|
The [Program-defined security policy] shall state that information should not be allowed to flow between partitioned applications unless explicitly permitted by the Program's security policy. {SV-AC-6} {AC-4,AC-4(6)}
|
Fault management and security management capabilities would be classified as mission critical and likely need separated. Additionally, capabilities like TT&C, C&DH, GNC might need separated as well.
|
|
The Program shall identify the key system components or capabilities that require isolation through physical or logical means. {SV-AC-6} {SC-3}
|
|
|
The spacecraft shall enforce approved authorizations for controlling the flow of information within the spacecraft and between interconnected systems based on the [Program defined security policy] that information does not leave the spacecraft boundary unless it is encrypted. {SV-AC-6} {AC-4,AC-4(6)}
|
|
|
The spacecraft shall, when transferring information between different security domains, implements the following security policy filters that require fully enumerated formats that restrict data structure and content: connectors and semaphores implemented in the RTOS. {SV-AC-6} {AC-4(14)}
|
|
|
The spacecraft shall use protected processing domains to enforce the policy that information does not leave the spacecraft boundary unless it is encrypted as a basis for flow control decisions. {SV-AC-6} {AC-4(2)}
|
* Examine the isolation between mission critical and non-mission critical functionality for each individual information system component. Include architectural considerations in the examination, including isolation derived from using distinct components for mission critical and non-mission critical functionality. This would include having multiple 1553 buses for example to segregate C&DH/TT&C with payload operations.
* Methods to separate the mission/cyber critical software from software that is not critical, such as partitioning, may be used (i.e., ARINC 653). If such software methods are used to separate the code and are verified, then the software used in the isolation method is mission/cyber critical, and the rest of the software is not mission/cyber critical.
* The intent is to prevent non-mission critical functions/failures from having mission impact. For example some real time operating systems do threading or have the ability to isolate tasks where a failure of one task doesn't affect the spacecraft overall
|
|
The spacecraft shall isolate [Program-defined] mission critical functionality from non-mission critical functionality by means of an isolation boundary (implemented via partitions) that controls access to and protects the integrity of, the hardware, software, and firmware that provides that functionality. {SV-AC-6} {SC-3}
|
|
|
The spacecraft shall prevent unauthorized access to system resources by employing an efficient capability-based object model that supports both confinement and revocation of these capabilities when the spacecraft security deems it necessary. {SV-AC-6} {SC-4}
|
|
|
The spacecraft data within partitioned applications shall not be read or modified by other applications/partitions. {SV-AC-6} {SC-4,SC-6}
|
|
|
The spacecraft shall employ the principle of least privilege, allowing only authorized accesses processes which are necessary to accomplish assigned tasks in accordance with system functions. {SV-AC-6} {AC-6}
|
|
|
The spacecraft shall maintain a separate execution domain for each executing process. {SV-AC-6} {SC-7(21),SC-39}
|
|
|
The spacecraft shall implement boundary protections to separate bus, communications, and payload components supporting their respective functions. {SV-AC-6} {SC-7(21)}
|
|
|
The spacecraft shall ensure that processes reusing a shared system resource (e.g., registers, main memory, secondary storage) do not have access to information (including encrypted representations of information) previously stored in that resource during a prior use by a process after formal release of that resource back to the system or reuse. {SV-AC-6} {SC-4}
|
|
|
The spacecraft shall prevent unauthorized and unintended information transfer via shared system resources. {SV-AC-6} {SC-4}
|
|
|
The spacecraft flight software must not be able to tamper with the security policy or its enforcement mechanisms. {SV-AC-6} {SC-3}
|
|
|
The Program shall define the resources to be allocated to protect the availability of system resources. {SV-AC-6} {SC-6}
|
|
|
The Program defines the security safeguards to be employed to protect the availability of system resources. {SV-AC-6} {SC-6,SI-17}
|
In particular, this control is required for all space platform buses to ensure execution of high priority functions; it is particularly important when there are multiple payloads sharing a bus providing communications and other services, where bus resources must be prioritized based on mission.
|
|
The spacecraft protects the availability of resources by allocating [Program-defined] resources based on [priority and/or quota]. {SV-AC-6} {SC-6}
|
|