PaperlayerView exact revision on arXiv

Source-linked AI summary

Denial of Service Attacks on Beam Allocation in Large LEO Constellations

Ali Abbasi, Pasha Barahimi, Marco Paolieri, Leana Golubchik

arXiv:2610.34631v1cs.NIcs.CR

TL;DR

Finite, demand-responsive beam capacity makes LEO allocation vulnerable to terminals that inflate demand while behaving like ordinary users. The paper evaluates such injections against greedy and max-min-fair schedulers with equal or proportional sharing; proportional sharing allows larger losses in users meeting a satisfaction threshold, while max-min requires attacks to span more cells and max-min/equal starts with the lowest no-attack coverage.

  • Problem

    Because beam capacity is finite and allocation responds to cell demand, the paper asks how adversarial demand inflation can disrupt service for legitimate LEO users.

    Source: §I · p. 1

  • Method

    The paper models attackers purchasing and activating terminals under terminal and cell budgets, then evaluates attack heuristics across greedy and max-min-fair schedulers and equal or proportional sharing.

    Source: §I · pp. 1–2

  • Results

    At a 5% budget, proportional sharing causes up to a 34% loss in users getting at least 0.7 satisfaction, compared with up to 13% under equal sharing.

    Source: §VI · p. 9

  • Takeaways & Limitations

    The most effective targeting depends on sharing: lightly loaded cells are more vulnerable under equal sharing, while heavily loaded cells are more vulnerable under proportional sharing.

    Source: §I · p. 2, §VI · p. 9

Abstract

from arXiv · show

We study the vulnerability of beam allocation approaches in large low-Earth-orbit (LEO) satellite constellations to adversarial demand inflation resulting in denial-of-service attacks. We consider an attack model in which an adversary places (injects) additional terminals and evaluate these attacks against greedy and max-min-fair beam allocation algorithms, each combined with either equal or demand-proportional intra-cell capacity sharing. Vulnerability is measured using mean demand satisfaction, coverage, and the fraction of legitimate users receiving at least a threshold fraction of their requested capacity under several attack heuristics. There is a trade-off for the system between robustness and performance, meaning the algorithm with the most vulnerability to the attacks (greedy-proportional) has the highest performance before the attacks. Demand-proportional sharing increases the fraction of under-served users up to 34% under both allocation algorithms, whereas equal sharing limits the increase up to 13%. The sharing rule also changes the most damaging attack allocation in nearly all cases: demand-proportional sharing rewards concentrating injected terminals in the most loaded cells, while equal sharing performs better when distributing these terminals across the least loaded cells. Furthermore, the max-min-fair beam allocation algorithm forces the attacker to use a higher number of targeted cells to result in extensive damage to the system.

I. INTRODUCTION

As LEO networks become important connectivity infrastructure, their finite, demand-responsive beam capacity creates an attack surface: ordinary-looking injected terminals can manipulate allocation and reduce legitimate users’ service. The paper formulates this attack and evaluates how sharing rules and schedulers shape its effects.

I. INTRODUCTION

  • LEO networks’ expanding commercial use and potential role in remote connectivity and failover make their security and resilience increasingly important.Measurement studies report latency and throughput comparable to terrestrial cellular networks,.Source: §I · p. 1
  • LEO capacity is constrained by a fixed pool of phased-array beams and reused channels, while satellite visibility and service choices change over time.Operators cannot always add capacity as demand increases.Source: §I · p. 1
  • Attackers can manipulate beam allocation by adding terminals that request legitimate demand, avoiding the specialized equipment or protocol weaknesses associated with other attack approaches.Because the attack targets resource allocation rather than routes, routing defenses alone do not address it.Source: §I · p. 1
  • The paper models an adversary that purchases and activates terminals, with budgets on terminal count and targeted cells and knowledge of cell demand or population.The attack model and quality-of-service metrics are formalized before the attack heuristics are presented.Source: §I · pp. 1–2

II. BACKGROUND

  • The study evaluates how system configuration changes attack effectiveness across several metrics and heuristics.The supplied background frames terminal populations and demands as inputs to the allocation algorithms, which the adversary can manipulate.Source: §I · p. 2, §II · p. 2

I. INTRODUCTION

  • At a 5% attack budget, proportional sharing reduces the fraction of users above 0.7 satisfaction by 30%–34%, versus 9%–13% under equal sharing.The scheduler matters more at larger budgets; max-min/equal is most robust but has the lowest pre-attack coverage.Source: §I · p. 2

A. Constellation and Traffic Model

The model represents a time-varying constellation in which visible satellites serve cells using capacity-limited beams and channels. Beam allocation is constrained by per-satellite, per-cell, visibility, and interference limits.

A. Constellation and Traffic Model

  • Each cell has a time-dependent set of visible satellites, determined by line of sight and minimum elevation requirements.The service region is partitioned into cells served by satellites.Source: A. Constellation and Traffic Model · p. 2
  • Each beam occupies one channel, serves one cell, and provides fixed capacity W; satellite and cell beam limits, channel reuse, and neighboring-cell interference constrain feasible service.A channel can be reused only by sufficiently distant cells, and the per-cell beam limit B cannot exceed the number of channels F.Source: A. Constellation and Traffic Model · p. 2
  • The allocator converts each cell’s aggregate demand into a beam target, limited by B and the beams needed to cover that demand.The target is the minimum between the per-cell beam limit and the demand-based beam requirement.Source: A. Constellation and Traffic Model · p. 2

B. Beam Allocation Constraints

  • A binary variable indicates whether satellite s serves cell i on channel f; the number of allocated beams determines the cell’s capacity as b_iW.Cell-level allocations are collected in vector b.Source: B. Beam Allocation Constraints · p. 2
  • Feasible allocations enforce satellite beam budgets, distinct channels for a cell, channel separation for neighboring cells, satellite visibility, and each cell’s beam target.The constraints also ensure that allocated beams do not exceed the demand-based target or per-cell limit.Source: B. Beam Allocation Constraints · p. 2

C. Beam Allocation Algorithms

The paper compares greedy and max-min-fair beam allocation, which process cells by aggregate demand and choose among least-loaded satellites. Greedy prioritizes high-demand cells in one pass, while max-min fair distributes beams across repeated passes.

C. Beam Allocation Algorithms

  • Both algorithms consider cells in descending aggregate demand and assign each next beam using the least-loaded eligible satellite.They allocate only beams satisfying the visibility, channel, and other feasibility constraints.Source: C. Beam Allocation Algorithms · pp. 2–3
  • Greedy assigns as many beams as possible to each current cell, up to its target, in one pass.This gives priority to cells with high aggregate demand.Source: C. Beam Allocation Algorithms · p. 3
  • Max-min fair gives each cell at most one additional beam per pass, repeating until targets are met or no feasible assignment remains.This prevents one cell from receiving another beam before other cells have been considered.Source: C. Beam Allocation Algorithms · p. 3

III. PROBLEM FORMULATION

The attack changes demand by injecting terminals, which can alter beam allocation across cells and divide capacity among more users within a cell. The model varies attacker knowledge and placement under shared terminal and cell budgets.

III. PROBLEM FORMULATION

  • Injected terminals can reduce legitimate service by changing cell demands and allocation order, or by reducing legitimate users’ intra-cell capacity shares.The attacker varies placement without directly changing the constellation or allocation algorithm.Source: §III · p. 3

A. Effects of Injection Attacks

  • Each injected user requests D_max, increasing a cell’s aggregate demand and potentially its beam target.The attack vector a places a_i malicious users in cell i; the resulting allocation is denoted b_i(a).Source: A. Effects of Injection Attacks · p. 3
  • Even without changing a cell’s allocation order, injected users can reduce legitimate users’ capacity shares under equal or demand-proportional sharing.The two policies divide capacity equally among users or in proportion to their service demands.Source: A. Effects of Injection Attacks · p. 3
  • Under equal sharing, every terminal receives the same fraction of demand-independent capacity per user, so users with larger demands may have lower demand satisfaction.Under proportional sharing, terminals whose demand is not fully met receive the same satisfied-demand fraction, b_i(a)W/D_i(a).Source: A. Effects of Injection Attacks · p. 3

B. Attacker Knowledge

  • A white-box attacker knows legitimate demands, satellite visibility, the allocation algorithm and constraints, and the sharing policy.This strong attacker can evaluate how candidate placements affect demand, beam targets, and allocations but still cannot modify the allocator or violate constraints.Source: B. Attacker Knowledge · p. 3
  • A black-box attacker lacks demand, visibility, and algorithm details, and ranks candidate cells by terminal population instead of actual service demand.It may use public population information and observations from its own terminals across cells and snapshots.Source: B. Attacker Knowledge · p. 3
  • Both attacker types share limits on injected terminal count and targeted-cell count; a smaller cell budget concentrates terminals, while a larger one permits wider distribution.The knowledge model changes placement choices, not the feasible attack set or its effect on demand.Source: B. Attacker Knowledge · p. 3

C. Quality of Service Metrics

The paper evaluates quality of service using three complementary measures of legitimate-user service and frames the attacker’s goal as maximizing average service degradation over time. The attack comparison uses the same objectives and budgets across knowledge models, comparing heuristics rather than assuming a closed-form optimum.

C. Quality of Service Metrics

  • Three metrics capture distinct aspects of legitimate-user service: average demand satisfaction, users meeting a satisfaction threshold, and the fraction of legitimate demand served.Average satisfaction can hide a severely affected subgroup; the threshold metric exposes that lower tail, while coverage measures served legitimate traffic.Source: C. Quality of Service Metrics · pp. 3–4

D. Adversarial Objectives

  • The attacker’s objective is average service degradation over time, with visibility changing across snapshots while injected terminals remain in fixed cells.The time point determines which satellites are visible from each cell.Source: D. Adversarial Objectives · p. 4
  • White-box and black-box attacks share objectives and budgets but use information-appropriate placement heuristics, whose degradation is compared without assuming an available closed-form optimum.The allocation map is discrete and coupled through beam constraints.Source: D. Adversarial Objectives · p. 4

IV. ATTACK HEURISTICS

Because exact attack placement can be computationally prohibitive, the paper uses efficient heuristics built from a single system snapshot. They select target cells using attacker knowledge and pair the selection with a terminal-spreading rule.

IV. ATTACK HEURISTICS

  • Exact attack placement can require prohibitive computation, so each efficient heuristic selects up to a budgeted set of cells and distributes injected terminals among them.The computed placement remains fixed throughout the evaluation period.Source: §IV · p. 4

A. Target Selection

  • White-box attackers score cells by aggregate demand, whereas black-box attackers use cell population as a proxy for demand.For white-box attackers, demand affects allocation order and beam targets.Source: A. Target Selection · p. 4
  • TOP targets cells with the largest scores, which are typically served earlier and can affect many legitimate users when resources are diverted.Additional demand may leave a cell’s beam target unchanged while reducing legitimate users’ capacity share.Source: A. Target Selection · p. 4
  • BOTTOM targets the smallest-score cells, where a small injection can move a cell earlier in the allocation order; RANDOM provides a baseline for ranking information.Source: A. Target Selection · p. 4

B. Spreading Rules

After selecting target cells, the attack assigns injected terminals either evenly or by water-filling scores. The rules balance different quantities and can leave selected cells without injected terminals.

B. Spreading Rules

  • Uniform spreading divides the terminal budget as evenly as possible across selected cells, regardless of their scores.When the budget is smaller than the selected-cell count, some selected cells receive no terminals.Source: B. Spreading Rules · pp. 4–5
  • Water-filling repeatedly assigns a terminal to the selected cell with the smallest adjusted score, using aggregate demand for white-box attackers or population for black-box attackers.The adjustment uses δ = Dmax for white-box attackers and δ = 1 for black-box attackers.Source: B. Spreading Rules · p. 4
  • Water-filling seeks to balance adjusted scores rather than terminal counts, producing similar aggregate demands and beam targets for white-box attackers.For black-box attackers it produces similar post-attack populations, the denominator used by equal sharing.Source: B. Spreading Rules · pp. 4–5
  • Water-filling may assign no terminals to some selected cells, but both spreading rules allocate the entire terminal budget.The selected-cell count is only an upper bound on the number of cells that receive injected terminals.Source: B. Spreading Rules · p. 5

V. EXPERIMENTAL EVALUATION

The evaluation simulates attacks on a time-varying LEO constellation serving a modeled Great Britain region. It varies demand, allocation and sharing policies, attacker budgets, and persistence while reporting complementary legitimate-user service metrics.

A. Setup

  • The simulator models 6,364 satellites with 32 beams and 8 channels each, and samples 95 snapshots at 60-second intervals across nearly one orbital period.The evaluation uses CosmoSim and models beam allocation and spectrum reuse over a time-varying topology.Source: A. Setup · p. 5
  • The service area is Great Britain, represented by 943 cells containing 100,000 legitimate users distributed proportionally to cell populations.Source: A. Setup · p. 5
  • Demand is drawn from a truncated log-normal distribution, with utilization factors of 0.6, 0.8, and 1.0 tested against visible-satellite capacity.At the default 0.8 utilization, average demand is 30 Mbps per user.Source: A. Setup · p. 5
  • The evaluation combines greedy or max-min-fair beam allocation with equal or proportional sharing and tests three attack heuristics with two spreading rules.Attackers have a maximum of 300 targeted cells and inject 1,000 to 5,000 terminals requesting 200 Mbps each.Source: A. Setup · p. 5
  • Each deterministic configuration is repeated across 20 demand realizations, and the persistent experiment replays one reference-epoch attack unchanged across later snapshots.Reported confidence intervals are 95% intervals over demand realizations; persistent runs keep those realizations fixed across snapshots while constellation visibility changes.Source: A. Setup · p. 6

B. Main Results

The sharing rule has the larger overall effect on attack vulnerability, especially for users receiving at least 0.7 satisfaction, while scheduler effects grow as adversarial demand increases system load. The most damaging targeting strategy depends on the sharing rule, and greater robustness comes with lower pre-attack coverage.

B. Main Results

  • Least-loaded-cell targeting is generally most damaging under equal sharing, whereas most-loaded-cell targeting is most damaging under proportional sharing.Table I and Fig. 1 summarize maximum damage across schedulers, sharing configurations, and three user-level metrics.Source: B. Main Results · p. 6
  • Max-min/equal has the smallest attack-induced degradation but also the lowest pre-attack coverage, so its smaller loss partly reflects a weaker starting point.Source: B. Main Results · p. 6

1) Effects of resource allocation policies:

  • At a 5% adversary budget, users reaching at least 0.7 satisfaction decrease by 34 and 30 percentage points under greedy/proportional and max-min/proportional, versus 13 and 9 points under the corresponding equal-sharing configurations.Fig. 1 summarizes worst-case harm across tested attacks; its points select the most damaging tested attack for each scheduler/sharing configuration.Source: Figure 1 · p. 6, 1) Effects of resource allocation… · p. 6
  • Scheduler effects become more pronounced at larger adversary budgets as injected demand increases system load.At a 5% budget, the loss in users reaching at least 0.7 satisfaction is 3.7 points greater under greedy than max-min with equal sharing, and 3.3 points greater with proportional sharing.Source: 1) Effects of resource allocation… · p. 6

2) Robustness and efficiency trade-off:

The scheduler and sharing rule jointly shape robustness and performance: max-min/equal has the lowest baseline coverage and smallest worst-case coverage drop, while the most damaging targeting heuristic depends primarily on sharing. The best attack width and the effects of spreading injected terminals also vary with system configuration.

2) Robustness and efficiency trade-off:

  • Max-min/equal has the lowest baseline coverage (56.8%) and the smallest worst-case coverage drop at 5% budget (7.6 points), versus 11.9 to 13.8 points for the others.Its even beam spread and equal intra-cell split limit attack impact but also limit service without an attack.Source: 2) Robustness and efficiency trade-off · p. 6

3) Most effective heuristic:

  • The strongest targeting heuristic depends on sharing: bottom targeting wins in 29 of 30 combinations under equal sharing, while top targeting wins in 28 of 30 under proportional sharing.At 5% budget, top targeting can lose effectiveness in greedy/proportional once heavily loaded cells reach their beam caps; random targeting is consistently less damaging.Source: 3) Most effective heuristic · pp. 6–7, Figure 4 · p. 8, Figure 3 · p. 8

4) Number of attacked cells:

  • At 5% budget, the best attack uses 246 cells under max-min/proportional versus 180 under greedy/proportional, and 286 versus 139 under equal sharing.Max-min spreads beams more evenly across cells, so an attacker must widen the attack rather than deepen it; response curves show the optimal width must be tuned to the design.Source: 4) Number of attacked cells · p. 7, Figure 2 · p. 7

5) Spread rule effect:

  • For bottom targeting, water-filling and uniform spreading differ by less than one percentage point; for top targeting under proportional sharing, water-filling’s effect reverses with the ranking basis.With demand-based ranking, greedy/proportional users above 0.7 satisfaction decline by 34.5% with water-filling versus 25.2% with uniform spreading; with population-based ranking, the losses are 16.1% versus 25.4%. Under max-min/proportional random targeting, uniform spreading is more effective.Source: 5) Spread rule effect · pp. 7–8, Figure 3 · p. 8

C. Ablation Study

The ablation examines attacker demand knowledge, system utilization, and satellite movement. It finds that detailed demand knowledge matters chiefly when top targeting, water-filling, and proportional sharing interact.

C. Ablation Study

  • The ablation considers attacker demand knowledge, system utilization when an attack lands, and satellite movement over time.The supplied passages describe these as the three system choices evaluated, but give findings here only for demand knowledge.Source: C. Ablation Study · p. 8

1) Demand knowledge effect:

  • Demand-based attackers rank cells by aggregate demand, while population-based attackers use terminal counts as a proxy; population directly determines the sharing denominator only under equal sharing.Heterogeneous per-terminal demand can put cells with many light terminals and few heavy terminals in opposite ranking positions; water-filling levels whichever score it uses.Source: 1) Demand knowledge effect · p. 8
  • At 5% budget, demand-based scoring raises the loss in users achieving at least 0.7 satisfaction from 16.1% to 34.5% for greedy and from 16.3% to 30.8% for max-min under proportional sharing.Under equal sharing, the strongest bottom-targeting results are nearly unchanged: 13.0% versus 13.1% for greedy and 9.5% versus 9.4% for max-min.Source: 1) Demand knowledge effect · pp. 8–9

2) Load Sensitivity:

Attack damage varies with system utilization and orbital state, while scheduler and sharing choices shape vulnerability. The conclusion emphasizes both relative damage and baseline service when comparing robustness.

2) Load Sensitivity:

  • With equal sharing, damage increases with utilization for both schedulers, steepest under greedy; max-min begins to level off between 80% and 100%.Under proportional sharing, the decrease in users attaining at least 0.7 satisfaction shrinks as utilization rises, while coverage decreases or varies non-monotonically; this reflects less room for additional measured damage at high load, not greater robustness.Source: 2) Load Sensitivity · p. 9

3) Time sensitivity:

  • Top targeting’s coverage loss remains nearly constant across the orbital cycle, while bottom targeting’s loss fluctuates with constellation state.Visible satellites vary from 84 to 99, affecting feasible beam assignments to lightly loaded cells; bottom-targeting attacks should be evaluated over a complete orbital cycle, not one snapshot.Source: 3) Time sensitivity · p. 9, Figure 5 · p. 9

VI. CONCLUSION

  • At a 5% budget, proportional sharing causes up to a 34% loss in users getting at least 0.7 satisfaction, versus up to 13% under equal sharing.Max-min requires the attacker to target 1.4×–2× as many cells as greedy, but max-min/equal has the lowest no-attack coverage.Source: §VI · p. 9
  • The authors recommend attack-aware beam scheduling and robust intra-cell sharing rather than relying on routing defenses alone.Simulations omit admission control and attack detection; future work will evaluate defenses across additional constellations and traffic conditions.Source: §VI · pp. 9–10
Loading 2610.34631v1…