶ Watch: Choosing Raspberry Pi for the satellite testbed (4:00)

The technical foundation of the small satellite testbed is built upon a combination of accessible hardware, custom communication protocols, and open-source simulation software, all designed to mimic the complexities of an orbiting satellite.

At the heart of the simulated satellite is the Raspberry Pi 4. This single-board computer provides the computational backbone for executing payloads, managing communications, and processing sensor data. Its robust community support and extensive libraries greatly facilitated development. For payload functionality, the team integrated an Aokin Raspberry Pi camera, capable of capturing low-quality images. While not high-fidelity, this camera served to demonstrate the system's ability to operate a payload and transmit data, utilizing pre-existing Raspberry Pi camera libraries.

Communication between the simulated satellite and its ground station is facilitated by RFM69HCW radios. These radios directly attach to the GPIO header on the Raspberry Pi units, operating at two different frequencies. The team reported a reliable range of up to 100 meters, which was sufficient for their lab-based testing. A custom TCP-style communication protocol was established over these radios. This protocol used the first byte of transmitted data as an identifier to control different states of the satellite. For instance, specific byte values would indicate the start or end of a data stream, a picture transmission, a new tasking command, or a configuration update for the satellite. This byte-level control allowed for precise management of satellite operations and data flow.

To provide the satellite with crucial environmental awareness and positioning capabilities, the team integrated the Sense Hat add-on board. Originally developed by the Raspberry Pi Foundation for the International Space Station, the Sense Hat is equipped with an array of sensors, including temperature, humidity, and critically for satellite operations, a gyroscope and accelerometer. The gyroscope was vital for positioning the satellite, allowing it to determine its orientation (yaw and axis) to prevent uncontrolled spinning and ensure proper alignment of solar panels for battery charging. The accelerometer, meanwhile, could be used to measure orbit speed and G-force, providing data points relevant to orbital mechanics. These sensors also played a role in protecting the camera payload by ensuring it didn't directly face the sun, which could damage the image sensor.

To simulate the complex orbital mechanics and communication windows, the team leveraged Cesium orbit software. Since the testbed was physically located in a lab, Cesium provided a visual and functional representation of the satellite orbiting Earth. Researchers could configure two different views: one from the satellite's perspective looking at Earth, and another showing its global trajectory. Crucially, Cesium allowed the definition of a preconfigured GPS location for the ground station. As the simulated satellite entered the communication range of this ground station, a "communication window" would open, enabling the satellite to transmit data based on its previous tasking and then listen for new commands from the ground station. This integration of physical hardware with orbital simulation software created a highly realistic and controllable environment for cybersecurity experiments.

The Small Satellite Defender (SSD) software itself, while not detailed in terms of its internal architecture or specific algorithms in the talk, is presented as the culmination of the hardening efforts. It is a software-based solution designed to be deployed directly on the satellite's onboard computer (the Raspberry Pi 4 in the testbed). Its purpose is to augment the satellite's existing security posture, likely through mechanisms such as integrity checking, anomaly detection, secure boot processes, or robust access controls, although these specifics are not elucidated. The successful experimentation of SSD on the Lockheed Martin LINUSS satellite validates its capability to function in a real space environment, suggesting its design is robust enough to operate within the constraints of an actual orbital platform.

Demo / Proof of Concept

▶ Watch: Details on camera and RFM69HCW radio communication (6:15)

While Dr. Murbach's talk did not feature a live, interactive demonstration of an attack or defense scenario, the entire research project serves as a compelling proof of concept for building and securing small satellite systems. The team successfully demonstrated the ability to replicate a functional satellite system in a lab environment using readily available hardware and software.

The core of this proof of concept was the physical testbed constructed in the lab. This setup mirrored the diagram presented, featuring a Raspberry Pi 4 serving as the satellite's onboard computer, an Aokin Raspberry Pi camera as the payload, and RFM69HCW radios for communication. The integration of the Sense Hat board provided critical sensor data for orientation and environmental awareness. This entire assembly was enclosed, with external ports for configuration and code uploads, allowing researchers to interact with the simulated satellite as if it were in orbit. The speaker explicitly showed an image of the real-world lab setup, confirming the physical realization of their design.

Further augmenting the realism, the Cesium orbit software was utilized to simulate the satellite's movement around Earth. This allowed the team to visualize the satellite's trajectory and, more importantly, to simulate communication windows opening and closing as the satellite passed over a pre-configured ground station GPS location. During these simulated windows, the satellite would execute its programmed tasks, such as taking a picture with the Aokin camera, and transmit the data to the ground station using the custom TCP-style protocol over the RFM69HCW radios. The ground station, in turn, could send new tasking to the satellite. This operational loop confirmed the testbed's ability to perform core satellite functions under realistic orbital communication constraints.

The ultimate proof of concept for the Small Satellite Defender (SSD) software came through its successful experimentation on a Lockheed Martin LINUSS satellite orbiting Earth. This real-world deployment validated that SSD could be integrated into an operational satellite and perform its intended hardening functions in a genuine space environment. While the specifics of the SSD's performance or the exact nature of the experiments on LINUSS were not detailed, this milestone signifies a critical step from theoretical research to practical application, demonstrating the software's readiness for deployment on actual small satellite missions. The ongoing work with Interorbital Systems TubeSat kits represents a continued effort to further refine and integrate SSD with diverse small satellite platforms.

Defensive Implications

▶ Watch: Sense Hat add-on for critical satellite positioning and sensors (8:00)

The research presented by Dr. Kyle Murbach carries profound defensive implications for the rapidly expanding small satellite ecosystem. As the cost of launching payloads decreases, there's a corresponding trend towards smaller form factors and simplified hardware/software designs, which often leads to the omission or reduction of crucial security mechanisms. This creates a fertile ground for cyber adversaries to exploit, making robust defense strategies imperative.

Firstly, the very existence of the Raspberry Pi 4-based testbed provides a low-cost, accessible platform for vulnerability research and defensive development. This allows security professionals and researchers to identify weaknesses in small satellite architectures and communication protocols without needing access to expensive, flight-ready hardware. By simulating real-world orbital dynamics with Cesium and using representative COTS components, defenders can proactively develop and test countermeasures against various attack scenarios, from disrupting communication links (via the RFM69HCW radios) to manipulating sensor data (from the Sense Hat) or hijacking payload operations (like the Aokin camera).

The development of the Small Satellite Defender (SSD) software is a direct response to the need for hardening. This software represents an on-board defensive capability, which is critical given the intermittent and often limited communication windows with ground stations. An effective SSD could potentially perform real-time integrity checks, detect anomalous behavior indicative of compromise, or even implement self-healing mechanisms to mitigate attacks without immediate human intervention. Integrating such software from the initial design phase of small satellites is crucial.

Furthermore, the emphasis on basic satellite functions, such as proper orientation using the Sense Hat's gyroscope for solar panel alignment and camera protection from the sun, highlights that even fundamental engineering considerations have cybersecurity implications. An attacker could, for instance, exploit vulnerabilities to misorient a satellite, draining its battery, damaging its sensors, or preventing it from performing its mission. Defensive strategies must therefore encompass both traditional software/network security and the secure design of physical and operational aspects.

Finally, the real-world experimentation of SSD on a Lockheed Martin LINUSS satellite provides invaluable lessons for operationalizing cybersecurity in space. It demonstrates that defensive software can be deployed and validated on actual orbiting assets, moving beyond theoretical models. This pushes the industry towards integrating security as a core component of satellite design and operation, rather than an afterthought. Defenders should leverage such research to inform best practices, develop standardized security frameworks for small satellites, and prioritize continuous threat intelligence sharing within the space community. The project's continued work with Interorbital Systems TubeSat kits suggests a pathway for integrating these defensive capabilities into future commercial and academic small satellite missions.

Key Takeaways

• Cybersecurity is paramount for small satellites: The increasing affordability and proliferation of small satellites necessitate a strong focus on cybersecurity to protect critical space infrastructure from potential threats.
• Accessible testbeds are crucial for research: Low-cost, COTS-based platforms like the Raspberry Pi 4, combined with open-source simulation tools like Cesium, enable effective and accessible research into small satellite vulnerabilities and defenses.
• Custom communication protocols require careful security design: The use of custom TCP-style communication and byte-level identifiers highlights the need for robust security analysis and hardening of bespoke protocols used in space.
• Onboard sensor integrity is a defensive priority: Sensors like the Sense Hat's gyroscope and accelerometer are vital for satellite operation and must be protected from manipulation, as their data impacts critical functions like orientation and payload protection.
• Software-defined defense is a viable solution: The development and real-world validation of the Small Satellite Defender (SSD) software demonstrate the feasibility of deploying active hardening measures directly on orbiting satellites.
• Real-world validation accelerates adoption: Experimentation of defensive software on operational satellites, such as the Lockheed Martin LINUSS, is critical for proving efficacy and fostering trust in new cybersecurity solutions for space.

About the Speaker(s)

Dr. Kyle Murbach is a Principal Research Engineer at the University of Alabama in Huntsville (UAH), specifically within its Center for Cybersecurity Research and Education (CCRE), a position he has held since 2020. He serves as a Principal Investigator (PI) and Subject Matter Expert (SME) on a diverse range of research projects, encompassing malware analysis, tool development, reverse engineering, and vulnerability analysis across various domains, including satellites. Dr. Murbach brings nine years of prior experience as a cybersecurity researcher and software reverse engineer. His academic background includes a PhD in Cyber Operations from Dakota State University (2019) and both a BS and MS in Computer Security from Rochester Institute of Technology (2018). He is the Technical Director of the Space Testing and Resiliency Simulation (STARS) team at CCRE, where he oversees the small satellite cybersecurity project.