1. When the intruder looks like a legitimate user

Clifford Stoll’s The Cuckoo’s Egg returns as the recalled work because its attacker moves through systems by exploiting weak authentication and poor logging. A spacecraft command link is a smaller stage but the same script: if the platform cannot verify who is sending a command and whether that command is appropriate, an adversary can borrow the identity of a legitimate operator.

This entry explains why the command authentication and intrusion detection test matters.

2. Why command authentication needs its own test

The cybersecurity reading arc established that the desktop should use authenticated, replay-resistant command links with power-efficient cryptography. The autonomous trust boundaries arc decided that the platform should execute maneuvers only within pre-approved, signed policy windows. Both are design claims. The command authentication and intrusion detection test is the experiment that validates them.

Without this test, the desktop might discover these problems only after launch:

  • A command with a valid signature but an expired timestamp is accepted because freshness checks are missing.
  • A replayed collision-avoidance maneuver is executed because sequence counters are not checked.
  • A command signed by a revoked ground-station key is accepted because revocation lists are stale.
  • A legitimate but out-of-policy command is executed because the policy engine is bypassed.
  • An anomalous command pattern goes unnoticed because there is no intrusion detection.

3. The failures that only appear when commands are attacked

Command authentication testing exposes behaviors that do not appear in nominal testing:

  • The platform accepts a forged command during a contact window because the radio driver does not pass authentication failures to the flight computer.
  • A software update is accepted from an intermediate key that has been rotated out.
  • A safe-mode command is rejected during an emergency because the multi-signature requirement is too strict.
  • Intrusion detection raises an alert but the alert itself is dropped due to telemetry scheduling.
  • A compromised payload computer issues commands to the propulsion subsystem because bus segregation is incomplete.

4. What this test must cover

The command authentication and intrusion detection test must exercise:

  • Valid commands with correct signatures, freshness, and policy compliance.
  • Replay attacks using previously recorded commands.
  • Forged commands with invalid signatures.
  • Commands signed with expired, revoked, or unauthorized keys.
  • Out-of-policy commands with valid signatures.
  • Anomalous command patterns and rates.
  • Compromised subsystem behavior and lateral movement attempts.
  • Logging and reporting of security events.

The goal is to prove that the platform accepts only authorized commands and notices when something is wrong.

5. What this changes

  • Command authentication and intrusion detection testing is identified as the next qualification step for the desktop.
  • The test must verify rejection of bad commands as well as acceptance of good ones.
  • The next entry will define the test matrix.