Every chunk verifiable
Payloads are split into chunks, each fingerprinted against one signed root, so chunks verify on arrival even out of order. A single flipped byte is rejected.
Delay-tolerant networking · data custody
Prove where space data has been, and who carried it.
As missions relay data through commercial orbiters and ground networks, every hand-off raises the same questions: did it arrive intact, who held it, and what happened during the blackout? DTN Custody answers all three with records anyone can verify.
Custody at every hop
Each relay signs a receipt as data passes through. The chain shows exactly who held it, and a forged, missing or reordered hop is caught with a specific reason.
Blackouts on the record
A link outage becomes a signed gap record with a start, an end and the bundles it delayed, instead of an unexplained silence.
Delivery tied to payment
Delivery is bound to the payment the customer actually made, and the payload's root can be anchored on a public ledger as permanent proof.
Proven on real systems
- Four open DTN stacks. The same custody records pass end to end on NASA HDTN, JPL ION, D3TN’s µD3TN and Aalyria’s Hardy, and across a mixed chain (µD3TN to HDTN to µD3TN). In each run the network held our data through a scheduled outage and every chunk and custody hand-off verified on arrival (results).
- Moon and Mars light time. Run with the true 1.3-second Earth–Moon delay and a blackout part-way through, and over JPL ION’s LTP protocol at 4, 12.5 and 22 minutes each way (Mars at closest, average and near-farthest). Everything arrived exactly one light time later and verified. A rover-to-orbiter-to-Earth relay with 5% packet loss on the long link also passed, with the losses repaired (Mars results).
- Thousands of satellites, on real orbits. Using public Starlink orbital data propagated minute by minute, every bundle verified end to end across 4,032 satellites and across all 9,732 active ones, with thousands rerouted mid-transfer as links changed. In a separate stress test, up to 200,000 bundles all verified. Each satellite signs one receipt per contact instead of one per bundle, and any single bundle can still be proven. Tampering, forged keys and a compromised satellite were each caught for exactly the bundles affected (results).
- On board, not just on the ground. A small C signer (about 11 KB of code on an ARM Cortex-M4) and a NASA cFS application reproduce our published test signatures byte for byte, so records signed in space verify with the same code as records signed on the ground.
- Real satellite downlinks. Run on frames from independent SatNOGS ground stations: 1,139 frames re-downloaded and re-verified, none changed. A published run’s batch root is anchored on BSV mainnet so anyone can check it (anchored run, anchor tx, discussion).
- Light overhead. About 2% extra data at 64 KB chunks and 0.1% at 1 MB; one server core signs about 30,000 receipts a second (benchmarks).
- Every hop paid, bound to its custody. On a private Teranode (BSV) test chain, every custody receipt from the 4,032-satellite real-orbit run became one transaction that pays the relaying satellite and records that exact receipt: 30,502 transactions, all confirmed, and 100 of 100 sampled bundles proven custodied and paid at every hop from the chain alone (results).
- Real on-chain anchor. A payload root committed on BSV mainnet in transaction 733dcc21…, re-derivable from the payload.
Not yet claimed: flight heritage, a full far-side outage (our lunar test used a 20-second blackout), any operator’s actual laser-link layout (our orbit runs use a geometric link model), a physical HSM (our key tests used a software token over the same PKCS#11 interface), high-rate operation on live traffic, and timing on flight hardware. A pilot measures these on your data.
Ground station custody pilot
Signed proof of every pass, including the ones that failed. Runs on the data your stations already receive, with no change to the spacecraft, the radio or your DTN software.
Signed receipts per pass
Each station signs a fingerprint of every product it received and when. A later change to any file, or to any record, is detected.
Silent passes on the record
Every scheduled pass gets a signed report. A pass that produced nothing becomes a dated gap record, which settles service-level and billing questions with evidence.
Stations vouch for each other
When two stations receive the same data, their ledgers corroborate it. Each ledger is sealed under one fingerprint you can timestamp if you choose; nothing else leaves your network.
A 90-day pilot on your recorded or live passes, run on your systems, for a fixed fee agreed up front. Your engineers can try it first with node ground/demo.mjs in the open-source repository.
Ask about a pilotOpen source
The reference implementation is free under Apache-2.0: application agent, custody receipts, gap objects, payment binding and the real-transport test harnesses.
BSVKey/dtn-custody-demoDTN custody and relay-payment layer
BSVKey/open-downlink-custodyCustody receipts over real SatNOGS downlinks
DiscussionOpen Downlink Custody thread on the Libre Space community forum
industries.bsvkey.comThe same custody records for pharma, cargo, aviation, vehicles, robotics and insurance
Operator Edition
For relay operators, ground-station networks and missions that hand data across companies. Available on request, with pilots.
Multi-operator settlement
Operators publish signed price sheets. Only hops with verified custody are billed; forged or broken chains become disputes with a reason.
Fair service credits
Delays inside a documented blackout are excused. Delays with no documented cause credit the customer automatically.
Non-custodial statements
Signed statements tell customers to pay each operator directly. Operators countersign their line, and payments are reconciled against it.
Built: fleet key management proven at 4,000+ satellites (enrollment with proof of possession, whole-fleet rotation, signed registry snapshots, compromise revocation), signing through the standard PKCS#11 hardware-key interface with non-extractable keys (tested on a software token), encrypted key storage, and a clearing API. Roadmap: hosted clearing service, certification on a physical HSM, and an operator dashboard.
Request the Operator Edition
Tell us about your relay, ground network or mission and we will set up an evaluation or a pilot.
Email embryospace@gmail.com