PAST-AI: Physical-layer Authentication of Satellite Transmitters via Deep Learning

I. INTRODUCTION

• Hardware authentication can address spoofing and replay threats, while cryptographic signatures may be inefficient for massive, difficult-to-reach deployments or when their overhead is excessive.The introduction notes that replayed encrypted messages may be accepted if they are not timestamped.Source: §I · p. 1

II. RELATED WORK

• Prior CNN radio-fingerprinting studies addressed terrestrial links, where channel effects can degrade classification accuracy, leaving satellite transmitters unexamined.The cited terrestrial work also investigated equalization and performance under different signal-to-noise conditions.Source: §I · p. 1, §II · p. 2

I. INTRODUCTION

• LEO satellite fingerprinting is challenging because attenuation and multipath fading change during a pass, while radio noise can obscure transmitter fingerprints.The introduction describes satellites at about 800 km altitude, moving at about 7 km/s, with passes lasting about eight minutes.Source: §I · pp. 1–2
• PAST-AI proposes a new IQ-sample representation and applies CNNs and autoencoders to fingerprint satellite transmitters.The paper presents intra-constellation authentication and authentication in the wild as its two scenarios.Source: §I · p. 2
• The paper reports accuracy greater than 0.8 for intra-constellation authentication and average AUC of 1 for satellite authentication in the wild.The latter result applies to the vast majority of satellites, and the scenarios rely on different assumptions.Source: §I · p. 2

II. RELATED WORK

• The cited GPS-spoofing study analyzed post-demodulation correlator samples to distinguish SDRs from legitimate satellites, whereas PAST-AI identifies specific IRIDIUM transmitters from raw IQ samples before demodulation.The authors state that their method is potentially applicable to LEO constellations using PSK modulation.Source: §II · p. 3

A. IQ (de)modulation

• IQ modulation converts bits into in-phase i(t) and quadrature q(t) components, which modulate carrier signals to form the transmitted radio signal.The receiver demodulates the propagated signal to obtain received components i′(t) and q′(t).Source: A. IQ (de)modulation · p. 3
• In QPSK, each pair of bits maps to one of four IQ symbols represented by i(t) and q(t) values of −1 or 1.The paper uses QPSK as an example and notes that IRIDIUM uses a similar modulation scheme.Source: A. IQ (de)modulation · p. 3, Figure 2 · p. 4
• Propagation can make received IQ components differ substantially from transmitted components, while small systematic symbol displacements from electronics imperfections may help identify transmitter hardware.The paper notes that sufficiently high signal-to-noise ratio makes symbol recovery feasible.Source: A. IQ (de)modulation · p. 4

B. Deep Learning classifiers and Transfer Learning

• The study introduces deep-learning classifiers and transfer learning as tools for improving accuracy in multi-class classification.The supplied passage introduces these tools but does not specify the transfer-learning procedure.Source: B. Deep Learning classifiers and… · p. 4

1) Autoencoders:

• An autoencoder learns an encoding of training data from which it reconstructs the input, and constraints such as a smaller encoding can encourage useful feature learning.The section also identifies regularized and variational autoencoders as variants with different encoding properties.Source: 1) Autoencoders · p. 4
• The paper uses autoencoders for one-class classification, relying on lower reconstruction error for inputs from the trained satellite distribution than for inputs from another distribution.The model's encoder, bottleneck, decoder, and reconstruction-error function are identified as its main components.Source: 1) Autoencoders · p. 4

2) Convolutional Neural Networks:

• CNNs use convolutional filters to build feature maps from overlapping input portions, while pooling and fully connected layers reduce parameters and learn high-level combinations.Their hierarchical combination of simple patterns is described as discouraging overly complex models and containing overfitting by construction [28].Source: 2) Convolutional Neural Networks · pp. 4–5

3) Transfer Learning:

• Transfer learning uses knowledge from a related domain to simplify learning; the study applies ImageNet-pretrained ResNet-18 to multi-class IRIDIUM satellite classification.The section says details of fine-tuning or freezing layers are given later.Source: 3) Transfer Learning · p. 5

C. Iridium Satellite Constellation

• The IRIDIUM constellation has 66 operational LEO satellites, each with 48 beams and a separate antenna that identifies the satellite.The constellation was arranged for full Earth coverage; the satellite-identification antenna transmits at higher power than the beams.Source: C. Iridium Satellite Constellation · p. 5
• The study focuses on the unencrypted, downlink-only IRIDIUM Ring Alert channel, whose messages carry satellite and beam IDs and satellite position.IRA packets have a 12-byte BPSK preamble followed by 103 bytes of DQPSK information; packet size can vary.Source: C. Iridium Satellite Constellation · p. 5
• The study extends prior IRA-based constellation analysis with observations about satellite observation time, IQ-sample distributions, noise effects, and samples per pass.These observations are presented as instrumental to authenticating IRIDIUM satellites at the physical layer using raw IQ samples.Source: C. Iridium Satellite Constellation · p. 5

A. Measurement Set-up

• An active IRIDIUM RST740 antenna fed an Ettus X310 SDR, which connected by Ethernet to a laptop.The SDR integrated a UBX160 daughterboard.Source: A. Measurement Set-up · p. 6, Figure 3 · p. 6
• The modified gr-iridium module logged IQ samples from valid packets after PLL filtering and synchronization; iridium-toolkit then selected valid IRA packets.The valid packets contain the 12-byte BPSK-modulated preamble.Source: A. Measurement Set-up · p. 6
• The antenna was placed outside an apartment window, where a building wall obstructed part of the sky and attenuated and deviated satellite signals; the authors say this was not a study limitation.They state that performance in this disadvantaged setting paves the way for further improvement.Source: A. Measurement Set-up · p. 6
• The campaign collected 102,318,546 IQ samples over about 589 hours, averaging 1,550,281 samples per satellite, and retained satellite IRA packets with beam ID 0.Logged fields include reception time, satellite and beam IDs, satellite coordinates, and raw IQ samples.Source: A. Measurement Set-up · p. 6
• CNN and autoencoder classifiers were implemented in MATLAB R2020a and trained, validated, and tested on a server with 64 cores and four GPUs.The server had 512 GB RAM and Nvidia Tesla M40 GPUs; the authors said the collected data would be released open source after acceptance.Source: A. Measurement Set-up · p. 6

B. Reverse-Engineering IRIDIUM Constellation Parameters

• 90% of collected samples had an SNR of 40–60 dBm, with the distribution peaking at about 45 dBm.The SNR distribution covers all collected IQ samples, independently of the transmitting satellite.Source: B. Reverse-Engineering IRIDIUM… · p. 6, Figure 4 · p. 7
• A satellite can pass the same location twice about 90 minutes apart, then return after about 560 minutes in the opposite direction.Waiting times near 650 minutes can reflect passes that the receiver did not detect.Source: B. Reverse-Engineering IRIDIUM… · p. 7, Figure 5 · p. 7
• The probability of collecting at least 10,000 IQ samples per pass is 0.7, and the probability of at least 20,000 is 0.5.The inverse cumulative distribution is linear up to 50,000 samples.Source: B. Reverse-Engineering IRIDIUM… · p. 7, Figure 6 · p. 7
• Passes lasting up to a median maximum of 9 minutes yielded 30,000–80,000 IQ samples, while 10,000 and 20,000 samples took 7 and 8 minutes, respectively.The authors attribute the wide yield range to changing noise conditions; short 3–8-minute passes near the horizon can yield 0–30,000 samples.Source: B. Reverse-Engineering IRIDIUM… · pp. 7–8

C. Transmitting-source Authentication via IQ samples

• The 679,740 received samples from satellite 7 differ substantially from ideal IQ positions, reflecting displacement rather than the link error rate studied here.The figure's red circles mark ideal positions and the four Cartesian quadrants; samples are assigned by the quadrant in which they lie.Source: C. Transmitting-source Authentication… · p. 8, Figure 7 · p. 8
• Hardware differences create small IQ artifacts that can identify a transmitter, but fading, multipath, and Doppler affect the samples and obscure those imbalances.The approach is presented as robust to noise and able to identify a transmitter among the 66 IRIDIUM satellites.Source: C. Transmitting-source Authentication… · p. 8

D. IQ Samples Pre-processing

• Satellite-link noise spreads IQ samples across the plane, and the authors state their approach remains effective at small SNR values.The cross-like distribution is attributed to a lack of signal-amplitude normalization in the demodulation chain.Source: D. IQ Samples Pre-processing · p. 8
• The method applies image-pattern recognition to synthetic images of IQ samples to separate noise from consistent, low-intensity hardware anomalies.The image representation slices the IQ plane into 224 × 224 tiles, counts samples per tile with a bivariate histogram, and maps counts to grayscale pixels.Source: D. IQ Samples Pre-processing · pp. 8–9, Figure 8 · p. 9

V. SATELLITE AUTHENTICATION METHODOLOGIES

• The dataset is split into training, validation, and test subsets in a 60%, 20%, and 20% ratio, with each satellite evenly represented in each subset.The paper states that the dataset is balanced by construction.Source: §V · p. 9
• Multiclass classification distinguishes all 66 satellites, assuming training data for every satellite and test samples drawn from the constellation.The satellite identity of the test samples is unknown to the classifier.Source: §V · p. 9, Table II · p. 9
• One-vs-rest compares a reference satellite with all others, requiring training data only for that reference and allowing any test subset.It returns a similarity score between the test subset and the reference training subset; the paper calls this setting satellite authentication in the wild.Source: §V · pp. 9–10, Table II · p. 9

A. Convolutional Neural Network Setup

• The 66-class DCNN transfers ResNet-18 convolutional parameters and replaces its 1,000-neuron output layer with 66 neurons.The network is fine-tuned with a monotonically increasing learning rate, higher for deeper layers.Source: A. Convolutional Neural Network Setup · p. 10, Figure 9 · p. 11

B. Satellite Authentication via CNN

• At 10,000 IQ samples per image, the dataset yields 155 images per satellite and about 0.83 validation accuracy.This setting balances richer information per image against having fewer images for classification, and corresponds to a single satellite pass as a reference.Source: B. Satellite Authentication via CNN · p. 10, Figure 10 · p. 11
• 24 satellites exceed a 0.9 hit rate, while only 4 fall below 0.5 across the IRIDIUM constellation.Figure 11 reports mean hit and miss rates from 30 runs of the complete training, validation, and testing procedure.Source: Figure 11 · p. 11, B. Satellite Authentication via CNN · p. 11

C. Authentication of satellite subsets

• Testing accuracy exceeds 0.82 at baseline and rises above 0.9 after the 9 worst-hit satellites are removed.Figure 12 plots testing accuracy against the number of excluded satellites, removed in order of poorest remaining hit rate.Source: Figure 12 · p. 12, C. Authentication of satellite subsets · p. 12

VII. SATELLITE AUTHENTICATION IN THE WILD

• For authentication with only a target satellite's training subset, an autoencoder learns that subset and uses reproduction error to distinguish test samples.The reproduction error is the mean squared error; samples below a threshold are treated as belonging to the target satellite.Source: §VII · p. 12
• The paper defines One-vs-Rest against the other constellation satellites and One-vs-One against each individual satellite; its test samples come only from IRIDIUM.The authors describe the same-constellation test set as a worst-case scenario because the satellites share an owner and likely have similar hardware.Source: §VII · p. 12

A. Satellite Authentication via Autoencoders

• The sparse autoencoder uses 1,024 hidden neurons and 50 training epochs, with L2 weight regularization set to 0.001 and sparsity regularization to 1.The sparsity proportion is set to 0.05, and the loss combines mean squared error with L2 and sparsity regularizers.Source: A. Satellite Authentication via… · pp. 12–13, Table III · p. 12

B. One-vs-Rest

• For satellite 25, training and validation reconstruction errors fall in the 0.2–0.5 range, while the other-satellite test errors range from 0.7 to 1.4.The test set contains samples from the rest of the IRIDIUM constellation; the authors call this a worst-case scenario because the transmitters likely share hardware.Source: B. One-vs-Rest · p. 13, Figure 13 · p. 14
• Satellite 25 has an AUC of about 0.98, with the reported optimal ROC point at [0.048, 1].The threshold is varied from 0.2 to 1.5, treating MSE values below the threshold as legitimate.Source: B. One-vs-Rest · p. 14, Figure 13 · p. 14
• AUC exceeds 0.93 for every satellite in the One-vs-Rest results.The sorted AUC values cover all IRIDIUM satellites; their optimal ROC operating points are also reported as close to TPR = 1 and FPR = 0.Source: Figure 15 · p. 14, B. One-vs-Rest · p. 14, Figure 14 · p. 14

C. One-vs-One

• For almost all satellites, the One-vs-One median and 95th-quantile AUC equal 1; even the few lower 5th-quantile values exceed 0.96.Figure 16 shows the 5th, 50th, and 95th quantiles for each reference satellite, sorted by median performance.Source: C. One-vs-One · pp. 14–15, Figure 16 · p. 15

VIII. CONCLUSION

• The authors state that their methodology demonstrates radio fingerprinting for LEO satellite transmitters despite high attenuation, multipath fading, strong Doppler effects, and short link duration.They identify the publicly available dataset, results, and insights as resources for future research.Source: §VIII · p. 15
• Across intra-constellation and in-the-wild scenarios, reported classification accuracy ranges from 0.8 to 1 depending on scenario assumptions.The evaluation uses more than 100 million IQ samples collected from a real IRIDIUM measurement campaign.Source: §VIII · p. 15

• 10,000 IQ samples were used per image across 30 runs.Source: APPENDIX · p. 17