SpaceShield

A command sent to a spacecraft cannot always be undone. Operations teams need to show who was permitted to send a command, who approved it and when, both for their own review and for customers and regulators.

SpaceShield is designed to provide the following.

• Role-based permissions for operators, reviewers and administrators.
• Command controls that limit which commands each role may prepare or release.
• Two-person approval for commands the operator organisation designates.
• An audit record of requests, approvals, releases and changes to permissions.
• Export of the audit record for review.

An example of how an operations team would use SpaceShield. The steps are illustrative.

1. An operator prepares a command in MissionOS.
2. SpaceShield checks it against the operator role and command rules.
3. If the rules require it, a second person reviews and approves.
4. The command is released and the record is written.
5. Reviewers can later open the record for any command.

SpaceShield sits in the command path of MissionOS. Identity integration with a partner directory, and the format of the audit export, are specified with that partner.

• A permission and approval model for the partner team.
• A mapping of the partner command set to approval rules.
• A sample audit export.
• A written list of security requirements still open.

Pilots are scoped with each partner. See the Design Partner Program.

SpaceShield controls and records command authority inside OrbitalOS. It does not by itself make a mission compliant with any standard. It does not secure the radio link or the spacecraft.