PAGE CONTENTS
Objectives
The objective of the activity is to develop and test a prototype of an on-board Software Defined Networking (SDN) module that includes security aspects such as secure interface following a ‘defence-in-depth’ approach, network segmentation, traffic segregation and resource isolation between services with different security requirements. Currently, on-board SDN technology can provide simple prioritisation between different services based on flags encoded in data packets. This approach limits the resource segregation and does not provide security redundancy, if the security checks done at payload level are compromised, the entire SDN becomes vulnerable. This poses potential security issues when the satellite needs to serve users with different security requirements and different levels of Quality of Service.
DOMI is addressing that issue by turning the SDN module itself into a security boundary (“defence-in-depth”), which means that even if one layer fails (payload security, ground network security), the SDN module shall remain resistant. The SDN module itself must enforce security for its interfaces to ground controllers (and other interfaces leading to the module), rather than assuming upstream/payload checks are sufficient. The module’s interface therefore enforces that only authorized controllers can create/modify a slice, controllers can only act inside their scope, all actions are authenticated, integrity-protected, logged.
Benefits
The targeted improvements are the following:
- Evaluating the technology required to enable secure SDN onboard infrastructure sharing between governmental and commercial services.
- Adding the following security features to on-board SDN technology: secure interface, network segmentation, traffic segregation, resource isolation between services and network slicing.
Features
DOMI provides the following features:
- The Implementation of a high-speed onboard SDN switch.
- The classification of the traffic going through the module into Traffic Classes by configurable matching tables.
- The enforcement of security policies to ensure only permitted traffic from the classification can flow through while isolating the resources of the different classes to ensure the quality of service.
Challenges
The key challenge tackled by the project is the combination of a high-performance need to a strict security enforcing network module.
System Architecture
The module is split between a control and a data plane. The SDN controller runs on an embedded system utilising the onboard processor to manage and monitor the switch module. Access to management functions is authenticated and authorised to protect the module against tempering, and telemetry of relevant network metrics and module health are transmitted back for monitoring. Traffic flows through the data plane under the rules set by the controller, unable to affect the security configuration directly. Packets are forwarded through a chain of evaluation process to determine if they should be discarded or not (by passing the sanity check and matching a Traffic Class rule entry) and where to be forwarded to (egress routing and priority drop on traffic overflow).
Plan
The project is split in 6 milestones, with a final presentation at T0+12:
- Technical specifications definition: Define a complete and traceable set of technical requirements.
- Technical Baseline selection: Select the technical baseline that offers the best potential to achieve the objectives.
- Verified detailed design: Establish a design and demonstrate that it can satisfy the technical requirements.
- Implementation and Verification Plan: Successfully implement and test the prototype.
- Verified Deliverable Items and Compliance Statement: Quantify the performance through a test campaign and demonstrate compliance to the requirements.
- Technology Assessment and Development Plan: Perform a critical assessment of the potential of the developed items.
Current Status
The project has started following the Kick-Off Meeting on the 29th of June 2026. All contractors have met and are currently working on consolidating the onboard SDN module control and data plane architecture, evaluating solutions to meet the required level of formal verification and performance for the testbenches, formalizing the security boundary definition and architecture into requirements to meet a Common Criteria certifiability of EAL4.
Related Links
Companies
