KeySpace: Enhancing Public Key Infrastructure for Interplanetary Networks

1. Problem Statement

As satellite networks expand to include interplanetary communication (Earth, Moon, Mars), they face unique challenges that render traditional terrestrial Public Key Infrastructure (PKI) ineffective:

• High Latency and Intermittency: Communication links between planets are subject to long delays (minutes to hours) and frequent interruptions due to orbital mechanics and solar occlusion.
• Centralized Bottlenecks: Traditional PKI relies on low-latency queries to a central Certificate Authority (CA). In space, querying a single Earth-based CA for every connection or revocation is infeasible due to round-trip times and bandwidth constraints.
• Revocation Delays: If a key is compromised, the time required to propagate revocation information across interplanetary distances allows attackers to cause significant damage before the network is protected.
• Misconceptions: Existing literature often assumes space networks are too unpredictable for standard PKI, suggesting decentralized gossip protocols or Hierarchical Identity-Based Cryptography (HIBC) as alternatives. The authors argue these are unnecessary given the predictable nature of satellite orbits.

2. Methodology: The KeySpace Framework

To address these challenges, the authors developed KeySpace, the first experimental framework designed to standardize the evaluation of PKI systems in interplanetary environments.

• Simulation Environment: The framework utilizes the DSNS (Delay-Tolerant Network Simulator), extended to support specific PKI mechanisms.
• Network Topologies: Three distinct scenarios were simulated:
  1. Earth-Moon-Mars (EMM): A federated network with relay satellites connecting Earth, Moon, and Mars, featuring intermittent high-latency links.
  2. Earth Constellation: A control group using a continuous, well-connected Iridium-like constellation.
  3. Federation of CubeSats: A dynamic mesh network with short contact windows.
• Metrics: The framework evaluates PKI performance based on five core goals:
  • G1: Low Latency (minimizing handshake distance).
  • G2: Low Establishment Overhead (time difference between handshake and data transmission).
  • G3: Fast Revocation Coverage (speed of propagating key revocations).
  • G4: Resilience to Jamming (performance under link interference).
  • G5: Low Link Saturation (avoiding bandwidth congestion).
• Scenarios:
  • Connection Establishment: Measuring latency and overhead for two nodes to authenticate and connect.
  • Key Revocation: Measuring the time it takes for a revoked key to be recognized across the network, including under "weak" and "strong" jamming attacks.

3. Key Contributions

The paper makes three primary contributions:

A. Validation of Terrestrial PKI in Space

The authors challenge the consensus that terrestrial PKI is unsuitable for space. They demonstrate that standard protocols (OCSP and CRLs) can function effectively provided that Certificate Authorities are distributed throughout the network segments (e.g., a local CA on the Moon, one on Mars) rather than relying solely on a central Earth-based CA.

B. Novel Protocol Extensions

The authors propose and evaluate three specific modifications to standard OCSP to optimize for interplanetary constraints:

1. OCSP Hybrid: Uses standard OCSP Stapling for intra-segment traffic but switches to "in-transit" validation (where the relay CA validates the certificate while forwarding) for inter-segment traffic.
2. OCSP Parallel: Separates the message payload from the certificate validation. The payload is sent directly to the recipient, while a small validation query is sent via the CA. This reduces link congestion compared to sending the whole message through the CA.
3. Relay Firewall: A technique where relay nodes act as firewalls. Upon receiving a revocation update, relays scan incoming traffic and drop messages signed by revoked keys before they traverse long-distance links, significantly limiting an attacker's reach.

C. Standardized Evaluation Framework

KeySpace provides a repeatable, standardized set of experiments and metrics. This allows researchers and operators to empirically compare different PKI configurations and network topologies without the bias of custom simulation setups.

4. Key Results

The simulation results yielded several critical findings:

• Centralized vs. Distributed: Centralized PKI (single Earth CA) resulted in massive latency overheads and dropped messages in interplanetary scenarios. Distributed PKI reduced establishment overhead and latency to levels comparable to terrestrial networks.
• OCSP with Validators: While theoretically efficient, routing all traffic through a CA caused severe link saturation and congestion, degrading performance by an order of magnitude.
• Performance of Proposed Techniques:
  • OCSP Parallel combined with Relay Firewalls emerged as the optimal solution. It achieved the lowest establishment overhead (negligible compared to total latency) and significantly reduced link saturation.
  • Revocation Speed: The Relay Firewall technique drastically improved revocation coverage. By dropping malicious traffic at the relay, it prevented attackers from reaching distant segments while the revocation was still propagating. In "strongly attacked" scenarios, this reduced the time to protect victim segments from thousands of seconds to under 1,000 seconds.
• Jamming Resilience: Distributed systems with local CAs maintained performance even when specific relay links were jammed, whereas centralized systems failed completely.

5. Significance and Implications

• Feasibility of Interplanetary Internet: The paper proves that an "Interplanetary Internet" can rely on existing, standardized internet security protocols (X.509, OCSP) rather than requiring entirely new cryptographic primitives. This accelerates standardization efforts by bodies like CCSDS.
• Operational Guidance: It provides satellite operators with a data-driven method to select PKI configurations. For example, high-security applications might prioritize centralization despite latency, while general data traffic benefits from distributed, firewall-protected OCSP Parallel.
• Security Architecture: The introduction of the Relay Firewall concept offers a new paradigm for securing long-distance links, effectively creating a "kill switch" for compromised keys at the network edge (relays) before they can impact the wider network.
• Future-Proofing: By demonstrating that terrestrial PKI scales to space, the framework ensures that as satellite constellations grow, security architectures can evolve without needing a complete protocol overhaul.

In conclusion, KeySpace bridges the gap between terrestrial security standards and the harsh realities of space networking, proving that with proper distribution of authority and specific protocol optimizations, secure, low-latency interplanetary communication is achievable.