D3FEND^Space

Background

D3FEND was designed to model computers, devices, networks, and the information flows between them. As users applied it to cyber-physical systems, space emerged as a domain that needed a more explicit security model.

D3FEND for Space extends the core ontology with a security-oriented view of spacecraft, ground systems, and related components. It builds on D3FEND for OT while incorporating space-specific concepts and mappings to Aerospace's SPARTA framework.

Purpose and Scope

D3FEND for Space enables space engineers, security engineers, and cyber threat intelligence analysts to model space security scenarios using the D3FEND ontology.

The extension adds space-relevant artifacts, events, and countermeasures; models supporting concepts such as software-defined radios and watchdog timers; and maps SPARTA techniques to the D3FEND artifacts they target.

What it is:

An extension of the D3FEND ontology tailored to space domains, adding space-specific artifacts, events, and countermeasures.
A high-fidelity modeling framework for space engineers, defenders, and cyber threat intelligence analysts to represent systems, threats, and detections in CAD or SysML (please contact us to use D3FEND in SysML).
A bridge to existing space security resources, including mappings to Aerospace's SPARTA framework.

What it is not:

A separate or standalone ontology or framework that replaces core D3FEND.
A comprehensive or complete model of the space domain.
A compliance checklist, product catalog, or prescriptive configuration guide.

Design Philosophy

D3FEND for Space follows the core D3FEND approach: model attacks and defenses through precise artifacts, not broad subsystem labels.

Threat-model driven: SPARTA techniques are mapped to the D3FEND artifacts they target.
Artifact-first: Spacecraft components such as computers, flight software, radios, and sensors are modeled directly so users can represent their own systems.
Built on OT: Space concepts reuse and extend D3FEND's cyber-physical / OT model where appropriate, such as with d3f:SpacecraftComputer.

Intended Audience & Use Cases

D3FEND for Space supports several roles across engineering, analysis, and acquisition.

Role	Use Case
Space Defensive Cyber Engineer	Map ground and space system artifacts to weaknesses, attack paths, and defenses. Connect sensor-reported events to artifacts and likely attack types.
Space Cyber Threat Intelligence Analyst	Represent observed threats and incidents with concrete technical targets. Create space security analytical products grounded in the D3FEND ontology.
Space Systems Developer or Architect	Model software, hardware, bus, and data-flow relationships to identify attack surfaces. Use those models to guide more secure flight and ground software design.
Space Systems Acquisition Specialist	Compare cybersecurity properties of candidate space and ground products. Request D3FEND CAD models from vendors to support structured technical review.

Quick Start

Applying D3FEND for Space to your scenario requires foundational knowledge that is outside the scope of this page, which focuses on added space content and examples. Since D3FEND for Space was built on the foundation of D3FEND for OT, we recommend its quick start blog post as a useful primer.

Reviewing the CAD diagrams that the the D3FEND team has modeled, such as one of the satellite firmware modification attacks from J.Willbold's Space Odyssey paper, is another good way to understand what we've built.

Ontology Additions

The D3FEND team has added the following items to the D3FEND ontology to support D3FEND for Space.

51 Artifacts

D3FEND Entity Name	D3FEND Entity Description
Atomic Clock	An atomic clock is a clock that measures time by monitoring the resonant frequency of atoms.
Boot ROM	Boot ROM is a piece of read-only memory (ROM) that is used for booting a computer system.
Clock	A mechanism that generates periodic, accurately spaced signals for timekeeping applications.
Digital Signal Processing Application	A Digital Signal Processing (DSP) application is a software system that ingests discrete-time or discrete-space signals (from sensors, ADCs, or files) and applies digital signal processing algorithms to analyze, transform, synthesize, or make decisions about those signals, often under real-time throughput and latency constraints.
Electrical Signal	A guided signal in the form of a time-varying voltage or current propagating along an electrical conductor such as a wire, circuit-board trace, twisted pair, or coaxial cable.
Flight Software	Flight Software (FSW) is software that runs on a processor embedded in a spacecraft's avionics.
FPGA Bitstream	A binary configuration file generated by synthesizing and placing-and-routing an HDL design, which is loaded into a Field-Programmable Gate Array (FPGA) to physically define its internal logic, interconnects, and I/O behavior.
GNSS Receiver	A GNSS (Global Navigation Satellite System) receiver is an electronic device that picks up signals from one or more satellite constellations (like GPS, GLONASS, Galileo, BeiDou) to calculate precise location, velocity, and time.
GNSS Satellite	A GNSS satellite is part of a space-based constellation that transmits signals, allowing receivers on Earth to determine their position, navigation, and timing (PNT) through trilateration.
GNSS Signal	A GNSS (Global Navigation Satellite System) signal is a low-power radio signal broadcast from satellites that contains a carrier wave, a ranging code, and a navigation message.
GNSS Time Record	A GNSS Time Record is an information content entity encoded in a GNSS signal that represents the transmission time of that signal as determined by the transmitting satellite, expressed relative to a constellation-specific time standard and epoch.
Hardware Clock	A clock implemented using physical electronic components, typically providing timekeeping independent of system power or software state.
Hardware Clock Device Driver	A device driver for a hardware clock.
Hardware Device Configuration	Information used to configure the parameters and settings for hardware devices.
Hardware Timer	A hardware timer is defined as an electronic component that serves as an 8-bit or 16-bit counter, capable of measuring time intervals, generating timed outputs, and driving loads through mechanisms such as pulse width modulation (PWM).
Hardware Timer Device Driver	A device driver for a hardware timer.
Hardware Watchdog Timer	A hardware watchdog timer is a watchdog timer implemented using electronic components.
Operating System Clock	An operating system clock is the primary software clock maintained by the operating system, representing the system's current time.
Real-time Clock	A real-time clock (RTC) is an electronic device (most often in the form of an integrated circuit) that measures the passage of time.
Real-time operating system	A real-time operating system (RTOS) is an operating system (OS) for real-time computing applications that processes data and events that have critically defined time constraints.
Receiver	A receiver is a device or system that acquires signals and converts them into usable information.
Safe Mode	An intentionally constrained operating mode of a system in which nonessential functions are disabled or limited and control is shifted to a minimal, well-tested configuration that prioritizes preventing harm (to the system, its environment, or data), maintaining basic stability and monitoring, and enabling diagnosis and recovery back to normal operation.
Satellite	A satellite or an artificial satellite is an object, typically a spacecraft, placed into orbit around a celestial body.
Satellite Transponder	A communications satellite's transponder is the series of interconnected units that form a communications channel between the receiving and the transmitting antennas.
Signal	In electronics and telecommunications, signal refers to any time-varying voltage, current, or electromagnetic wave that carries information.
Software Clock	A clock implemented in software which may synchronize with hardware clocks or external time sources.
Software Timer	A timer implemented in software, typically managed by the operating system or application code.
Software Watchdog Timer	A software watchdog timer is a watchdog timer implemented in software.
Software-defined Radio	Software-defined radio (SDR) is a radio communication system where components that conventionally have been implemented in analog hardware (e.g. mixers, filters, amplifiers, modulators/demodulators, detectors, etc.) are instead implemented by means of software on a computer or embedded system.
Software-Defined Radio Computer	An embedded computer that includes a self-contained radio system, onboard compute (e.g., SoC/CPU/DSP/FPGA), and software/firmware sufficient to run waveforms and manage RF functions without requiring a continuously attached host PC.
Software-defined Radio Configuration	The physical radio hardware parameters used by a software-defined radio (SDR), including center frequency, bandwidth, gain settings, antenna selection, ADC/DAC sample rates, filter characteristics, power output, and others.
Software-Defined Radio Device	A hardware device that functions primarily as an RF front end plus data conversion and transport, relying on an external host computer to run most waveform/DSP processing and to control operation.
Software-defined Radio Waveform Application	A software implementation of a radio waveform that executes on the programmable processing elements of a software-defined radio and realizes the signal processing functions necessary to transmit and receive a specific radio signal.
Spacecraft	A spacecraft is a vehicle that is designed to fly and operate in outer space.
Spacecraft Computer	A vehicle computer installed on a spacecraft, executing real-time control or data-handling logic under spaceflight conditions (vacuum, radiation, extended communication latency) and communicating over buses such as MIL-STD-1553, SpaceWire, or CAN.
Spacecraft Safe Mode	Safe mode is an operating mode of a modern uncrewed spacecraft during which all non-essential systems are shut down and only essential functions such as thermal management, radio reception and attitude control are active.
System Time	In computing, system time represents a computer system's notion of a point in time.
Time Record	A time record either records, describes, represents, or is generally about Time.
Timer	A timer or countdown timer is a type of clock that starts from a specified time duration and stops upon reaching 00:00.
Transceiver	A transceiver is a device that contains both a transmitter and receiver.
Transmitter	A device or system that takes information and generates a signal suitable for propagation.
Transponder	In telecommunications, a transponder is a device that, upon receiving a signal, emits a different signal in response.
Vehicle	A vehicle is an electronically controlled machine designed for self-propulsion, usually to transport people, cargo, or both.
Vehicle Computer	An embedded computing system within a vehicle that monitors, controls, or supports vehicle functions by processing data, communicating with other components, and interacting with sensors, actuators, and external interfaces.
Vehicle Control Software	A specialized subset of vehicle software strictly responsible for the direct management of the vehicle's physical state, orientation, and safety-critical dynamics.
Vehicle Operating Mode	The current functional state or control regime of a vehicle that determines how it is configured, how its systems behave, and what kind of operation it is performing at a given time.
Vehicle Software	Any software residing on a vehicle's onboard compute platforms.
Watchdog Timer	A watchdog timer (WDT, or simply a watchdog) is an electronic or software timer that is used to detect and recover from computer malfunctions.
Wired Link	A physical link that uses a physical conductor or waveguide to constrain and direct signal propagation between endpoints.
Wireless Command	A wireless command is a remote command transmitted to a system over a non-wired medium.
Wireless Link	A physical link that transmits signals through free space or an unguided medium without physical connectors between endpoints.

3 Countermeasures

D3FEND Entity Name	D3FEND Entity Description
Bus Message Authentication	Applies cryptographic primitives to individual bus frames to verify the sender's identity and ensure the integrity of the data payload.
Electromagnetic Radiation Hardening	The application of physical and material-level design measures to electronic systems, components, or facilities to reduce their susceptibility to damage or disruption from electromagnetic threats.
Radiation Hardening	Radiation hardening is the process of making electronic components and circuits resistant to damage or malfunction caused by high levels of ionizing radiation.

24 Events

D3FEND Entity Name	D3FEND Entity Description
Clock Event	An event involving a clock artifact, characterized by changes to or readings from a timekeeping mechanism that maintains a representation of temporal progression.
Clock Synchronization Event	An event in which a software clock adjusts its value based on an external time reference (e.g., NTP server, GPS time signal).
Hardware Clock Event	A clock event involving a physical timekeeping mechanism implemented in hardware components.
Hardware Timer Configuration Event	An event in which a hardware timer's registers or operational parameters are programmed or modified.
Hardware Timer Event	A timer event involving a physical timer mechanism implemented in hardware components.
Hardware Timer Interrupt Event	An event in which a hardware timer generates an interrupt signal upon expiration or interval completion.
Power and Thermal Device Event	An event involving power supplies, batteries, or thermal management devices.
RTC Update Event	An event in which a Real-Time Clock's stored time value is read from or written to its battery-backed storage.
Software Clock Event	A clock event involving a software-based timekeeping mechanism maintained by an operating system or application.
Software Timer Event	A clock event involving a software-based timekeeping mechanism maintained by an operating system or application.
Software-defined Radio Event	An event involving a software-defined radio (SDR) device indicating that the SDR's lifecycle state, operational state, configuration, data-streaming status, timing/reference status, or fault condition has changed.
Software-defined Radio RF State Change Event	A software-defined radio (SDR) event where one or more radio-frequency (RF) parameters have been changed in a way that affects reception or emission (e.g., center frequency retune, gain/attenuation update, bandwidth/filter selection, antenna/port switch, TX enable/disable, etc).
Software-defined Radio Waveform Application Configuration Event	An SDR event where the waveform application's operational parameters have been applied and validated (e.g., sample rate, bandwidth, channel selection, framing/modulation options), placing the waveform in a state ready to run.
Software-defined Radio Waveform Application Load Event	An SDR event where a waveform application (software/firmware/FPGA image and associated descriptors) has been installed or selected on the SDR and is available to be configured.
System Clock Update Event	An event in which the operating system's primary timekeeping value is modified or synchronized.
Timer Event	An event involving a timer artifact, characterized by the initiation, expiration, modification, or cancellation of a countdown or interval-based temporal mechanism.
Timer Expiration Event	An event in which a software timer reaches its configured duration and triggers associated actions (callbacks, interrupts, or signals).
Timer Modification Event	An event in which the duration or expiration time of an active timer is changed.
Timer Set Event	An event in which a software timer is initialized with a specific duration or expiration time.
Watchdog Timer Configuration Event	An event in which a watchdog timer's timeout period or recovery action is configured.
Watchdog Timer Event	A watchdog timer event is any occurrence in which a watchdog timer is started, updated, reset, expired, or otherwise interacts with the system it monitors, resulting in a state change, status report, or corrective action intended to detect, signal, or recover from abnormal or stalled system behavior.
Watchdog Timer Expiration Event	An event indicating the watchdog timer was not serviced in time and triggers a reset or escalation action.
Watchdog Timer Reset Event	An event where a watchdog timer is reset as a consequence of watchdog timer expiry or watchdog timer escalation policy.
Watchdog Timer Service Event	An event in which the watchdog timer is serviced (kicked/pet), extending the time until expiry.

Common Space System Threats & Related Artifacts

These examples show how common space-system threats can be anchored to concrete D3FEND artifacts in a model.

Threat Vector	Examples	Related Artifacts
Supply Chain	Malicious flight software builds Firmware tampering Compromised COTS components	d3f:Firmware d3f:FlightSoftware d3f:SpacecraftComputer
RF and Physical Access	RF jamming or denial Signal spoofing Passive eavesdropping	d3f:WirelessLink d3f:Software-definedRadio
Software Modification	Flight software modification Bootloader or firmware replacement Unsafe on-orbit update	d3f:FlightSoftware d3f:BootLoader d3f:BootROM
Unauthorized Commanding	Malicious telecommanding Command path abuse	d3f:WirelessCommand d3f:Transmitter d3f:Transceiver d3f:Receiver

Example Space-focused D3FEND Graphs

Space Odyssey Firmware Attack

D3FEND for Space Overview

Satellite User Terminal Example

SPARTA IA-0002: Software Defined Radio

SPARTA EX-0014.04: Position, Navigation, and Timing (PNT) Spoofing

SPARTA EX-0001.02: Bus Traffic Replay

SPARTA EX-0016.01: Uplink Jamming

SPARTA IOB MIRE-5: Flight Software Memory Corruption

SPARTA IOB UACE-10: Processed Command Log Flooding

Aerospace SPARTA Integration

D3FEND for Space maps a subset of SPARTA techniques to D3FEND's ontology-defined artifacts, providing a mechanism for understanding the precise targets of these techniques along with potential defensive countermeasures.

Diagram of D3FEND for Space mappings to Aerospace SPARTA techniques and artifacts

Loading SPARTA technique artifact restrictions.

Acknowledgements

We'd like to thank the following organizations and people who contributed to the development of D3FEND for Space.

Brandon Bailey, Aerospace: for developing SPARTA and answering our numerous questions.
Space ISAC: for providing valuable insight on space CTI and giving us the opportunity to present and discuss our work with your community.
MITRE SMEs: for answering our questions and sanity checking our work.

D3FENDSpace