1. Home
  2. Countermeasure
  3. Tamper Resistant Body

Tamper Resistant Body

A tamper-resistant physical enclosure increases the effort, time, and equipment required to physically probe, observe, remove, or modify protected spacecraft sensor nodes and embedded components. The enclosure must be designed for the specific physical-access and side-channel threats being addressed and should not be assumed to prevent every invasive or non-invasive attack. A passive tamper-resistant body can provide physical and side-channel protection without continuous processing or electrical power, which may make it suitable for resource-constrained sensor nodes. The design trade must also account for mass, volume, thermal performance, manufacturability, inspection, repairability, qualification, and lifecycle cost. Enclosures incorporating active sensing or response mechanisms require power and must be evaluated separately from fully passive designs. The physical security design must distinguish among tamper resistance, which impedes access; tamper evidence, which leaves observable indications of attempted access; tamper detection, which senses an attempt while it occurs; and tamper response, which protects designated sensitive assets after detection. The required properties and response behavior must be selected according to the protected component, threat model, and mission consequence of both successful tampering and false activation.

Sources

ID: CM0057
Tier: III
Onboard SV CM 
Created: 2022/10/19
Last Modified: 2026/08/06

Pre-Operations Government

Acquisition requirements should address tamper-resistant enclosures for sensor nodes and other physically accessible spacecraft components as a design option to be evaluated during the system security engineering process, with selection criteria that account for the node's threat exposure, the power budget available for alternative protective measures, and the unit cost implications across the sensor node population. Requirements should define the required tamper-resistance, tamper-evidence, tamper-detection, and tamper-response properties for each protected node, as applicable. The requirements must identify the physical attack capabilities considered, protected assets, permitted maintenance access, detection performance, false-activation tolerance, and approved response behavior, derived from the mission's physical threat assessment. Contract language should require that tamper-resistant enclosure specifications be documented, that selected enclosures be validated through testing that demonstrates performance against the specified tamper resistance properties, and that the cost and power trade analysis used to select tamper-resistant enclosures over alternative countermeasures be submitted as a design justification deliverable. Evaluation criteria should assess offerors' proposed tamper-resistant enclosure designs, their validation methodology, and their demonstrated understanding of the power and cost tradeoffs between physical and software-based protection approaches for resource-constrained nodes. Verification should include physical tamper resistance testing of representative node samples, confirming that the enclosure provides the specified level of protection against the attack methods identified in the threat assessment.

Pre-Operations Developer/Supplier

Tamper-resistant enclosure selection must be integrated into the sensor node design process from the component selection phase, as the mechanical, thermal, and electrical interface implications of a tamper-resistant enclosure affect printed circuit board layout, connector selection, and thermal management design in ways that cannot be easily accommodated after the node design is mature. The design trade should compare passive tamper-resistant construction with other controls addressing the same physical-access or side-channel threat. The analysis must account for the power required by any active tamper-detection or response features and for the enclosure’s effects on mass, volume, thermal management, reliability, manufacturing, and qualification. Encryption and runtime integrity monitoring must not be treated as direct substitutes when they address different threat paths. Materials and active elements used by the tamper-resistant enclosure must be qualified for their intended lifecycle environment, including applicable radiation, vacuum, thermal cycling, vibration, contamination, and atomic-oxygen or ultraviolet exposure. Qualification must demonstrate that the security-relevant mechanical, electrical, optical, and sensing properties remain within required limits for the mission lifetime. Where tamper-resistant enclosures incorporate active intrusion detection or destructive response mechanisms, the power required for those functions and the conditions under which destructive responses are triggered must be carefully defined to avoid inadvertent activation from environmental stimuli such as thermal cycling, vibration, or radiation-induced transients. Qualification testing must use production-representative enclosure materials, manufacturing processes, interfaces, and assembly methods. Destructive or invasive testing may be performed on representative qualification articles, while production hardware must receive defined acceptance inspections or non-destructive verification sufficient to confirm conformity with the qualified design.