1. When the station must guard its own airlock

Stanisław Lem’s Solaris returns as the recalled work because the station must decide what to let in and what to keep out while cut off from help. The desktop’s command authentication system is its airlock: it must open for legitimate operators and seal against everything else, even when the difference is subtle.

This entry defines success and failure for the command authentication and intrusion detection test.

2. Minimum success

The test passes if:

  • Valid commands with correct signatures, freshness, and policy compliance are accepted and executed.
  • Replay attacks are rejected by sequence counters, timestamps, or nonces.
  • Commands with invalid signatures are rejected and logged.
  • Commands signed with expired or revoked keys are rejected.
  • Out-of-policy commands are rejected by the policy engine even if correctly signed.
  • Safety-critical commands require multi-party or hardware-backed authorization.
  • Anomalous command rates or sequences trigger intrusion detection alerts.
  • Commands from unauthorized subsystems are rejected due to least privilege and bus segregation.
  • Security events are logged and reported to ground.

This minimum says the desktop’s command boundary can absorb common cyber threats.

3. Full success

A stronger result would add:

  • Rejected commands are quarantined for forensic analysis rather than silently dropped.
  • Intrusion detection distinguishes operational anomalies from malicious activity with low false-positive rate.
  • Key compromise triggers automatic revocation and fallback to emergency procedures.
  • The platform continues nominal operations during low-severity attacks without ground intervention.
  • Security event logs are tamper-resistant and survive safe-mode transitions.
  • Fault injection results match predictions from cybersecurity analysis.

This stronger result supports a claim that the desktop’s command architecture is robust enough for extended autonomous operation.

4. Failure modes

The test fails if any of the following occur:

  • A replayed command is accepted and executed.
  • A forged or unsigned command is accepted.
  • A command signed with a revoked key is accepted.
  • An out-of-policy safety-critical command is executed.
  • A safety-critical command executes without required multi-party authorization.
  • A compromised subsystem can command another subsystem outside its privilege.
  • Anomalous command patterns go undetected.
  • Security events are not logged or are incomprehensible to ground.

Each failure mode points to a fix in cryptographic implementation, policy engine, key management, bus segregation, or logging.

5. What this changes

  • The command authentication and intrusion detection test has clear pass and fail criteria.
  • The criteria separate correct acceptance from correct rejection and from detection and reporting.
  • The next entry will close the test arc.