Direct-to-Cell Satellite Radio Signal Traceback at Scale

Abstract

Direct-to-cell (DtC) satellites borrow licensed RF bands from terrestrial cellular networks to connect our phones anytime, everywhere. However, this spectrum sharing may introduce unexpected satellite RF signals into licensed bands, leading to interference across satellite and terrestrial networks. A prerequisite for addressing these issues is to trace which DtC satellite transmits these radio signals. However, our real-world measurements reveal that this basic task encounters three challenges unique to DtC satellites: inaccurate tracing after their RF pre-compensation for optimization, exhausting tracing to satellite mobility, and incomplete tracing due to dedicated monitoring systems' low coverage and high cost. We devise SatMon, a community-driven backtracer of DtC satellite RF signals at scale. Upon detecting signals of interest, SatMon traces their originating satellites by sensing their cross-user uplink synchronization under orbital constraints. This fingerprint is accurate despite signal pre-compensations. It is deployable not only on existing dedicated monitoring systems but also on ubiquitous regular phones. It also needs only sparse monitors and their existing measurements for wide-area, timely satellite signal tracing at low cost. SatMon has been released to the community and tested in 5 countries. Our real-world field tests and data-driven emulations using 203 million signaling records show that SatMon can identify DtC satellite transmitters at 96.7% accuracy using only two phones at low cost and is robust to radio interference.