1
00:00:06,500 --> 00:00:16,460
Hello, I'm Pam Melroy and I'm delighted to be here today for Aerospace Village to talk about cybersecurity lessons learned from human spaceflight.

2
00:00:16,460 --> 00:00:19,660
So I'll start out by introducing myself.

3
00:00:19,780 --> 00:00:27,120
I am a retired Air Force test pilot and a NASA astronaut.

4
00:00:27,160 --> 00:00:32,800
I flew three times in space on the space shuttle to the International Space Station.

5
00:00:32,800 --> 00:00:36,120
My first two missions I was the pilot in the right seat.

6
00:00:36,240 --> 00:00:40,040
And on my final mission, I was the mission commander of the space shuttle.

7
00:00:40,420 --> 00:00:44,360
Now, all of my missions were to the International Space Station.

8
00:00:44,360 --> 00:00:50,760
And this is a picture of what it looks like now in space orbiting above us at about 400 kilometers.

9
00:00:50,900 --> 00:00:53,540
It's an international laboratory.

10
00:00:53,680 --> 00:01:05,580
Now, there's lots of very interesting science that you can do in microgravity as you're whizzing around in low Earth orbit, experiencing a balancing of all the forces.

11
00:01:05,580 --> 00:01:07,600
So it feels like there's no gravity.

12
00:01:07,600 --> 00:01:10,280
You don't feel the effects of gravity, even though they're there.

13
00:01:11,980 --> 00:01:22,000
We discovered we could do a lot of really interesting science on the space shuttle, like fluid mechanics, combustion, and even studying the human body and biology.

14
00:01:22,080 --> 00:01:29,620
But flying on the shuttle, we only flew about six or seven times a year for about 10 days to two weeks at a time.

15
00:01:29,860 --> 00:01:43,760
And so the United States joined with our partners, Russia, Japan, Canada, and Europe to build the International Space Station so that we could do science 24-7, 365 days a year.

16
00:01:44,260 --> 00:01:51,500
And now, of course, if you look at the space station, you realize it's far too big to put on the top of a rocket and launch it.

17
00:01:51,500 --> 00:01:57,320
We had to bring it up a piece at a time and build it as we went along.

18
00:01:58,100 --> 00:02:11,400
If you look in the upper left-hand corner, you can see Atlantis from my second flight with part of the truss segment that the solar arrays sit on, filling up the entire payload bay.

19
00:02:11,440 --> 00:02:23,120
So we carried up an element at a time and then using the robotic arm of the space shuttle and the space station, maneuvered it into position and then bolted it down.

20
00:02:23,120 --> 00:02:29,060
And then we sent spacewalkers outside to make the power, cooling, and data connections.

21
00:02:29,060 --> 00:02:33,280
And then inside the space station, we would activate the element.

22
00:02:33,400 --> 00:02:45,160
Now, most of the time, we actually had to upgrade the software each time that we did that on the ISS because we had new mass properties, new capabilities.

23
00:02:45,380 --> 00:02:55,520
And so it wasn't just activating a new element, it was actually constantly evolving the International Space Station command and data handling system.

24
00:02:57,510 --> 00:03:20,070
Now, after I left NASA, I went on to a variety of opportunities in industry and government, including spending a couple of years with the FAA's Office of Commercial Space Transportation, learning all about space policy and the new emerging commercial space industry.

25
00:03:20,070 --> 00:03:27,750
And I spent four years at DARPA as a deputy of the Tactical Technology Office overseeing the air and space research portfolio.

26
00:03:28,130 --> 00:03:31,650
Space is incredibly important in our daily lives.

27
00:03:32,030 --> 00:03:37,070
The GPS navigation that we have on our phone is just the beginning.

28
00:03:37,070 --> 00:03:44,170
Think of all the apps that use GPS, agriculture, most importantly, financial transactions.

29
00:03:44,170 --> 00:03:48,490
When you use an ATM, the timing signal is set by GPS.

30
00:03:48,710 --> 00:03:53,350
We also use space for national security communications throughout the world.

31
00:03:53,350 --> 00:04:02,510
Think about remote sensing of our Earth to study the weather, be able to predict it, and have other indicators of the health of the Earth.

32
00:04:02,510 --> 00:04:11,770
We've had a very complacent attitude about our satellites because physical access was basically impossible once the satellite was launched.

33
00:04:11,770 --> 00:04:20,530
But now we know that our key infrastructure is at threat on the ground, and it is in space as well from both physical and cyber threats.

34
00:04:20,690 --> 00:04:30,930
Space systems have always focused on safety and mission assurance because you can't access them, you can't repair them, and it's expensive to launch things.

35
00:04:30,930 --> 00:04:37,950
So we've spent a lot of time focusing on redundancy and testing and mission assurance.

36
00:04:38,270 --> 00:04:44,590
Now we have the commercial world coming into play, doing things faster and cheaper.

37
00:04:44,810 --> 00:04:49,530
And we have the potential for lunar exploration.

38
00:04:49,610 --> 00:04:55,250
And we also have nation-states competing for achievements and resources in space.

39
00:04:55,250 --> 00:04:57,350
So the threat is evolving.

40
00:04:57,350 --> 00:05:01,710
We need to understand the implications and prepare for the challenges ahead.

41
00:05:01,790 --> 00:05:09,170
I'm going to talk a little bit about the lessons learned from the software approach to human spaceflight for both a space shuttle and a space station.

42
00:05:09,170 --> 00:05:13,550
But first I'd like to actually address, so what is the real threat?

43
00:05:13,550 --> 00:05:16,330
What could a hacker actually do to a satellite?

44
00:05:16,710 --> 00:05:20,430
Well, the simplest hack, of course, is a denial of service.

45
00:05:20,430 --> 00:05:21,930
Pretty straightforward.

46
00:05:21,930 --> 00:05:24,250
And it's actually happening today.

47
00:05:24,250 --> 00:05:25,790
Jamming of signal.

48
00:05:25,790 --> 00:05:33,190
Sometimes it's inadvertent, just having a transmitter tuned too loudly so it's drowning other transmitters out.

49
00:05:33,190 --> 00:05:35,650
And sometimes it's completely intentional.

50
00:05:35,650 --> 00:05:38,950
You could intercept commands and data.

51
00:05:39,030 --> 00:05:51,890
So you could understand what things the satellite is pointing at, what it's taking pictures of, see that data stream for yourself, and also intercept communications.

52
00:05:52,930 --> 00:05:57,170
There's also the potential for the man-in-the-middle type of attacks.

53
00:05:57,170 --> 00:06:06,510
That's quite a bit harder, actually, with most space systems now, because you would have to really understand the data stream in order to alter it.

54
00:06:07,050 --> 00:06:12,210
Now, could you do something crazy like send it over to hit another satellite?

55
00:06:12,210 --> 00:06:16,290
So if you think about a self-driving car and hacking that, you could drive it off the road.

56
00:06:16,290 --> 00:06:17,270
Well, not really.

57
00:06:17,270 --> 00:06:22,630
Most satellites don't actually carry enough propellant to maneuver over to another satellite.

58
00:06:22,630 --> 00:06:26,350
But what you could do is run the satellite out of fuel.

59
00:06:26,610 --> 00:06:32,050
You could shut down a critical system like cooling or pointing the solar arrays at the sun.

60
00:06:32,490 --> 00:06:41,510
Now, there are roughly 5,000 active satellites in space, but only the International Space Station has humans on board permanently.

61
00:06:41,770 --> 00:06:48,870
So even back in the 70s, when the shuttle was being designed, there was a recognition that it was going to be different.

62
00:06:49,050 --> 00:06:50,710
Lives were going to be at stake.

63
00:06:50,710 --> 00:06:57,530
So a much higher level of attention needed to be paid to software errors that could have catastrophic consequences.

64
00:06:57,530 --> 00:07:04,510
So I'd like to talk about some of the lessons that we can learn from the shuttle and from ISS.

65
00:07:08,220 --> 00:07:12,180
Now, it's kind of easy to make fun of the space shuttle.

66
00:07:12,180 --> 00:07:15,100
Yes, this is a picture from my first flight.

67
00:07:15,100 --> 00:07:22,040
And you can see that we interfaced with the shuttle computers using a cathode ray tube screen.

68
00:07:22,100 --> 00:07:24,940
And that's a blow-up of what it looks like.

69
00:07:24,940 --> 00:07:28,220
It's black with green letters on it.

70
00:07:28,220 --> 00:07:35,740
Absolutely no graphics processing units or, you know, any kind of artistry at all.

71
00:07:35,740 --> 00:07:38,240
It's anything that you could make with numbers and lines.

72
00:07:38,240 --> 00:07:39,920
And that was pretty much it.

73
00:07:40,140 --> 00:07:44,440
We also were very limited in the way that we could communicate.

74
00:07:44,440 --> 00:07:48,060
We didn't have a full keyboard the way most computers do.

75
00:07:48,060 --> 00:07:51,200
We had a small hexadecimal keyboard.

76
00:07:51,320 --> 00:07:53,840
Now, this actually wasn't that bad.

77
00:07:53,840 --> 00:08:06,800
One of the very clever things that was done with shuttle software was the extensive use of bundled commands, what I would, in my simplistic mind, think of as a macro.

78
00:08:07,540 --> 00:08:21,580
So there were many, many things that needed to have multiple tasks done, say to configure the entire vehicle for a different phase of flight or to prepare for another activity.

79
00:08:21,580 --> 00:08:41,920
So rather than throwing switches, which were limited space, or pressing in a number or an action for every single one, you had the capability to hit item and a number and then execute on a given page, and it would set off a whole string of bundled commands.

80
00:08:41,920 --> 00:08:46,840
So it actually wasn't as bad to interface with as you might think.

81
00:08:47,420 --> 00:08:51,080
Now, here's one of the areas that I really didn't like.

82
00:08:51,080 --> 00:08:52,540
The fault summary.

83
00:08:52,540 --> 00:08:56,420
So if something went wrong, this is the page that you went to.

84
00:08:56,420 --> 00:09:02,240
And it had a maximum of 15 faults displayed, which most of the time was pretty okay.

85
00:09:02,240 --> 00:09:05,820
But worse, it doesn't have any scrolling capability.

86
00:09:05,900 --> 00:09:08,960
So on my first flight, we had a malfunction.

87
00:09:09,100 --> 00:09:19,200
We had an electrical bus short on a payload bus that provided about one-third of the power to the payload and the systems aboard the space shuttle.

88
00:09:19,500 --> 00:09:24,620
Now, you can imagine when that happened, every bell and whistle went off inside the space shuttle.

89
00:09:24,620 --> 00:09:29,220
And when I went back to look at this fault sum, I didn't have very many choices.

90
00:09:29,220 --> 00:09:34,400
I had to either write everything down, because when I hit reset, it was gone and I could never see it again.

91
00:09:34,480 --> 00:09:38,780
And the messages would stack up and get lost behind each other.

92
00:09:38,780 --> 00:09:43,820
So definitely, you can see some real weaknesses in the interface area.

93
00:09:43,820 --> 00:09:51,660
I think that was a real challenge, I think, but probably very reflective of the capabilities of the 70s.

94
00:09:52,500 --> 00:09:58,480
The Shuttle General Purpose Computer, or GPC, was a marvel.

95
00:09:58,520 --> 00:10:01,120
Really, incredibly rugged.

96
00:10:01,120 --> 00:10:06,600
So carrying a whole whopping megabyte of RAM, but very, very rugged.

97
00:10:06,600 --> 00:10:07,820
It had to be rugged.

98
00:10:07,820 --> 00:10:12,080
It had to withstand the intense vibration and g's of launch.

99
00:10:12,080 --> 00:10:30,600
It also had to be very radiation tolerant, compared to the laptops that we carried that I'll talk about in a little bit, which had constant cosmic ray hits and corruption of data, requiring you to reboot them typically once a day.

100
00:10:30,600 --> 00:10:33,120
That was not the case with the GPC.

101
00:10:33,120 --> 00:10:36,940
It was very, very rugged, and it was meant to be radiation tolerant.

102
00:10:37,040 --> 00:10:39,780
It was also highly efficient.

103
00:10:39,820 --> 00:10:46,640
Only 400,000 lines of code to operate the entire space shuttle.

104
00:10:46,640 --> 00:10:50,100
Pretty amazing, actually, that we could do that.

105
00:10:50,260 --> 00:10:55,580
Part of the reason for that is that code in space has weight implications.

106
00:10:55,640 --> 00:10:56,760
That's right.

107
00:10:56,760 --> 00:11:05,340
If you're doing more computations, you need more power and more cooling, which is more mass and more volume.

108
00:11:05,480 --> 00:11:13,300
And so efficiency in software is incredibly important in space, and the space shuttle definitely reflected that.

109
00:11:14,420 --> 00:11:22,020
One of the cool things about the space shuttle software was it had a very, very low error rate.

110
00:11:22,100 --> 00:11:32,820
So I'm showing here a table from a great paper that's got the link at the bottom, reflective of the space shuttle software history.

111
00:11:32,820 --> 00:11:44,640
If you look back to the right-hand side there, the total error rate per case lock in 1981 was about eight to nine.

112
00:11:44,640 --> 00:11:46,660
That's pretty darn good.

113
00:11:46,660 --> 00:11:55,860
And within seven years, it was consistently down around one, which is an order of magnitude better than commercial software.

114
00:11:55,860 --> 00:11:59,240
Some would say two orders of magnitude, depending on the software.

115
00:11:59,300 --> 00:12:12,260
And you can see that by the time we got close to the end of the space shuttle, flying the space shuttle, we had gotten the error rates in our new updates down to zero.

116
00:12:12,660 --> 00:12:16,140
Now, how in the world did we do this?

117
00:12:16,140 --> 00:12:18,560
Well, we kind of had to brute force it, right?

118
00:12:18,560 --> 00:12:23,200
It was a lot of verification and testing.

119
00:12:23,520 --> 00:12:28,400
So each space shuttle mission had unique software on it.

120
00:12:28,400 --> 00:12:37,660
Now, there was the core software, which was the same, but it was actually a unique software load because you had a different payload.

121
00:12:37,660 --> 00:12:39,600
You had different mass properties.

122
00:12:39,620 --> 00:12:43,980
Maybe you were going to the space station, or maybe you were going to a different inclination.

123
00:12:43,980 --> 00:12:55,880
So for each shuttle mission, months were spent on that unique software load doing verification in SAIL, the Shuttle Avionics Integration Laboratory.

124
00:12:56,120 --> 00:13:09,420
And the idea behind that is you would have crews and engineers who would run through tons and tons of scenarios, lots of procedures, to verify that there were no unwanted changes to the software.

125
00:13:09,420 --> 00:13:16,200
This is pretty amazing, considering that there were no auto debugging capabilities at that time.

126
00:13:16,200 --> 00:13:24,000
So it was very manual intensive, but it does show that it is possible to get very, very low error rates.

127
00:13:24,020 --> 00:13:45,440
One of the other interesting things about the shuttle software program was that not only was verification very intense, but if a bug or an error was found, the program would go back and take a look at what process escape allowed that bug to slip through.

128
00:13:45,680 --> 00:14:03,980
So in addition to just checking the software, they were also looking at the entire coding process to go back and see if they could trap any other bugs that were from the same process escape, and plug that process escape so that future bugs would not be introduced to the system.

129
00:14:05,140 --> 00:14:20,260
Another aspect of the Space Shuttle that was really interesting and added to the resiliency of the system was the flexible redundancy in the software systems put into the general purpose computers.

130
00:14:20,260 --> 00:14:25,020
So we carried five GPCs aboard the Space Shuttle.

131
00:14:25,020 --> 00:14:36,140
Four of them were loaded with the primary avionics software system, known as PASS, and one computer was loaded with backup flight software, or BFS.

132
00:14:36,240 --> 00:14:40,520
That software was developed completely independently.

133
00:14:40,520 --> 00:14:47,080
It was a separate company, a separate group of people, there was no interaction or interfacing between them.

134
00:14:47,080 --> 00:15:00,000
That backup flight software was there to protect in case there was a flaw in the primary avionics software system that affected the four primary computers that were used.

135
00:15:00,000 --> 00:15:05,020
Now, backup flight software didn't have all the same capability as PASS.

136
00:15:05,020 --> 00:15:16,580
It had basically what you needed to complete an ascent and get to orbit safely, or if you had a problem occur on entry, to get down to the ground.

137
00:15:16,840 --> 00:15:27,760
So on ascent and entry, we flew with four computers running in parallel with each other and the backup ready to go.

138
00:15:27,760 --> 00:15:44,820
And if there were any failures that you lost confidence in either the software or the GPCs, the crew could press a red button on the stick and instantly jump over to the backup flight software and then get into a safe place with that software.

139
00:15:45,140 --> 00:15:47,700
Any computer could take any of that software.

140
00:15:47,700 --> 00:15:58,660
If you got on orbit and realized that the BFS computer that had BFS loaded into it had a hardware problem, that was fine.

141
00:15:58,660 --> 00:16:03,720
You could load BFS for entry into any one of the other GPCs.

142
00:16:04,000 --> 00:16:10,300
The mass memory unit on board had several copies of both sets of software.

143
00:16:10,880 --> 00:16:34,100
So if you found an error in the software, maybe there was a coding problem or a corruption, in one of the GPCs you could reload the software from the mass memory unit and you had actually several copies to select from in case again somewhere on the mass memory unit there was a corruption or a failure.

144
00:16:34,160 --> 00:16:37,140
Incredibly flexible, incredibly redundant.

145
00:16:38,940 --> 00:16:52,840
The other key aspect that I think had a very positive impact on resiliency but also on security is a distributed architecture and the space shuttle was one of the first vehicles to use this capability.

146
00:16:52,960 --> 00:17:07,060
So the idea is that you separate critical functions and then you're very careful and limit what information is allowed to pass between them and there are checks to make sure that you protect that.

147
00:17:07,080 --> 00:17:20,200
So on orbit we would shut down three of the GPCs into basically into a warm mode and so that we could restart them if we needed to.

148
00:17:20,200 --> 00:17:25,260
We had one actually was warm as a warm backup and the other two were shut down completely.

149
00:17:25,440 --> 00:17:29,480
And then in one computer we had guidance, navigation, and control.

150
00:17:29,480 --> 00:17:41,900
Very critical software controlling the vehicle, knowing where its navigation state was, knowing where you were pointed, all very very critical aspects of operating the vehicle.

151
00:17:41,920 --> 00:17:55,840
And then in another computer we loaded systems management software or SM software and that had critical functions having to do with the systems but the communications between these were very tightly structured.

152
00:17:57,320 --> 00:18:08,740
Well we found pretty quickly that three CRTs was not enough information for the crew especially as our missions began to get more complex on in the shuttle program.

153
00:18:08,740 --> 00:18:18,640
And so we added a third tier to the distributed architecture, a payload general support computer or PGSC.

154
00:18:18,640 --> 00:18:25,080
And that's a picture of the IBM ThinkPad that I flew on my missions as a PGSC.

155
00:18:25,240 --> 00:18:29,900
Each crew would carry somewhere between five and seven PGSCs.

156
00:18:29,980 --> 00:18:37,920
They performed functions like a world map so that you could just glance at the map and know exactly where over the earth you were.

157
00:18:37,920 --> 00:18:44,820
You could see critical things like if there was a loss of communications coming up, a comm outage, or something like that.

158
00:18:44,820 --> 00:18:47,840
But we used them heavily for mission support.

159
00:18:47,840 --> 00:18:59,040
In the bottom left picture is me and my friend Koichi Wakata had just completed a very complex robotics operation using the two PGSCs mounted behind us.

160
00:18:59,040 --> 00:19:02,760
Of course in microgravity it was pretty easy to mount those anywhere that you wanted to.

161
00:19:02,760 --> 00:19:07,980
They just would stick with a little bit of velcro on a platform.

162
00:19:08,220 --> 00:19:17,400
And those PGSCs would take data from the GNC and the SM computers but could not send anything back.

163
00:19:17,400 --> 00:19:24,060
So it was a one-way flow of data from the GNC computer or the SM computer to the PGSC.

164
00:19:24,440 --> 00:19:40,420
Now in the bottom right hand corner you see a picture of the Rendezvous and Proximity Operations Program, or RPOP, which is an app that we used to visualize the orbital mechanics between the shuttle and the station.

165
00:19:40,420 --> 00:19:48,400
And that picture was taken shortly after I docked to the space station showing my approach, my line of approach.

166
00:19:48,400 --> 00:19:57,840
Now we also used these laptops for email, but the email wasn't directly connected.

167
00:19:57,840 --> 00:20:03,780
In fact, what would happen is the ground would sync up our mail three times a day.

168
00:20:03,780 --> 00:20:13,640
So you know, three times a day we'd get a message from the ground, basically mail call, and you know, everybody would scramble for a computer to check their email.

169
00:20:14,400 --> 00:20:18,980
We could do that because we were only in space about 10 days to two weeks at a time.

170
00:20:18,980 --> 00:20:22,580
We also used it for file sharing and other things like that.

171
00:20:22,580 --> 00:20:28,760
The PGSCs were absolutely essential, but they were also very isolated and very protected.

172
00:20:30,020 --> 00:20:45,380
Now this is a pretty happy story about the overall security of the shuttle software system and how we approached it, but that doesn't mean that we didn't have unanticipated issues, almost all of them resulting from complexity.

173
00:20:45,680 --> 00:21:00,440
So we used for many, many years on the space shuttle, inertial navigation units were the primary form of maintaining the navigation state, you know, where are you in space?

174
00:21:00,440 --> 00:21:07,100
And the ground could uplink information from a radar pass or something that gave us more precise information.

175
00:21:07,100 --> 00:21:24,280
But when the opportunity came to integrate a GPS receiver, when they started to become lightweight enough and ubiquitous enough, that was a great opportunity because we were doing highly precise navigation maneuvers like rendezvousing with the space station.

176
00:21:24,280 --> 00:21:35,660
Now the first time we tested it was on STS-91 and of course we were smart enough not to make the GPS receiver be the only generation of the nav state.

177
00:21:35,660 --> 00:21:42,060
In fact, we disconnected the GPS receiver from the primary nav state of the GNC computer.

178
00:21:42,060 --> 00:21:47,920
So we didn't want to influence or upset that, but we wanted to monitor it.

179
00:21:47,920 --> 00:21:54,420
So there was an aiding state, basically a secondary state that the GPS receiver would periodically update.

180
00:21:54,420 --> 00:22:01,600
And that way we could sort of measure and see what the nav state would look like if the GPS receiver was updating it.

181
00:22:01,760 --> 00:22:03,600
Well, we had a little hiccup.

182
00:22:03,600 --> 00:22:11,400
The GPS receiver had a software anomaly and basically went into a control-alt-delete type reboot situation.

183
00:22:11,700 --> 00:22:21,460
And unfortunately, at exactly the same time, the GNC computer sent a message to the GPS receiver asking for an update to the aiding state.

184
00:22:21,460 --> 00:22:23,640
Well, the GPS receiver never saw it.

185
00:22:23,640 --> 00:22:31,480
When it came back up on board, it was not a flag that was set.

186
00:22:31,480 --> 00:22:38,140
And so as far as the GPS receiver was concerned, it had never been asked for the information and never provided it.

187
00:22:38,140 --> 00:22:42,380
So the GNC computer at that point said, uh-oh, GPS receiver is down.

188
00:22:42,380 --> 00:22:46,720
So stopped asking for updates from the GPS receiver.

189
00:22:46,720 --> 00:22:50,460
Now that aiding state began to degrade, right?

190
00:22:50,460 --> 00:22:55,380
You're propagating a navigation state without putting any corrections in.

191
00:22:55,380 --> 00:23:03,440
And sooner or later, the numbers started to go pretty funky and math errors began to be generated.

192
00:23:03,440 --> 00:23:04,680
No problem, right?

193
00:23:04,680 --> 00:23:05,300
No problem.

194
00:23:05,300 --> 00:23:11,720
I told you already, very limited information flows between the GNC computer and the systems management computer.

195
00:23:11,720 --> 00:23:13,540
Everything should be just fine.

196
00:23:13,540 --> 00:23:21,020
Well, there are two very important things that are communicated between the GNC computer and SM.

197
00:23:21,020 --> 00:23:22,960
The first one is the nav state.

198
00:23:22,960 --> 00:23:28,480
So the systems management computer knows where to point the antenna to talk to the ground.

199
00:23:28,800 --> 00:23:38,600
Unfortunately, when those math errors started to generate, the other type of information came into play, which is error codes.

200
00:23:38,600 --> 00:23:44,660
Of course, the systems management computer wants to know if there's a problem on the GNC computer.

201
00:23:44,660 --> 00:23:54,660
Well, the intercomputer communication bus got flooded with these math errors, which essentially choked out passing the nav state.

202
00:23:54,660 --> 00:24:00,540
So the systems management computer did not receive any updated shuttle state vectors.

203
00:24:00,540 --> 00:24:08,360
And eventually, this antenna lost lock with the satellite that linked it to the ground.

204
00:24:08,360 --> 00:24:14,020
And one of the most serious problems that can happen in space is a loss of communications.

205
00:24:14,020 --> 00:24:16,500
And it happened while the crew was asleep.

206
00:24:16,640 --> 00:24:30,740
Well, MCC to the rescue, mission control was able to actually get in and figure out how to manually... they eventually got a lock over a ground station.

207
00:24:30,740 --> 00:24:40,440
They sent a command to manually point the antenna at the TDRS satellite and then were able to fix the problem.

208
00:24:40,440 --> 00:24:49,740
But it just points out that it was really incredibly resilient and they thought through as many errors as they could.

209
00:24:49,740 --> 00:24:52,820
But in a complex system like this, you can still have problems.

210
00:24:53,700 --> 00:24:56,920
Now, we learned a lot for the International Space Station.

211
00:24:56,960 --> 00:24:59,580
I'd like to say we really upped our game.

212
00:24:59,880 --> 00:25:04,840
We learned a lot about security, starting all the way with the ground system.

213
00:25:04,840 --> 00:25:12,860
Even back in the Apollo days, there was not the capability to talk straight from Houston up to the spacecraft.

214
00:25:12,980 --> 00:25:28,380
But instead, a large set of antennas in White Sands, New Mexico, talking to the tracking and data relay satellite, which then communicates low data rate S-band audio information and high data rate KU-band video and payload data.

215
00:25:28,380 --> 00:25:32,300
This entire network is completely owned by NASA.

216
00:25:32,300 --> 00:25:36,280
So this is not going through open internet.

217
00:25:36,280 --> 00:25:38,200
There's no cloud.

218
00:25:38,200 --> 00:25:41,380
This is completely controlled to NASA.

219
00:25:41,380 --> 00:25:43,340
And of course, it's been updated.

220
00:25:43,340 --> 00:25:45,980
So just another aspect of the security.

221
00:25:48,060 --> 00:25:53,100
Another interesting issue was around mission control commanding.

222
00:25:53,100 --> 00:25:59,100
Now, people weren't really thinking about hacking, but what they were thinking about is making mistakes.

223
00:25:59,160 --> 00:26:02,420
So an innocent mistake could send a bad command.

224
00:26:02,420 --> 00:26:04,420
Now, that was true for the space shuttle, too.

225
00:26:04,420 --> 00:26:13,220
But we had fewer controllers for the space shuttle, all hands on deck, the six times a year or seven times a year that the shuttle was flying.

226
00:26:13,220 --> 00:26:18,300
So a high level of proficiency in a very small pool of people.

227
00:26:18,300 --> 00:26:28,820
Well, with the International Space Station operating 365 days a year and 24-7, we needed a lot more controllers.

228
00:26:28,820 --> 00:26:42,140
So there's a very rigorous certification process required for controllers in the International Space Station Mission Control Center to allow them to send commands to the space station.

229
00:26:42,140 --> 00:27:00,100
In addition, there are screening protocols, both before it ever leaves MCC, going up to the ISS, and once it's on board ISS, to check and make sure that that command will not inadvertently do some damage to the station.

230
00:27:00,240 --> 00:27:12,560
And so, again, really all of these characteristics were really there for safety, but they have the added capability of adding to the cybersecurity as well.

231
00:27:13,520 --> 00:27:15,780
Now, distributed architecture.

232
00:27:15,780 --> 00:27:19,460
This is at a whole new level on the space station.

233
00:27:19,460 --> 00:27:30,700
So starting with the command and control computers, multiplexer, demultiplexer, or MDMs, there's three command and control MDMs that control the station.

234
00:27:30,700 --> 00:27:43,540
And just like the GNC and the SM computers on the shuttle, in this case, there are multiple separate payload and ISS element MDMs to control the system.

235
00:27:43,540 --> 00:27:45,980
So highly distributed in that regard.

236
00:27:46,020 --> 00:27:50,780
And again, with very strict rules about bus traffic between them.

237
00:27:50,860 --> 00:27:57,280
Now, the crew on board the space station does not have cathode ray tubes, I'm very happy to report.

238
00:27:57,280 --> 00:28:01,280
Instead, they use a laptop called the portable computer system.

239
00:28:01,280 --> 00:28:03,300
I apologize for all the acronyms.

240
00:28:03,300 --> 00:28:05,080
This is what NASA does, though.

241
00:28:05,080 --> 00:28:11,640
Anyway, the PCS is used for the crew to send commands to the ISS MDMs.

242
00:28:11,640 --> 00:28:13,640
It's essentially a remote terminal.

243
00:28:13,640 --> 00:28:15,100
It plugs in.

244
00:28:15,500 --> 00:28:17,880
They are not networked to each other.

245
00:28:17,880 --> 00:28:22,720
They are plugged directly into the station and can send commands.

246
00:28:22,960 --> 00:28:30,600
Now, they have the same issues that we did on the space shuttle, wanting more screens, more apps, more capability.

247
00:28:30,600 --> 00:28:33,000
And so there is an ops LAN.

248
00:28:33,380 --> 00:28:37,760
It is a local area network using station support computers.

249
00:28:39,080 --> 00:28:44,840
These computers are used for procedures, email, and everything else.

250
00:28:44,840 --> 00:28:46,300
Including Twitter.

251
00:28:46,300 --> 00:28:53,480
Now, you may be wondering, because I told you on the space shuttle, we didn't have real-time access to the internet.

252
00:28:54,000 --> 00:28:59,460
Well, that's a real hardship on the space station, if you stop and think about that for a moment.

253
00:28:59,460 --> 00:29:02,800
Because there are people living up there for six months.

254
00:29:03,260 --> 00:29:05,780
And, I mean, just even really simple things.

255
00:29:05,780 --> 00:29:11,560
Like, if you were up there for six months, and maybe you wanted to go on the internet and buy your husband a birthday present.

256
00:29:11,560 --> 00:29:13,200
And lots and lots of other things.

257
00:29:13,200 --> 00:29:20,060
So, and of course, the onset of Twitter, which astronauts have embraced completely.

258
00:29:20,440 --> 00:29:25,560
So, it took a fair amount of work to set up the cyber security.

259
00:29:25,560 --> 00:29:28,700
Because that was already a consideration even by then.

260
00:29:28,700 --> 00:29:34,900
So, there's a computer inside the firewall at the Johnson Space Center that is the proxy computer.

261
00:29:34,900 --> 00:29:41,060
So, the space station support computers talk to the proxy computer, which then goes out onto the internet.

262
00:29:41,140 --> 00:29:47,400
Now, of course, just like any computer, it's still subject, potentially, to malware.

263
00:29:47,460 --> 00:29:57,500
But the most important thing is the station support computers, in no way, shape, or form, are networked to the actual commanding of the station.

264
00:29:57,500 --> 00:30:02,320
They're completely separate systems, and they don't talk to each other.

265
00:30:02,320 --> 00:30:11,180
And so, a hacker might be able to get at, with great difficulty, but might be able to get at somebody's email on board the space station.

266
00:30:11,180 --> 00:30:14,400
But they couldn't take over controlling the station.

267
00:30:14,520 --> 00:30:18,200
Sort of the ultimate in a distributed architecture.

268
00:30:18,760 --> 00:30:23,160
So, the use of computers is so important on the International Space Station.

269
00:30:23,160 --> 00:30:29,240
I just want to show an example, actually, of how they're used operationally.

270
00:30:29,240 --> 00:30:34,920
And this is a picture from my third flight in space, where we had a lot of important robotics operations.

271
00:30:35,180 --> 00:30:40,440
So, in the center of the screen, you will see three videos.

272
00:30:40,460 --> 00:30:45,560
And then, underneath the one on the left, and on the right, are two hand controllers.

273
00:30:45,660 --> 00:30:49,480
They control the robotic arm of the space station.

274
00:30:49,520 --> 00:30:52,940
So, that's how you move the arms with those hand controllers.

275
00:30:54,380 --> 00:31:00,880
Now, I talked about the PCS, which does command, and it actually can send commands to the big arm.

276
00:31:00,880 --> 00:31:04,600
Turn it on, turn it off, switch power sources, and so forth.

277
00:31:04,600 --> 00:31:07,860
And so, the PCS on the right was set up for ISS commands.

278
00:31:07,860 --> 00:31:11,680
And then, there's a backup PCS set up in the middle.

279
00:31:11,680 --> 00:31:22,660
It enables you to quickly, if there's a hardware or software failure on the primary PCS, you could go to the backup PCS very quickly.

280
00:31:22,660 --> 00:31:29,220
And in addition, it allows you to monitor other critical systems that interact with the robotic arm.

281
00:31:29,840 --> 00:31:36,080
And then, the other three computers, the two above and the one to the left, are part of the OPSLAN.

282
00:31:36,080 --> 00:31:37,660
They're station support computers.

283
00:31:37,660 --> 00:31:43,380
They provide extra camera views, procedures, file sharing, etc., etc.

284
00:31:45,800 --> 00:31:50,160
Now, areas of concern in space systems for me.

285
00:31:50,160 --> 00:31:56,460
I'd like to shift gears a little bit and say, this is what I see out there that is worrying me.

286
00:31:56,460 --> 00:32:06,600
First of all, uplink and downlink to most satellites is encrypted, but the data on the bus itself is not.

287
00:32:07,140 --> 00:32:11,480
So, of course, it's easy to say, well, there's no way to access it.

288
00:32:11,480 --> 00:32:12,380
It's just out there.

289
00:32:12,380 --> 00:32:13,560
It's in space.

290
00:32:13,580 --> 00:32:17,060
But in fact, I think it is an area of concern.

291
00:32:17,060 --> 00:32:21,580
It's something that we should be thinking about encrypting onboard traffic as well.

292
00:32:21,900 --> 00:32:29,420
Ground system vulnerabilities is probably the one place that if you're talking to a space person, they will acknowledge there is a cyber risk.

293
00:32:29,520 --> 00:32:32,520
Our ground systems are very vulnerable.

294
00:32:32,520 --> 00:32:40,160
They're just as vulnerable as any enterprise computer, as part of any enterprise IT system.

295
00:32:40,320 --> 00:32:51,040
Something interesting, particularly in DoD, is that all of the constellations and all of the satellites, most of them have completely unique ground systems.

296
00:32:51,040 --> 00:32:52,840
Now, DoD is moving away from that.

297
00:32:52,840 --> 00:32:55,900
They're having a common ground system going forward.

298
00:32:55,900 --> 00:32:57,940
But what that means is that they're all different.

299
00:32:57,940 --> 00:33:05,340
Now, the good news is, well, if you figured out an exploit in one, it wouldn't necessarily work on another one.

300
00:33:05,340 --> 00:33:15,120
But the flip side to that, from an enterprise IT management standpoint, is configuration management, patching, and so forth, is a nightmare.

301
00:33:15,160 --> 00:33:17,660
So, that is a real concern.

302
00:33:17,660 --> 00:33:21,160
And fortunately, it's being addressed in DoD.

303
00:33:21,540 --> 00:33:23,200
Edge computing.

304
00:33:23,200 --> 00:33:39,900
Well, the challenge there is, you know, I had talked a little earlier about how man-in-the-middle attacks are kind of hard on satellites, because real-time, you have to see the data stream and then figure out what you want to inject into it.

305
00:33:39,900 --> 00:33:45,240
Well, edge computing is becoming increasingly important.

306
00:33:45,240 --> 00:33:51,640
Now, I mentioned the fact that in the past, it's been minimized to do computations on board.

307
00:33:51,640 --> 00:34:01,040
There was really just enough code and just enough hardware to run the satellite, run its payload, and then communicate all the data to the ground.

308
00:34:01,080 --> 00:34:04,880
And that's, as I said, because it had weight implications.

309
00:34:04,920 --> 00:34:13,340
Well, with the advent of Moore's Law, satellites are becoming smaller and more efficient because their electronics are more efficient.

310
00:34:13,660 --> 00:34:25,780
So, one of the challenges in low-Earth orbit is, as you whiz around the Earth every 90 minutes, you really can only downlink your information when you happen to be within sight of a ground station.

311
00:34:25,780 --> 00:34:30,920
And any one ground station, you're only in sight of between 5 and 10 minutes.

312
00:34:31,020 --> 00:34:36,920
So, you could take a picture, but you might actually end up waiting a half an hour before you can downlink it.

313
00:34:37,120 --> 00:34:45,060
Well, that's actually a challenge if you've got very short periods of time to get a lot of data down.

314
00:34:45,100 --> 00:35:02,640
And so, increasingly, we're moving into a place where there's more and more computation moving on board and really getting high-quality edge computing so that you can do all the data management, and that minimizes the amount of information that you have to downlink.

315
00:35:02,640 --> 00:35:12,780
I'm just going to send you a notification that something has occurred, or I'll send you a highly processed picture of what you're most interested in instead of a giant data stream.

316
00:35:12,780 --> 00:35:18,080
Well , that is also going to make it a lot easier for man-in-the-middle attacks.

317
00:35:18,560 --> 00:35:25,620
Finally , the most serious problem I think we have in aerospace is complacency.

318
00:35:25,620 --> 00:35:32,860
As I said, many people in space think that their systems are not vulnerable to cyber.

319
00:35:33,080 --> 00:35:35,060
We have an attitude in aerospace.

320
00:35:35,060 --> 00:35:38,900
It's part of our culture and our values to think about safety.

321
00:35:38,900 --> 00:35:45,440
Safety is integral from design to test and verification and operations.

322
00:35:45,440 --> 00:35:47,500
We just think that way.

323
00:35:47,600 --> 00:36:02,160
We are going to have to figure out how to insert cybersecurity and an awareness of that into the values and the culture of aerospace, all the way from the beginning in design and all the way through to operations.

324
00:36:02,160 --> 00:36:05,660
I really think we are going to need to do that.

325
00:36:06,460 --> 00:36:11,320
Now, fortunately, there's some exciting work being done on cyber-physical systems.

326
00:36:11,320 --> 00:36:20,300
One of my favorite demonstrations was in the Information Innovation Office, or I2O, at DARPA when I was there.

327
00:36:20,580 --> 00:36:25,660
It's the DARPA High Assurance Cyber Military Systems Program, or HACMS.

328
00:36:25,660 --> 00:36:33,680
So the picture you see there is an optionally crewed helicopter called Little Bird, built by Boeing.

329
00:36:33,720 --> 00:36:40,360
Now, the HACMS program gave a group of hackers access to the flight data recorder.

330
00:36:40,400 --> 00:36:48,080
And within 30 minutes, they had hacked their way into critical systems on the Little Bird, which really surprised everyone.

331
00:36:48,560 --> 00:36:57,720
So the HACMS program funded several performers to develop security capability and a secure kernel.

332
00:36:57,760 --> 00:37:06,580
So I'm not a software person, but to me, a secure kernel is very much like the distributed architecture that I talked about for the shuttle and station.

333
00:37:06,580 --> 00:37:20,480
You have a separation of critical functions, and then you have a high level of restrictions about what information and checks that go on for information that flows in and out of that critical area.

334
00:37:20,480 --> 00:37:25,080
This secure kernel was loaded into Little Bird.

335
00:37:25,080 --> 00:37:34,680
Those same hackers were given access in the same way, and all they could do was shut down the flight data recorder, not very important, and point the camera.

336
00:37:34,680 --> 00:37:41,600
So it is possible to develop secure cyber physical systems.

337
00:37:41,780 --> 00:37:51,240
Now, the HACMS program is over, but the System Security Integrated Through Hardware and Firmware program, or SIF, is still active.

338
00:37:51,240 --> 00:38:12,500
And those of you who were at DEF CON last year may remember that DARPA, through the SIF program, brought a voting box, a voting computer, to DEF CON to work on the vulnerabilities and challenges of how to protect that hardware system from software exploits.

339
00:38:12,500 --> 00:38:14,040
So I have high hopes.

340
00:38:14,040 --> 00:38:16,560
There's a lot of really good work going on.

341
00:38:16,560 --> 00:38:24,080
I would like to see these best practices and these technologies proliferate into space.

342
00:38:25,440 --> 00:38:30,200
So a lot of interesting trends in space that are going to have an impact on this.

343
00:38:30,780 --> 00:38:39,900
Some of you may be familiar with some of these proliferated low-earth orbit, or PLEO, constellations like Starlink or OneWeb.

344
00:38:40,160 --> 00:38:45,560
Now, I talked about low-earth orbit and having to wait until you came over a ground station.

345
00:38:45,560 --> 00:39:04,480
Well, the idea here is to have enough satellites which are also connected through cross-links, through a mesh network, such that if one satellite takes a picture , it can send the information through the mesh network to another satellite that's over a ground station.

346
00:39:04,480 --> 00:39:14,100
And so this would greatly increase the persistence and, in fact, make data ubiquitous at any time.

347
00:39:14,100 --> 00:39:17,060
Now, there's some real challenges with mesh networking.

348
00:39:18,800 --> 00:39:23,840
So the Space Defense Agency is working on that right now.

349
00:39:23,980 --> 00:39:32,420
I think you're going to see a lot more of these cross-links and these mesh networks, which, of course, will increase the attack vectors as well.

350
00:39:33,920 --> 00:39:37,500
NASA's working on going to the Moon and on to Mars.

351
00:39:37,500 --> 00:39:45,920
Their Moon-to-Mars program is a program that, just like the Space Station, they've reached out to international partners.

352
00:39:45,920 --> 00:39:58,260
So far, Europe, Japan, Canada, and Australia have all expressed interest in joining in going to the Moon to prepare and develop the technologies that will allow us to go on to Mars.

353
00:39:58,300 --> 00:40:04,700
And there will be an orbiting logistics platform called Gateway in lunar orbit.

354
00:40:04,700 --> 00:40:19,630
And then, not too different from the International Space Station, a Moon village made up of different elements that different countries have doing whatever science they're most interested in, but having shared infrastructure.

355
00:40:21,900 --> 00:40:27,440
As we push out into the solar system, we're going to need a lot more logistics hubs.

356
00:40:27,440 --> 00:40:35,820
So the most efficient way to get from point A to point B in space is through careful transfers of orbits.

357
00:40:35,820 --> 00:40:38,640
Low Earth orbit to geosynchronous orbit.

358
00:40:38,640 --> 00:40:41,440
Geosynchronous orbit to lunar orbit.

359
00:40:41,440 --> 00:40:44,780
Geosynchronous orbit to Mars orbit.

360
00:40:44,780 --> 00:41:05,820
And you're going to see these logistics hubs that allow us to refuel or even build new satellites, store and supply logistics, and transfer not just data, but also goods and supplies out into the solar system.

361
00:41:06,540 --> 00:41:12,100
NASA's already thinking about solar system internet, but there's a big challenge with that.

362
00:41:12,620 --> 00:41:15,180
Communications is done through RF.

363
00:41:15,180 --> 00:41:19,500
And what that means is it's prone to blockouts and fading.

364
00:41:19,540 --> 00:41:30,360
Now, the way internet protocol works today is a packet that cannot show that it has connection all the way to its destination never gets sent.

365
00:41:30,420 --> 00:41:37,320
Well, you can't have that in space because you're going to have these blockages, this fading of signal periodically.

366
00:41:37,320 --> 00:41:46,060
So NASA has been working on delay-tolerant networking that allows data to be cached as it pushes out.

367
00:41:46,240 --> 00:41:51,020
And so that way, if there is a loss of signal, that's fine.

368
00:41:51,020 --> 00:41:59,440
It can tolerate microseconds up to seconds and then pass along the information once the network is re-established.

369
00:41:59,720 --> 00:42:03,000
Interestingly, this has implications as well.

370
00:42:03,040 --> 00:42:19,880
DARPA has also been working on it for disruption-tolerant networking, and that's more for emergencies, disasters, humanitarian disasters, and things like that where there's not a consistent capability for the internet.

371
00:42:19,880 --> 00:42:31,500
And so delay or disruption-tolerant networking is going to be incredibly important as we develop a solar system internet.

372
00:42:32,840 --> 00:42:42,260
So I just want to say how wonderful it is to be here, and thanks for inviting me to participate at the Aerospace Village.

373
00:42:42,260 --> 00:42:44,400
I'm very excited about HACCASAT.

374
00:42:44,400 --> 00:42:46,040
I think it's a really great idea.

375
00:42:46,040 --> 00:42:54,520
It's a way to get insight into what the actual vulnerabilities are, just like we did the demonstration for HACCAMS.

376
00:42:54,520 --> 00:43:01,020
But it's important to remember that the implications for space cybersecurity are huge.

377
00:43:01,020 --> 00:43:11,160
Even today, I talked about how much of our economy depends on GPS, weather, and so many other pieces of data that we get from space.

378
00:43:11,160 --> 00:43:16,000
But there are bigger implications as we build out a solar system internet.

379
00:43:16,000 --> 00:43:34,140
We're really going to have the opportunity to completely think this through again and go on to internet 2.0 technologies, like delay-tolerant networking, and build in security from the beginning, which is something that we didn't do with internet 1.0.

380
00:43:34,540 --> 00:43:46,520
So I'm hopeful that someone out there that's listening today will have some ideas about how to build a more secure internet for the solar system.

381
00:43:46,520 --> 00:43:49,000
And I'm just going to ask you to get cracking on that.

382
00:43:49,000 --> 00:43:50,080
Thank you.