Europe's Missing Control Point in Orbit: Execution Finality for Satellites, Orbital AI, and Spacecraft Autonomy, with a Working Reference Gate for the EU Space Act Era
Year: 2026
Type: article
Abstract: Europe’s space ambitions increasingly run on software and autonomy: IRIS² secure connectivity, Galileo and Copernicus, commercial LEO and direct-to-device constellations, optical inter-satellite links, onboard AI for Earth observation, and the in-orbit servicing and collision-avoidance capabilities a sustainable orbit will require. These systems already authenticate telecommands, secure their links, verify software images, and recover from faults. But they check at reception or at decision time, while the consequence happens later, at a different component, under possibly different conditions. The consequence might be a thruster valve opening, a laser emitting, new firmware booting, an image being downlinked, or a bundle being forwarded across borders. In that gap, nothing needs to be forged: A manoeuvre authenticated an hour ago can fire after new conjunction data has made it dangerous. A compromised onboard planner can change the delta-v. A laser can be re-pointed at another spacecraft. A stored bundle can be released after the destination’s authority was revoked. Earth-observation imagery can be re-rendered at a resolution that was never approved for release. This disclosure specifies execution finality for satellites and non-terrestrial networks. It works in four steps: Every consequential operation is held non-effective. A protected domain binds the exact act into a single-use, non-bearer permit for one named onboard component. The binding includes current ephemeris, conjunction, policy and revocation epochs, budgets, a validity window that allows for clock uncertainty, and multiple independent approvals where needed. That component checks the act it is about to execute immediately before, or atomically with, the effect. Examples are the propulsion latch-valve driver, attitude-control gate, laser driver, bootloader, downlink encoder, bundle agent, or power switch. Out of contact, the spacecraft operates under explicitly limited authority rather than failing open, and emergency overrides are themselves counted and time-limited. Sixty enforcement profiles cover: sovereign downlink and beam-footprint control; orbital AI and Earth observation; radiation recovery; optical inter-satellite links; onboard RAN and delay-tolerant networking; emergency services; firmware and debug access; manoeuvres, collision avoidance, proximity operations and propulsion; hosted payloads; end-of-life passivation; commands that require approval from multiple independent authorities. The architecture is shown to be implementable, not only theoretical. A 130-line reference gate using SHA-256 and Ed25519 was tested against a conventional baseline (telecommand authenticated at reception): Measure Result Test vectors passed 23 of 23 Post-reception attacks blocked: reference gate 8 of 8 Post-reception attacks blocked: conventional baseline 0 of 8 Verification time per command, commodity CPU about 0.1 ms Verification time, two-authority approval about 0.2 ms Permit size 445 bytes Even pessimistic estimates for radiation-tolerant processors stay well inside spacecraft manoeuvre and contact-window timescales. Implementation routes use component classes Europe already builds and controls: FPGA command gates and actuator drive electronics; partitioned on-board computers and secure elements; optical terminals and payload data handling; DTN agents; the ground segment. For European operators and regulators, the result is a testable, auditable control point that sits inside the spacecraft, under the operator’s own control. It addresses the safety, collision-risk, cybersecurity, access-control, supply-chain and incident-handling objectives of the proposed EU Space Act, whatever final relationship with NIS2 emerges from the negotiations. It also supports European sovereignty over who may make a space asset act. It claims compliance with no instrument and complements, rather than replaces, telecommand authentication, link security, FDIR, 3GPP NTN, DTN and established mission-assurance practice. The reference implementation and test vectors are published with this record. Corrections and review are invited from ESA, EUSPA, national space agencies, European primes and NewSpace operators, standards bodies, and researchers. Keywords: EU Space Act; space cybersecurity; NIS2; IRIS²; satellite security; LEO; NTN; orbital AI; collision avoidance; space sustainability; optical inter-satellite links; delay-tolerant networking; telecommand security; spacecraft autonomy; in-orbit servicing; European digital sovereignty; execution finality; reference implementation
Author: Das, Sangam
Language: English
Subfield: Aerospace Engineering
Field: Engineering
Domain: Physical Sciences
Open Access status: green
OpenAlex ID: W7214217758