Chi-MERA: Defending Orbit-Based Authentication of LEO Satellites with the Space Oddity of MLAT (Long Version)

Source: arXiv:2607.19047 · Published 2026-07-21 · By Sarah Jung, Eric Jedermann, Martin Strohmeier, Jens Schmitt

TL;DR

This paper addresses the security weaknesses of physical layer authentication methods for Low Earth Orbit (LEO) satellite signals, specifically those relying on Time Difference of Arrival (TDOA) signatures. Existing schemes that use a single reference receiver for TDOA signature calculation are vulnerable to coordinated multi-device attackers controlling multiple synchronized signal sources (e.g., multiple UAVs). Such attackers achieve high false positive rates (FPR) up to 40%, seriously undermining trustworthiness. To combat these attacks, the authors propose Chi-MERA, a novel authentication scheme that re-structures the TDOA signature calculation using a minimum spanning tree (MST)-based receiver graph and supplements it with multilateration (MLAT) residual analysis for robust multi-source discrimination. Extensive simulations using realistic satellite constellations (Starlink, Iridium, OneWeb) demonstrate that Chi-MERA reduces attacker false positives below 2% while maintaining false negatives under 3%, and its defense scales linearly with the number of receivers. This work pioneers multi-device attacker modeling in LEO satellite physical layer security and offers a practical path forward to harden orbit-based authentication schemes against sophisticated spoofing.

Key findings

• Multi-device attackers controlling multiple UAVs cause FPR levels above 35% up to 47% against current state-of-the-art orbit-based TDOA authentication (Fig. 2).
• Single reference receiver (RR) signature structure is a systemic root cause: attackers only optimize TDOAs involving the reference receiver, reducing attack complexity significantly.
• Using a Closest-Neighbour (CN) signature structure based on a Minimum Spanning Tree (MST) of receiver graph edges preserves full connectivity, reduces redundancy, and limits attack surfaces across receiver clusters (Fig. 3 and Eq. 4).
• Chi-MERA integrates MLAT residual (χ-parameter) analysis for signal source classification, discriminating orbit (satellite) vs non-orbit (single/multi-UAV) sources despite poor DOP conditions.
• Extensive simulations show Chi-MERA achieves FPR < 2% and false negative rates (FNR) < 3% across Starlink, Iridium, and OneWeb constellations with typical receiver deployments (Fig. 5-6).
• Chi-MERA's defense scales linearly: n receivers can reliably defeat attackers controlling up to n/2 synchronized devices with FPR < 1% (Fig. 7).
• MLAT localization is repurposed from precise location estimation to residual-based signal source discrimination in scenarios with unfavorable geometric dilution of precision.
• Optimizing decision procedures and signature graph structures jointly is needed to withstand coordinated multi-device spoofing, not mere increases in receiver density or single device defenses.

Threat model

The adversary is a well-resourced multi-device attacker controlling multiple UAVs or CubeSats capable of transmitting synchronized spoofing signals to multiple receivers. They know the approximate receiver locations, the authentication algorithm internals (including TDOA structures and reference receivers), and have access to public satellite orbit databases to optimize timing and spatial positioning of spoofed signals. The adversary cannot control or tamper with receiver hardware or desynchronize receivers, and has no access to cryptographic keys or internal satellite transmissions.

Methodology — deep read

The authors start with the threat model assuming powerful attackers who know receiver locations, system parameters, and can synchronize multiple UAVs to spoof satellite signals. They consider three attacker types: CubeSat (single high-altitude device), single UAV, and most critically, multi-UAV attackers coordinating synchronized transmissions with optimized locations and sending delays.

Data is synthesized through extensive simulations using real satellite TLE data for Starlink, Iridium, OneWeb constellations, and realistic receiver deployments—8 receivers placed in circular arrangements with variabilities to emulate real-world scenarios. The signal arrival times are simulated with Gaussian synchronization noise (100 ns std dev), producing TDOA signatures.

The baseline authentication algorithm from Jedermann et al. [11] is re-implemented to reproduce prior performance against single-device attackers, confirming vulnerability against multi-UAV attacks with false positive rates >35%. Root cause analysis identifies the single Reference-Receiver (RR) TDOA signature structure as the main weakness.

To improve, the authors propose Chi-MERA which revises two main parts: (1) The TDOA signature structure is changed from the RR scheme to a Closest-Neighbour (CN) signature determined by computing a Minimum Spanning Tree (MST) over receiver distance graphs. This preserves full TDOA information with minimal redundancy and evenly balances influence between receivers, impeding localized spoofing optimizations. (2) The decision procedure is enhanced by using multilateration (MLAT) residual analysis. Instead of precise localization, an iterative least squares solver estimates a position and calculates the residuals between measured and computed TDOAs. Large residuals indicate signal sources inconsistent with valid satellite orbits. The key parameter χ quantifies residual tightness for classification.

The MLAT solver is bounded within LEO altitude ranges, uses receiver centroids as initial estimates, and at least 3 TDOA pairs to solve for 3D positions. A statistical classification then discriminates orbiting satellites from UAV attacks.

Simulations evaluate Chi-MERA’s false positive and false negative rates across parameters like receiver number, spatial distribution, and attacker device counts. Attackers optimize UAV placement and transmit delays to best mimic satellite TDOAs, leveraging k-means clustering for distribution and synchronization within 100 ns.

Performance is analyzed across constellations and attacker strategies with 1000 runs per scenario. The MST-based signature structure combined with MLAT residual classification dramatically improves resistance to multi-device spoofing, exhibiting linear scaling of defense strength as receiver count grows.

Code is based on public implementations from [11], extended and adapted for the new signature structures and attacker models. The paper does not specify code release for Chi-MERA but emphasizes reproducibility through detailed parameter disclosures and use of publicly available TLE data.

Technical innovations

• Introduction of multi-device attacker models in LEO satellite authentication exposing vulnerabilities of prior single-reference receiver TDOA signature schemes.
• Design of a Closest-Neighbour TDOA signature structure using Minimum Spanning Tree to maintain full connectivity with minimal redundancy, balancing receiver influence and hindering cluster-wise spoofing.
• Use of multilateration residual (χ parameter) analysis not for precise localization but as a discriminator for signal source classification under poor DOP geometric conditions.
• Development of a distributed TDOA reference scheme avoiding dependence on any single reference receiver to reduce single points of failure exploitable by attackers.

Datasets

• Starlink constellation — ~10,000 satellites at 350–560 km altitude — public TLE data from CelesTrack
• Iridium constellation — 66 satellites at ~780 km altitude — public TLE data
• OneWeb constellation — 650 satellites at 1200 km altitude — public TLE data
• CubeSat attacker dataset — 55 real CubeSat orbits at 386–1223 km altitude — public orbit data [36]

Baselines vs proposed

• Reference-Receiver (RR) baseline: false positive rate (FPR) > 35% against multi-UAV attackers vs Chi-MERA: FPR < 2%
• RR baseline: false negative rate (FNR) ~4% vs Chi-MERA: FNR < 3%
• RR baseline with 4 UAVs vs 6 receivers: FPR up to 47% vs Chi-MERA with MST structure: FPR < 1% for attacker device ≤ n/2 receivers
• Single-UAV and CubeSat attackers: RR and Chi-MERA both achieve low FPR (<1%), showing main improvement is for multi-device cases

Figures from the paper

Figures are reproduced from the source paper for academic discussion. Original copyright: the paper authors. See arXiv:2607.19047.

Fig 1: The proposed χ-MERA algorithm is able to distinguish

Fig 2: Performance of the original authentication algorithm

Fig 4: Boxplot comparing the cost value of the MLAT for

Fig 5: System model diagram of the χ-MERA Algorithm

Fig 6: Performance of χ-MERA algorithm with CN structure

Fig 7: Performance of χ-MERA for different constellations

Fig 8: FPR for different receiver-to-UAVs ratios of the χ-

Limitations

• The scheme assumes accurate knowledge of receiver locations and synchronization within 100 ns; real-world errors or GPS outages may degrade performance.
• Simulations do not yet evaluate performance under distribution shifts such as more complex attacker mobility or non-line-of-sight conditions.
• Code and detailed parameters for Chi-MERA are not released, hindering direct reproducibility or real-world deployment testing currently.
• MLAT’s poor localization quality in LEO conditions limits potential future extension to fine-grained location verification beyond residual classification.
• No real-world RF experiment or over-the-air validation is presented, results are currently limited to simulated setups.
• Attacker synchronization error is assumed small but may be difficult to achieve practically for large numbers (> n/2) of UAVs.

Open questions / follow-ons

• How does Chi-MERA perform under real-world propagation effects, such as multipath, atmospheric disturbances, and non-line-of-sight conditions?
• Can machine learning or adaptive mechanisms improve classification beyond static MLAT residual thresholds for evolving attacker tactics?
• What is the effect of adding more receivers with irregular spatial distributions beyond circular arrays on defense scaling?
• How feasible is multi-device synchronization and delay optimization in real attack scenarios with more than n/2 attacker sources?

Why it matters for bot defense

This work is highly relevant to bot-defense and CAPTCHA practitioners who rely on physical-layer signal characteristics for authentication in distributed sensor networks. The paper highlights the critical risk posed by multi-device coordinated adversaries who can manipulate multi-receiver timing signatures to mimic legitimate sources. The Chi-MERA approach illustrates how rethinking signature structures and leveraging residual-based multilateration can significantly enhance resilience against such sophisticated spoofing. Similar principles—minimizing single points of failure in signature calculation and using geometric residual analysis—could be adapted to defend against botnets controlling multiple client devices in location or timing-based CAPTCHA challenges. The linear scaling insight also informs architectural decisions on receiver deployments for robust defense. Practitioners should carefully consider their threat model assumptions regarding attacker synchronization and spatial coordination capabilities, as this paper rigorously analyzes their impact in a complex real-world domain. Overall, the work provides a strong methodological template for designing multi-sensor authentication schemes robust to coordinated multi-source attackers.

Cite

@article{arxiv2607_19047,
  title={ Chi-MERA: Defending Orbit-Based Authentication of LEO Satellites with the Space Oddity of MLAT (Long Version) },
  author={ Sarah Jung and Eric Jedermann and Martin Strohmeier and Jens Schmitt },
  journal={arXiv preprint arXiv:2607.19047},
  year={ 2026 },
  url={https://arxiv.org/abs/2607.19047}
}

Read the full paper

• arXiv:2607.19047 (abstract)
• arXiv:2607.19047 (PDF)