Certificate management is needed for securing certificates which has been widely deployed in satellite networks to support security-related services. However, directly utilizing existing certificate management mechanisms in satellite networks would cause critical issues in terms of security, privacy, and practicality. Typically, the trustworthiness of certificate revocation checking (CRC) cannot be guaranteed in the presence of active adversaries; The certificate to be checked contains the satellite’s identity, which is sensitive in some applications but could be exposed during CRC; CRC cannot be trivially launched when the satellite is under constrained networks (e.g., it enters dead zones where direct communication with base stations fails).Worse still, compromising the secret key of a single certificate authority (CA) leads to certificate forgery. In this paper, we propose a forward-secure and privacy-preserving certificate management scheme, dubbed SNCM, for satellite networks, where a forward-secure signature algorithm is used to issue certificates. We utilize a neighboring-assisted forwarding paradigm in SNCM to support CRC in constrained networks. SNCM is secure against adversaries who invalidate CRC results or violate related sensitive information about the satellite, which is achieved by utilizing authenticated encryption with associated data (AEAD). Furthermore, SNCM utilizes a 2-layer revocation checking protocol to perform lightweight CRC, where the CA and base stations handle CRC tasks from satellites in a cooperative way, which frees the CA from heavy costs and reduces CRC delay significantly. We analyze the security of SNCM, implement an SNCM prototype, and conduct a comprehensive performance evaluation, which demonstrates its security, efficiency, and practicality.

Certificate revocation checking (CRC) is a fundamental component for securing certificates which has been widely deployed in satellite networks to support security-related services. However, directly utilizing existing CRC mechanisms in satellite networks would cause critical issues in terms of security, privacy, and practicality. Typically, the trustworthiness of checking results cannot be guaranteed in the presence of active adversaries; the certificate to be checked contains the satellite’s identity, which is sensitive in some applications but could be exposed during CRC; CRC cannot be trivially launched when the satellite is being under constrained networks (e.g., it enters dead zones where direct communication with base stations fails). In this paper, we propose a privacy-preserving and lightweight CRC scheme, dubbed SNCRC, for satellite networks, where a neighboring-assisted forwarding paradigm is utilized to support CRC in constrained networks. SNCRC is secure against adversaries who invalidate checking results or violate related sensitive information about the satellite, which is achieved by utilizing authenticated encryption with associated data (AEAD). Furthermore, SNCRC utilizes a 2-layer revocation checking protocol to perform lightweight CRC, where the certificate authority (CA) and base stations handle CRC tasks from satellites in a cooperative way, which frees CA from heavy costs and reduces CRC delay significantly. We analyze the security of SNCRC, implement an SNCRC prototype, and conduct a comprehensive performance evaluation, which demonstrates its security, efficiency, and practicality.

In this article, we propose an integrated satellite–terrestrial network (ISTN) architecture to support delay-sensitive task offloading for remote Internet of Things (IoT), in which satellite networks serve as a complement to terrestrial networks by providing additional communication resources, backhaul capacities, and seamless coverage. Under this architecture, we investigate how to jointly make offloading link selection and bandwidth allocation decisions for BSs and IoT users. Considering the differentiated decision-making time granularities, we formulate a two-timescale stochastic optimization problem to minimize the overall task offloading delay. To accommodate the two-timescale network dynamics and characterize state–action relations, we establish a hierarchical Markov decision process (H-MDP) framework with two separate agents tackling two-timescale network management decisions, and two evolved MDP-based subproblems are formulated accordingly. To efficiently solve the subproblems, we further develop a hybrid proximal policy optimization (H-PPO)-based algorithm. Specifically, a hybrid actor–critic architecture is designed to deal with the mixed discrete and continuous actions. In addition, an action mask layer and an action shaping function are designed to sample feasible task offloading decisions from the time-variant action set. Extensive simulation results have validated the superiority of the proposed ISTN architecture and the H-PPO-based algorithm, especially, in scenarios with scarce spectrum resources and heavy traffic loads.

In this paper, we investigate the joint cache placement and content delivery in satellite-terrestrial integrated cloud radio access networks. We consider the scenario where cache-enabled access points (APs), including multiple base stations (BSs) and one low orbit earth satellite, are connected to a central processor via backhaul links and cooperatively serve users via joint beamforming. To minimize the long-term power consumption, we formulate an optimization problem to jointly optimize the cache placement, AP clustering, and multicast beamforming, while satisfying the constraints on the transmission power, quality-of-service, and caching storage. Since the formulated problem has mixed timescales, it is decoupled into two sub-problems. For the short-term delivery sub-problem, we first reformulate it as an equivalent sparse multicast beamforming problem and approximate the non-convex objective function by a concave smooth function, and then solve it with a convex-concave procedure approach. For the long-term cache placement sub-problem, we propose an alternating based method to tackle it iteratively. Simulation results validate the advantages of our proposed method and show the impacts of different cache capacities and file numbers on the long-term power consumption.