Direct-to-cell satellites enable global network services for our regular phones/IoTs via 4G, 5G, and beyond. To enforce highly available, trustworthy, and roaming policy-compliant network services, they heavily rely on user geolocation and timing information from external global navigation satellite systems (GNSS) to assist with their radio access, authentication, and authorization. Our analysis and field tests reveal that, this cross-technology over-reliance propagates satellite navigation's defects to direct-to-cell satellite networks, leading to diverse issues such as intermittent connectivity, over/under-billing, unauthorized services, and service denials even when direct-to-cell satellites are accessible. Our solution, SN2, adopts the "fate-sharing" principle to reuse direct-to-cell satellites themselves for self-navigating networks. By exploiting the flexible tradeoffs between satellite network availability and navigation accuracy, it enables "good enough" built-in navigation for highly available and functionally correct network services at a negligible cost of hardware or communication resources. Our evaluations with commodity satellite phones and 3GPP NTN protocol stacks demonstrate SN2's 4.4–23.5× network availability boost and 1.9–12.3× access latency reduction over legacy solutions.

Leveraging direct-to-cell (DTC) satellites in low-earth orbits (LEO) to directly provide communication services for terrestrial cellphones is gaining popularity in recent years. However, the unique characteristics of the wireless medium in space-ground communication, combined with the dynamic behavior of LEO satellites, raise a new privacy leakage risk that an adversary eavesdropping on DTC broadcasts could steal the physical locations of active users. In this paper, we investigate new techniques to analyze the location leakage risks in emerging LEO direct-to-cell satellite networks (DCSN). We present DCATOR1DCATOR indicates the abbreviation of DCSN terminal locator. , a novel location leakage analyzer which continuously monitors DTC signaling messages in broadcast channels, extracts various location clues and combines them with the time-varying satellite trajectories to infer the physical locations of active users. We use DCATOR to analyze the consequences if an adversary is able to continuously monitor and process broadcast DTC signaling to deduce the locations of other users within the same satellite coverage area, in three representative DCSNs: (i) the operational Iridium; (ii) the developing Starlink DTC; and (iii) a DCSN based on the latest 3GPP NTN standards. Our extensive experiments demonstrate the existence of location leakages in real DCSNs, and in the worst case an adversary can precisely track the locations of other users within hundreds of meters. Finally, we propose privacy-enhancing countermeasures for DCSNs.

Low Earth Orbit (LEO) satellite mega-constellations promise ubiquitous network services to "unconnected" users. But their upcoming global routing for Earth will be unstable due to exhaustive topology updates between satellites and Earth, inside an orbital shell, and across heterogeneous orbital shells. In real LEO networks, these multi-dimensional dynamics are interleaved and complicated by chaotic orbital maneuvers and random failures. They are less predictable than most satellite routing proposals expect and threaten these proposals' availability, efficiency, or resiliency at scale.

The emergent direct-to-cell Low-Earth Orbit (LEO) satellite mega-constellations promise ubiquitous LTE/5G access for our commodity phones and IoTs without terrestrial base stations. While their extreme scale and mobility help tolerate diverse attacks, we show that both new features are exploitable to amplify signaling protocol vulnerabilities inherited from LTE/5G and obfuscate attacks to threaten satellite services. We showcase this with SatOver, a control-plane cross-layer attack that lets a greedy terrestrial operator or a man-in-the-middle attacker block all direct-to-cell satellites in urban areas. SatOver can reuse terrestrial LTE/5G base stations or deploy commodity software-defined radios as false satellites, stealthily hijack victim devices, delay their satellite access, stop them from probing other satellites, and block the entire mega-constellation. Our real-world satellite tests, lab tests with commodity 3GPP NR/IoT-NTN stacks, and operational trace-driven emulation validate SatOver’s viability for attacking COTS and upcoming NTN phones/IoTs. We discuss potential defenses against SatOver’s attack amplification/obfuscation.

Low-earth-orbit (LEO) satellite mega-constellations, such as SpaceX Starlink, are under rocket-fast deployments and promise broadband Internet to remote areas that terrestrial networks cannot reach. For mission safety and sustainable uses of space, Starlink has adopted a proprietary onboard autonomous driving system for its extremely mobile LEO satellites. This paper demystifies and diagnoses its impacts on the LEO mega-constellation and satellite networks. We design a domain-specific method to characterize key components in Starlink's autonomous driving from various public space situational awareness datasets, including continuous orbit maintenance, collision avoidance, and maneuvers between orbital shells. Our analysis shows that, these operations have mixed impacts on the stability and performance of the entire mega-constellation, inter-satellite links, topology, and upper-layer network functions. To this end, we investigate and empirically assess the potential of networking-autonomous driving co-designs for the upcoming satellite networks.

Is it worth and feasible to push mobile core network functions to low-earth-orbit (LEO) satellite mega-constellations? While this paradigm is being tested in space and promises new values, it also raises scalability, performance, and security concerns based on our study with datasets from operational satellites and 5G. A major challenge is today's stateful mobile core, which suffers from signaling storms in satellites' extreme mobility, intermittent failures in outer space, and attacks when unavoidably exposed to untrusted foreign locations. To this end, we make a case for a stateless mobile core in space. Our solution, SpaceCore, decouples states from orbital core functions, simplifies location states via geospatial addressing, eliminates unnecessary state migrations in satellite mobility by shifting to geospatial service areas, and localizes state retrievals with device-as-the-repository. Our evaluation with datasets from operational satellites and 5G shows SpaceCore's 17.5× over existing solutions signaling reductions and resiliency to failures/attacks.

We study a new design objective for "Internet in space" for terrestrial users: To align logical network topology, address, and route in the virtual cyberspace with movements of satellite mega-constellations and earth's rotations in the real physical world. We explain why this is particularly desirable by the recent low-earth-orbit (LEO) mega-constellations, and how it welcomes mobility to streamline the network design for stability, efficiency, and scalability in an unstable space-ground environment. We showcase its feasibility with the common fixed satellite sub-point trajectory in mega-constellations. We describe how it permits stable recursive topology, unifies cyber-physical locations in the address, and naturally embeds the geographical routing into the topological routing.