1. CCSDS Security Working Group Spring 2014 Meeting 31 March – 1 April 2014 Noordwijkerhout, The Netherlands Charles Sheehe NASA/Glenn

2. Hosted Payloads / Disaggregated functions, Spacecraft's Security Risks Charles Sheehe

3. Objective of the risks discussion To recommend that the threat book be updated with the threats to these emergent threats and technologies. To recommend that a Green Book developed to provide guidance to the users of the emergent technologies.

4. Back Ground

5. Hosted items may become corrupted affecting the host. Disaggregated functions may become corrupted and infecting other functions. Distributed functions between crafts/payloads may propagate failures or viruses. What are the risks

6. Threats

7. Weakest link In distributed systems and functions the weakest function or system is the benchmark for the entire system Multiple platforms, supplied by different vendors, complicate the process of implementing different security policies, and in the absence of standards, proprietary security applications do not interoperate. The result is uneven, uncertain security.

8. CCSDS Relevance

9. Recovery Audit trails in a distributed computing environment are at best difficult.

10. WHAT IS DISTRIBUTED PROCESSING In security terms, one might think of distributed processing as dispersing where and how decisions are made. If all decisions are made at a single central location, that is central processing. If decisions are independently made at multiple locations, that is distributed processing.

11. Distributed Trust Trust is essentially the establishment of trust by interpreting policies to validate credentials

12. Trust Management How should proof of compliance shown? Should polices and credentials be partially or fully programmable? How are responsibilities be managed between the calling application and the trust engine?

13. BACK UP

14. Trust management approach, In order to protect sensitive parameters (i.e. attributes) in trust instances, trust instances should be encrypted and cryptographic protocols such as SSL/TLS should be employed to ensure sensitive trust instances are only exposed to the intended parties. Trust negotiation protocol / negotiation framework be a fully policy-driven approach, where each principal may define its own meta- policies that control the protocol behavior, which gives an increased flexibility.

15. References The Role of Trust Management in distributed System Security; Matt Blaze, Joan Feigenbaum, John Ioannidis and Angelos D. Keromytis http://www.crypto.com/papers/trustmgt.pdfhttp://www.crypto.com/papers/trustmgt.pdf Moving from Security to Distributed Trust in Ubiquitous Computing Environments; Lalana Kagal, Tim Finin and Anupam Joshi. Trust management for widely distributed systems; Walt Yao https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-608.pdf https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-608.pdf mse corporate security http://www.msecorp.net/Distributed_Processing. html http://www.msecorp.net/Distributed_Processing. html