1. The command that had to be trusted
Andy Weir’s The Martian returns as the recalled work because Mark Watney’s survival depends on distinguishing real commands from corrupted or unintended ones. When Pathfinder’s firmware is hacked to extend communication, every subsequent command must be trusted because a single bad instruction could damage the only link home. The desktop’s command authentication test is the same discipline: know which commands are real and reject the rest.
This entry defines the command authentication and intrusion detection test matrix.
2. Test setup
The test uses a flight-representative command and control chain or a high-fidelity simulator with programmable ground station, radio link emulator, command generator, and flight software. Faults and attacks are injected at the radio link, ground station, command generator, and onboard bus. The platform is expected to authenticate commands, enforce policy, and detect anomalies for cases within the matrix. Command acceptance, rejection, policy result, anomaly alerts, and security logs are recorded continuously.
3. The test matrix
| Case | Scenario | Condition | Expected outcome |
|---|---|---|---|
| 1 | Valid command | Correct signature, fresh timestamp, in-policy | Command is accepted and executed. |
| 2 | Replay attack | Previously valid command retransmitted | Command is rejected due to duplicate timestamp or sequence counter. |
| 3 | Forged signature | Command with invalid signature | Command is rejected and logged as authentication failure. |
| 4 | Expired timestamp | Command outside accepted time window | Command is rejected as stale. |
| 5 | Revoked key | Command signed with a revoked ground-station key | Command is rejected and key revocation is logged. |
| 6 | Out-of-policy command | Valid signature but outside pre-approved window | Command is rejected by policy engine. |
| 7 | Missing multi-party authorization | Safety-critical command with only one signature | Command is rejected pending second authorization. |
| 8 | Anomalous rate | Commands arrive faster than operational baseline | Rate limit triggers; excess commands are buffered or rejected. |
| 9 | Anomalous command sequence | Commands in an order inconsistent with mission phase | Intrusion detection raises an alert. |
| 10 | Compromised subsystem | Payload computer issues propulsion command | Command is rejected due to least-privilege bus segregation. |
| 11 | Telemetry interception attempt | Unencrypted telemetry is requested or spoofed | Telemetry remains encrypted; event is logged. |
| 12 | Key rotation failure | New key fails to load before old key expires | Platform falls back to safe mode or last-known-good key. |
4. What is measured
For each case the test records:
- Whether the command was accepted, rejected, or quarantined.
- Detection time and classification accuracy.
- Whether the correct reason was logged.
- Whether ground received a coherent security event report.
- Whether the platform entered safe mode when required.
- Whether legitimate operations were unnecessarily blocked.
5. What this changes
- The command authentication and intrusion detection test has a concrete matrix.
- The matrix links back to the cybersecurity reading and autonomous trust boundaries arcs.
- The next entry will define pass and fail criteria.