O SlideShare utiliza cookies para otimizar a funcionalidade e o desempenho do site, assim como para apresentar publicidade mais relevante aos nossos usuários. Se você continuar a navegar o site, você aceita o uso de cookies. Leia nosso Contrato do Usuário e nossa Política de Privacidade.
O SlideShare utiliza cookies para otimizar a funcionalidade e o desempenho do site, assim como para apresentar publicidade mais relevante aos nossos usuários. Se você continuar a utilizar o site, você aceita o uso de cookies. Leia nossa Política de Privacidade e nosso Contrato do Usuário para obter mais detalhes.
• In the past year we heard a lot about hostile takeover
attempt of satellites, especially US satellites.
• The presentation will explain what are the building blocks
of satellites command channel, identifying the weak links
in the chain.
Since Satellites are very (very) far away, the only way to get
hold of one is via the remote command channel
• The presentation will address only command and control
channels and not hostile takeover of payload such as pirate
What does a satellite Command System do ?
Very specific and predefined things!
• Reconfigures satellite or subsystems in response to radio
signals from the ground.
• Different Command timing
– Priority driven (ASAP)
• Batched (sequenced) Commands
• Power on/off subsystems
• Change subsystem operating modes
• Control spacecraft guidance and
• Deploy booms, antennas, solar cell
arrays, protective covers
• Upload computer programs
Command System RF Performance
You need professional equipment!
– S-band (1.6 – 2.2 GHz)
– C-band (5.9 – 6.5 GHz)
– Ku-band (14.0 – 14.5 GHz)
• BER = 10-6
• Typical transmission power: 50-100 Watt (based on
large diameter antennas)
• Typical transmission rate: up to 8 Kbit/sec
High speed tracking antennas are required
Command System Block Diagram - Ground
Very specific and predefined actions (in the SW)
• GSE operator selects command mnemonic
• Software creates command message in appropriate format
and encodes it
• Sequence (Batch) commands/macros
• Signal Modulation: Pulse code modulation (PCM), Phase
shift keying (PSK), Frequency shift keying (FSK)
Command System Block Diagram - Space
Not “launch and forget” simple system
• Decoders reproduce command
messages and produce lock/enable
and clock signals.
• Command logic validates the
– Default is to reject if any uncertainty of
– Drives appropriate interface circuitry
Data checked and packaged in “envelopes”
Overall structure of a command
Command Messages Fields
• Spacecraft address (unique identifier)
• Source ID
• Command type
• Error detection and correction
• Multiple commands
AMOS-3 Satellite, 4ºW
Command Logic Verification Process
• Receiver level Validation
– Encryption (commercial such as CARIBOU)
– Command destination
• Software level Validation
Several Data check Levels
RF Transmission equipment
Knowledge of command frequencies.
Knowledge of Encryption key(s)
Knowledge of Authentication key(s)
Knowledge of Satellite ID
Knowledge of source (Ground Facility) ID
Knowledge of commands dictionary
Is that it ? Not yet…
• RF receiving equipment
• Decoded Telemetry
– To generate correct addressing (destination) of the fake
– To generate correct timing (numbering) of the fake command
– To generate correct context of the fake command
• Is it hard to jam or block a command channel ? Not really
– Simple hardware, relevantly low power
• Commercial Encryption is not good enough
– Is it ? What do banks use for transactions ? What do 7.5 Million
PayPal transaction every evening use ?
• It will be no problem to hack into GCS computers
– If you’re a smart operator, the GCS network is an isolated one
without connections to the outside world
• Easiest Method is……
Inside job !!