Space Fabric: A Satellite-Enhanced Trusted Execution Architecture

• URL: http://arxiv.org/abs/2603.23745v1
• Date: Tue, 24 Mar 2026 22:13:02 GMT
• Title: Space Fabric: A Satellite-Enhanced Trusted Execution Architecture
• Abstract summary: Decentralized satellite networks create a pressing need for trust architectures that operate without physical access to hardware.<n>We present Space Fabric, an architecture that relocates the trusted computing stack to satellite infrastructure.<n>All cryptographic secrets are generated within co-located secure elements after launch, with no signing keys accessible on Earth at any point.
• Score: 1.9116784879310027
• License: http://creativecommons.org/licenses/by-nc-sa/4.0/
• Abstract: The emergence of decentralized satellite networks creates a pressing need for trust architectures that operate without physical access to hardware, without pre-provisioned vendor secrets, and without dependence on a single manufacturer's attestation service. Terrestrial TEEs are insufficient: hardware-based designs are susceptible to physical attacks, and most platforms root their attestation chains in secrets provisioned during manufacturing, creating a pre-launch trust window and single-vendor dependency that cannot be independently audited. We present Space Fabric, an architecture that provides the missing trust foundation for orbital computing by relocating the trusted computing stack to satellite infrastructure, exploiting post-launch physical inaccessibility as a tamper barrier unattainable by terrestrial deployments. Our Satellite Execution Assurance Protocol binds workload execution to a specific satellite via a Byzantine-tolerant endorsement quorum of distributed ground stations, certifying not only \emph{what} executes inside the TEE but also \emph{where}. All cryptographic secrets are generated within co-located secure elements after launch, with no signing keys accessible on Earth at any point. To reduce single-vendor dependence, Space Fabric distributes its trust anchor across two independent secure elements, an NXP SE050 and a TROPIC01, both of which must co-sign attestation evidence. We implement Space Fabric on a USB Armory Mk II with ARM TrustZone, verify attestation end-to-end using Veraison, and provide a security analysis with satisfaction arguments and impossibility bounds under a strong adaptive adversary.

Related papers

• Toward Space-Based Public Key Systems: Enabling Secure Space Communications through In-Orbit Trust Services [0.3823356975862005]
  The New Space era has led to a rapid increase in satellites operated by independent entities in near-Earth orbit.<n>Traditional ground-dependent Public Key Infrastructure (PKI) suffers from latency and operational bottlenecks.<n>This paper proposes architectural designs for space-based PKI that shift certificate management and validation from ground infrastructure into space.
  arXiv  Detail & Related papers  (2026-05-07T09:57:35Z)
• When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI [6.1511441479993225]
  Agentic AI systems that plan, invoke tools, maintain persistent memory, and delegate tasks to peer agents introduce a threat surface that differs materially from standalone model inference.<n> Confidential computing offers a hardware-rooted alternative: Trusted Execution Environments (TEEs) isolate agent code and data from privileged system software.<n>This survey synthesizes the design space in four parts: (i) a unified taxonomy of six TEE platforms covering deployment roles and performance tradeoffs; (ii) an agent-centric threat model spanning perception, planning, memory, action, and coordination layers mapped to nine security goals; (iii) a comparative survey of CC
  arXiv  Detail & Related papers  (2026-05-04T23:09:16Z)
• Systems-Level Attack Surface of Edge Agent Deployments on IoT [5.081228499547384]
  We present an empirical security analysis of three architectures (cloud-hosted, edge-local, and hybrid)<n>We identify five systems-level attack surfaces, including two emergent failures observed during live testbed operation.<n>Results demonstrate that deployment architecture, not just model or prompt design, is a primary determinant of security risk in agent-controlled IoT systems.
  arXiv  Detail & Related papers  (2026-02-26T01:48:46Z)
• Zero Trust for Multi-RAT IoT: Trust Boundary Management in Heterogeneous Wireless Network Environments [0.0]
  Multi-Radio Access Technology, Internet of Things devices, particularly Unmanned Aerial Vehicles, creates a fundamental and hitherto unexamined challenge for Zero Trust Architecture adoption.<n>Current ZTA frameworks assume relatively stable network environments and do not address the trust implications of frequent, dynamic RAT switching in mobile IoT deployments.
  arXiv  Detail & Related papers  (2026-02-09T18:36:05Z)
• Multi-Agent-Driven Cognitive Secure Communications in Satellite-Terrestrial Networks [58.70163955407538]
  Malicious eavesdroppers pose a serious threat to private information via satellite-terrestrial networks (STNs)<n>We propose a cognitive secure communication framework driven by multiple agents that coordinates spectrum scheduling and protection through real-time sensing.<n>We exploit generative adversarial networks to produce adversarial matrices, and employ learning-aided power control to set real and adversarial signal powers for protection layer.
  arXiv  Detail & Related papers  (2026-01-06T10:30:41Z)
• Zero-Trust Foundation Models: A New Paradigm for Secure and Collaborative Artificial Intelligence for Internet of Things [61.43014629640404]
  Zero-Trust Foundation Models (ZTFMs) embed zero-trust security principles into the lifecycle of foundation models (FMs) for Internet of Things (IoT) systems.<n>ZTFMs can enable secure, privacy-preserving AI across distributed, heterogeneous, and potentially adversarial IoT environments.
  arXiv  Detail & Related papers  (2025-05-26T06:44:31Z)
• Research Directions for Verifiable Crypto-Physically Secure TEEs [0.0]
  Web3 applications have to rely on cloud infrastruture to act as trusted guardians of hardware-based TEEs. This work aims at exploring how we could potentially architect and implement chips that would be secure against physical attacks.
  arXiv  Detail & Related papers  (2024-10-04T06:47:14Z)
• HasTEE+ : Confidential Cloud Computing and Analytics with Haskell [50.994023665559496]
  Confidential computing enables the protection of confidential code and data in a co-tenanted cloud deployment using specialized hardware isolation units called Trusted Execution Environments (TEEs) TEEs offer low-level C/C++-based toolchains that are susceptible to inherent memory safety vulnerabilities and lack language constructs to monitor explicit and implicit information-flow leaks. We address the above with HasTEE+, a domain-specific language (cla) embedded in Haskell that enables programming TEEs in a high-level language with strong type-safety.
  arXiv  Detail & Related papers  (2024-01-17T00:56:23Z)
• Tamper-Evident Pairing [55.2480439325792]
  Tamper-Evident Pairing (TEP) is an improvement of the Push-Button configuration (PBC) standard. TEP relies on the Tamper-Evident Announcement (TEA), which guarantees that an adversary can neither tamper a transmitted message without being detected, nor hide the fact that the message has been sent. This paper provides a comprehensive overview of the TEP protocol, including all information needed to understand how it works.
  arXiv  Detail & Related papers  (2023-11-24T18:54:00Z)
• Putting a Padlock on Lambda -- Integrating vTPMs into AWS Firecracker [49.1574468325115]
  Software services place implicit trust in the cloud provider, without an explicit trust relationship. There is currently no cloud provider that exposes Trusted Platform Module capabilities. We improve trust by integrating a virtual TPM device into the Firecracker, originally developed by Amazon Web Services.
  arXiv  Detail & Related papers  (2023-10-05T13:13:55Z)
• SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices [67.65883495888258]
  We present SyzTrust, the first state-aware fuzzing framework for vetting the security of resource-limited Trusted OSes. SyzTrust adopts a hardware-assisted framework to enable fuzzing Trusted OSes directly on IoT devices. We evaluate SyzTrust on Trusted OSes from three major vendors: Samsung, Tsinglink Cloud, and Ali Cloud.
  arXiv  Detail & Related papers  (2023-09-26T08:11:38Z)
• Building Your Own Trusted Execution Environments Using FPGA [16.206300249987354]
  BYOTee (Build Your Own Trusted Execution Environments) is an easy-to-use infrastructure for building multiple equally secure enclaves. BYOTee creates enclaves with customized hardware TCBs, which include softcore CPUs, block RAMs, and peripheral connections, in FPGA on demand.
  arXiv  Detail & Related papers  (2022-03-08T17:22:52Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.