In a terrestrial environment, threat actors use traffic analysis attacks to analyze traffic flow to gather topological information. This traffic flow can divulge information about critical nodes, such as the aggregator node in a sensor network. In the space environment, specifically with relays and constellations, traffic analysis can be used to understand the energy capacity of spacecraft node and the fact that the transceiver component of a spacecraft node consumes the most power. The spacecraft nodes in a constellation network limit the use of the transceiver to transmit or receive information either at a regulated time interval or only when an event has been detected. This generally results in an architecture comprising some aggregator spacecraft nodes within a constellation network. These spacecraft aggregator nodes are the sensor nodes whose primary purpose is to relay transmissions from nodes toward the ground station in an efficient manner, instead of monitoring events like a normal node. The added functionality of acting as a hub for information gathering and preprocessing before relaying makes aggregator nodes an attractive target to side channel attacks. A possible side channel attack could be as simple as monitoring the occurrences and duration of computing activities at an aggregator node. If a node is frequently in active states (instead of idle states), there is high probability that the node is an aggregator node and also there is a high probability that the communication with the node is valid. Such leakage of information is highly undesirable because the leaked information could be strategically used by threat actors in the accumulation phase of an attack.
| ID | Name | Tiering | Description | NIST Rev5 | ISO 27001 | Onboard SV | Ground | |
| CM0002 | COMSEC | Communications security (COMSEC) denies unauthorized parties access to information derived from telecommunications while ensuring the authenticity of those communications. COMSEC is commonly defined as a broad discipline that may encompass cryptographic security, transmission security, emissions security, cryptographic key management, traffic-flow security, and physical security of COMSEC material. Within SPARTA, these areas are further broken down through separate countermeasures, including CM0029 | TRANSEC, CM0030 | Crypto Key Management, CM0003 | TEMPEST/EMSEC, and CM0073 | Traffic Flow Analysis Defense. CM0002 provides the overarching communications-security context and supports the coordinated application of these specialized countermeasures. All mission links, particularly telemetry, tracking, and commanding (TT&C) links, should employ communications-security protections appropriate to the sensitivity, criticality, operational environment, and threat exposure of the information being exchanged. These protections may include cryptographic protection, transmission security, emissions security, traffic-flow protection, secure key management, and physical protection of COMSEC material, as addressed by the applicable specialized countermeasures. Spacecraft should not provide an operational mode that permits required cryptographic protection or command authentication on TT&C links to be bypassed or disabled. Operational, maintenance, test, recovery, and contingency modes should be considered when evaluating whether communications-security protections can be unintentionally or improperly circumvented. Communication receivers and associated signal-processing or TRANSEC mechanisms should detect and, when mission-defined criteria are met, reject or otherwise safely handle transmissions exhibiting anomalous signal characteristics consistent with communications deception. Cryptographic mechanisms should authenticate and integrity-check received content but should not be treated as RF-deception detectors. | AC-17 AC-17(1) AC-17(10) AC-17(2) AC-18 AC-18(1) AC-2(11) AC-3(10) CA-3 IA-4(9) IA-5 IA-5(7) IA-7 PL-8 PL-8(1) SA-8(18) SA-8(19) SA-9(6) SC-10 SC-12 SC-12(1) SC-12(2) SC-12(3) SC-12(6) SC-13 SC-16(3) SC-28(1) SC-28(3) SC-7 SC-7(10) SC-7(11) SC-7(18) SC-7(5) SC-8(1) SC-8(3) SI-10 SI-10(3) SI-10(5) SI-10(6) SI-19(4) SI-3(8) | A.5.14 A.6.7 A.8.1 A.8.16 A.5.14 A.8.1 A.8.20 A.5.14 A.8.21 A.5.16 A.5.17 A.5.8 A.5.14 A.8.16 A.8.20 A.8.22 A.8.23 A.8.26 A.8.12 A.5.33 A.8.20 A.8.24 A.8.24 A.8.26 A.5.31 A.5.33 A.8.11 | ||||
| CM0073 | Traffic Flow Analysis Defense | Traffic flow analysis attacks enable adversaries to derive operationally significant intelligence from observable transmission characteristics, including message timing, volume, duration, periodicity, and routing information, without decrypting the content of communications. Even when link encryption is in place, unprotected traffic patterns can reveal spacecraft operational schedules, command activity, contact windows with specific ground stations, and anomalous events that provide adversaries with actionable mission intelligence. Traffic flow analysis defense encompasses a set of techniques applied to protect the confidentiality of transmission metadata on telemetry, tracking, and commanding (TT&C) and data links, as well as onboard communications where applicable. Applicable techniques include padding transmissions to normalize message lengths and volumes, introducing artificial traffic during idle periods to obscure true contact patterns and event timing, obfuscating routing information and endpoint identities, varying transmission periodicity to defeat statistical pattern recognition, and frustrating traffic volume and duration analysis through active obfuscation methods. These controls are a complement to, but distinct from, cryptographic content protection, and should be applied based on a threat-informed assessment of the value of traffic metadata to potential adversaries and their collection capabilities. | SC-8 SI-4(15) | A.5.10 A.5.14 A.8.20 A.8.26 | ||||
| CM0050 | On-board Message Encryption | Authentication controls on the spacecraft internal bus verify the identity of communicating components but do not protect the confidentiality of the data in transit; an adversary with access to the bus, whether through a compromised component, a hardware implant, or a physical access event, can observe all unencrypted inter-component communications regardless of whether authentication is enforced. Encrypting data traversing the spacecraft internal bus protects the confidentiality of selected message content from entities that can observe the bus but do not possess authorization and the applicable cryptographic keys. The protection does not prevent disclosure to a compromised component that legitimately possesses the decryption key, and it may not conceal unencrypted protocol headers, addressing information, message timing, or traffic volume. Bus encryption should be considered for bus segments or message types carrying information whose unauthorized disclosure would create unacceptable mission, security, privacy, or operational risk. Criticality alone does not establish a confidentiality requirement. Where confidentiality is required, encryption must be combined with message integrity, source authentication, and replay protection through an approved authenticated-encryption mechanism or an appropriately composed set of cryptographic protections. | AC-4 AC-4(23) AC-4(24) AC-4(26) AC-4(31) AC-4(32) PL-8 PL-8(1) SA-3 SA-8 SA-8(18) SA-8(19) SA-8(9) SA-9(6) SC-13 SC-16 SC-16(1) SC-16(2) SC-16(3) SC-8(1) SC-8(3) SI-19(4) SI-4(10) SI-4(25) | A.5.14 A.8.22 A.8.23 A.8.11 A.5.8 A.5.2 A.5.8 A.8.25 A.8.31 A.8.27 A.8.28 A.5.33 A.8.24 A.8.26 A.5.31 A.8.11 | ||||
| CM0062 | Dummy Process - Aggregator Node | In spacecraft architectures containing aggregator or relay nodes, observable computation and communication patterns may reveal valid aggregation cycles and traffic-flow relationships involving critical nodes, root nodes, or ground termination points. This countermeasure is applicable when the threat model identifies a credible adversary capability to observe node power or electromagnetic activity and correlate those observations with RF transmission activity. While camouflaging all network traffic through constant high-power transmission is energy-prohibitive, selectively obscuring aggregator node behavior through dummy process execution provides a practical alternative. This countermeasure requires aggregator nodes to execute dummy workloads whose observable characteristics are sufficiently similar to genuine aggregation cycles to make reliable classification difficult within the mission-defined adversary model. Evaluation should consider applicable power, electromagnetic, execution-duration, processor-activity, memory-access, and RF-correlated features rather than matching only an average power-consumption curve. Two properties are essential for effectiveness: first, dummy processes must vary in their execution pattern, using a different dummy process each time or maintaining a low repetition rate, to prevent adversaries from identifying a distinguishable signature that differentiates dummy from genuine execution; second, timing of dummy execution must be carefully controlled, with a dummy process executed every time the aggregator receives a transmission and randomly during idle periods, to prevent adversaries from correlating the presence or absence of radio frequency (RF) transmissions with power consumption curves to identify and discard dummy activity. Together, these properties are intended to reduce an observer’s ability to distinguish valid aggregation cycles and infer traffic flow toward a critical root or base-station node. They do not guarantee that aggregator nodes, network topology, or the base station cannot be identified through other observations. | PE-19 PE-19(1) | A.7.5 A.7.8 A.8.12 | ||||
| CM0071 | Communication Physical Medium | The physical medium selected for ground segment networking directly affects the mission's vulnerability to passive interception, traffic flow analysis, and electromagnetic eavesdropping, making medium selection a security design decision that must be informed by the mission's threat model. Fiber optic cabling transmits data optically and does not produce the same conducted or radiated electrical emanations as copper cabling, reducing exposure to proximity-based electromagnetic collection. Fiber may still be intercepted through physical access, optical coupling, compromised patch points, or endpoint equipment, and medium selection alone does not conceal traffic timing or volume from an observer with access to the link or its endpoints. Fiber should therefore be considered where the threat model identifies electromagnetic emanation or physical-medium interception risk, while cryptographic and physical protections remain applicable, particularly for links carrying mission-sensitive data such as command uplink traffic, cryptographic key material, or mission planning data. The selection of physical medium should be treated as a threat-informed engineering decision evaluated for each network segment based on the sensitivity of the data carried, the physical accessibility of the cabling, and the threat environment of the facility in which the cabling is installed. | PE-4 SC-8 SC-8(1) SC-8(3) SC-8(5) | A.7.2 A.7.12 A.5.10 A.5.14 A.8.20 A.8.26 A.5.33 | ||||
| CM0029 | TRANSEC | Transmission security (TRANSEC) is the component of communications security (COMSEC) concerned with protecting the characteristics of the transmission itself, as distinct from protecting the content of the information being communicated. TRANSEC controls reduce the likelihood, effectiveness, or operational impact of transmission interception, signal disruption, communications deception, and exploitation of transmission characteristics within the defined threat model. Applicable TRANSEC techniques include jam-resistant waveforms that increase resistance to jamming and communications deception, spread spectrum and frequency hopping techniques that reduce signal predictability and improve resistance to interception and disruption, low probability of intercept and low probability of detection (LPI/LPD) signal designs that reduce transmission observability, and transmission scheduling or pattern discipline that limits the intelligence value of traffic analysis. TRANSEC requirements should be applied to mission communication links according to link criticality (e.g., TT&C, crosslinks), threat exposure, and operational consequence. TRANSEC must be treated as a distinct layer of protection complementary to, but not a substitute for, cryptographic protection of information content. | AC-17 AC-18 AC-18(5) CA-3 CP-8 PL-8 PL-8(1) SA-8(19) SC-16 SC-16(1) SC-40 SC-40(1) SC-40(3) SC-40(4) SC-5 SC-8(1) SC-8(3) SC-8(4) | A.5.14 A.6.7 A.8.1 A.5.14 A.8.1 A.8.20 A.5.14 A.8.21 A.5.29 A.7.11 A.5.8 A.5.33 | ||||