xOrbit: Satellite Ground Segment Security

Executive Summary

xOrbit splits satellite commands and telemetry across independent ground stations using XorIDA threshold sharing, authenticated by xLink DIDs, with unconditionally-secure key transport via xChange. No single compromised station can command the satellite.

Four production modules cover the full ground segment lifecycle: command.ts (~494 LOC) issues digitally-signed commands and splits them K-of-N. telemetry.ts (~323 LOC) protects downlinks with per-share HMAC. orbit.ts (~331 LOC) performs verified orbit calculations with xProve integration. coordination.ts (~401 LOC) manages ground station identity, acquisition windows, and threshold authorization.

Result-based error handling with 32 structured codes. HMAC verification before reconstruction ensures integrity. XorIDA splits in ~5ms, reconstructs in ~3ms. All operations are quantum-secure by construction — XorIDA is information-theoretically unconditional.

Developer Experience

xOrbit provides structured error codes, actionable error hints, and optional progress callbacks for debugging and monitoring satellite operations.

Error Codes & Structure

All operations return Result<T, E> with detailed error information: code, message, hint, field attribution, and documentation URL. No thrown exceptions in library code.

The Problem

The 2022 Viasat KA-SAT attack demonstrated that a single compromised ground station can disable thousands of satellite terminals. Pre-shared commanding keys are a single point of failure.

Current satellite commanding uses shared keys. All ground stations hold the same commanding key. One station compromise = full constellation access.

Ground stations are geographically dispersed and physically hard to secure. Adversaries can target specific stations, inject malicious commands, or intercept telemetry.

No individual station has commanding authority. But current systems lack threshold-based authorization. Destructive commands (de-orbit, payload release) require multi-station approval.

The Old Way

The New Way

Real-World Use Cases

Four scenarios where xOrbit prevents single-point-of-failure ground segment compromises.

Solution Architecture

Four composable modules orchestrating authenticated, threshold-based satellite operations.

Core Properties

All modules use XorIDA threshold sharing over GF(2) with HMAC-SHA256 integrity before reconstruction. No computational assumptions — information-theoretically unconditional. Result-based error handling with 32 structured codes. Gold Standard Bronze certified.

Integration & API

import {
  issueCommand,
  splitCommand,
  reconstructCommand,
} from '@private.me/xorbit';

// Ground station issues a command
const cmd = await issueCommand(
  {
    commandType: 'attitude-adjustment',
    satelliteId: 'sat-leo-001',
    issuerId: 'ground-station-a',
    payload: new Uint8Array([...]),
    expiresAt: Date.now() + 3600000,
  },
  signingFn,
);

// Split into 3 shares, require 2 to reconstruct
const split = splitCommand(cmd.value, {
  n: 3,
  k: 2,
});

// Satellite reconstructs from K shares
const reconstructed = reconstructCommand({
  shares: [share0, share1],
  n: split.value.n,
  k: split.value.k,
});

Security & Threat Model

Implementation Details

• 103+ comprehensive tests — Command, telemetry, orbit, coordination, and abuse test suites
• Gold Standard Bronze certified — SECURITY.md, threat-model.md, failure-modes.md
• Result<T,E> error handling — No exceptions, structured 32 error codes with hints
• HMAC before reconstruction — Always validate integrity before decoding XorIDA shares

Performance Benchmarks

All measurements on Node.js 22.x on standard infrastructure. Split/reconstruct scales linearly with share count (typical 3-10 shares).

Honest Limitations

Command Payload Size

Maximum 4 KB per command. Larger payloads require multi-part transmission (not yet implemented). Typical satellite commanding is <1 KB.

Threshold Configuration

Typical deployment is 3-5 stations with K=2 or K=3 threshold. Larger N increases latency and bandwidth. No practical limit beyond constellation size.

Ground Station Availability

Requires K stations online to reconstruct. If <K stations are available during acquisition window, commands are queued. Satellite cannot command itself.

Real-Time Constraints

Orbit calculations are <1ms, command reconstruction ~3ms. Not suitable for millisecond-scale control loops. Designed for command/telemetry on 1-60 second timescales.

Error Codes (32 total)

All operations return structured errors with actionable hints and documentation links.

Command errors (6): INVALID_SIGNATURE, EXPIRED_COMMAND, PAYLOAD_TOO_LARGE, INVALID_COMMAND_TYPE, MALFORMED_COMMAND, UNKNOWN_SATELLITE

Split/Reconstruct errors (8): HMAC_VERIFICATION_FAILED, INSUFFICIENT_SHARES, XORIDA_ERROR, INVALID_SHARE_INDEX, CORRUPTED_SHARE, DUPLICATE_SHARE, OUT_OF_RANGE_INDEX, RECONSTRUCTION_FAILED

Telemetry errors (6): TELEMETRY_PAYLOAD_TOO_LARGE, TELEMETRY_DOWNLINK_FAILED, INVALID_DOWNLINK_FORMAT, TELEMETRY_PARSE_ERROR, RECONSTRUCTION_TIMEOUT, FRAME_DROPPED

Orbit errors (6): INVALID_SEMI_MAJOR_AXIS, INVALID_ECCENTRICITY, INVALID_INCLINATION, OUT_OF_RANGE_PARAMETERS, XPROVE_VERIFICATION_FAILED, ORBITAL_CALCULATION_ERROR

Coordination errors (6): GROUND_STATION_NOT_FOUND, INVALID_ACQUISITION_WINDOW, STATION_NOT_AUTHENTICATED, UNAUTHORIZED_COMMAND, THRESHOLD_NOT_MET, SIGNATURE_VERIFICATION_FAILED

Module Architecture

packages/xorbit/
├── src/
│   ├── command.ts          // ~494 LOC
│   ├── telemetry.ts        // ~323 LOC
│   ├── orbit.ts            // ~331 LOC
│   ├── coordination.ts      // ~401 LOC
│   ├── types.ts            // ~291 LOC
│   ├── errors.ts           // ~430 LOC
│   ├── index.ts            // Barrel exports
│   └── __tests__/          // 103+ tests
├── docs/
│   ├── threat-model.md
│   └── failure-modes.md
└── SECURITY.md

Key design principle: All modules compose through Result<T, E>. XorIDA operations always validate HMAC before reconstruction. No state beyond request handling.

Technical Specifications

Operational Limits

• Command payload: Maximum 4 KB per command
• Telemetry frame: Maximum 16 KB per downlink
• Share count: Typical 3-10 shares, configurable K-of-N
• Semi-major axis: 6,571-42,371 km (200-36,000 km altitude)
• Eccentricity: 0-1 (circular to hyperbolic)
• Inclination: 0-180° (equatorial to retrograde)
• Command expiry: Default 1 hour, configurable
• Share distribution: Independent encrypted channels, HTTPS or custom adapter

Cryptographic Algorithms

• Threshold sharing: XorIDA over GF(2), information-theoretically unconditional
• Integrity: HMAC-SHA256 per-share before reconstruction
• Signatures: ED25519 for command authentication
• Key transport: xChange unconditionally-secure (no KEM)
• Verifiable proofs: xProve zero-knowledge proofs on orbits

Ready to deploy xOrbit?

Talk to Sol, our AI platform engineer, or book a live demo with our team.