At 03:02 UTC on February 24, 2022—roughly one hour before Russia invaded Ukraine—large numbers of subscriber modems using the KA-SAT satellite network over Europe suddenly went offline. Thousands of subscribers in Ukraine and tens of thousands across Europe were affected directly or indirectly. To restore service, the operator, Viasat, had to rush nearly 30,000 replacement modems to distributors [1]. Enercon, a leading German manufacturer of onshore wind turbines, also reported that the satellite communications outage simultaneously disrupted the remote monitoring and control network for 5,800 of its wind turbines in Central Europe [2].
The incident went beyond the one-dimensional framing of a ‘KA-SAT satellite hack.’ Researchers at Johns Hopkins University who analyzed the event explained that, as illustrated in Figure 1, the attack traffic merely passed through the space segment; the space segment itself was not the direct target [3]. This incident clearly shows that satellite communications security is not limited to the satellite alone. It is an end-to-end system issue spanning terrestrial management networks, gateways, and user terminals.
Figure 1. Simplified flow based on public analyses of the KA-SAT attack [1][3]
Satellite communications networks may be largely invisible to us, but they are already deeply woven into the critical infrastructure of everyday life. Before discussing satellite security, this article first compares today’s 5G NTN architecture with the 6G NTN architectures now under study, and then examines the shift from a cybersecurity perspective.
Three Concepts to Distinguish: 5G, 5G NTN, and 6G
5G and 6G refer to generations of mobile communications systems. NTN (Non-Terrestrial Network) refers to an approach that connects non-terrestrial nodes, such as satellites and high-altitude platforms, to a mobile network. Table 1 summarizes the distinctions.
Table 1. Distinguishing Terrestrial 5G, 5G NTN, and 6G NTN
| Term | Description | Status |
| Terrestrial 5G | Conventional mobile architecture in which a device connects to the 5G core through a terrestrial base station | Commercially deployed |
| 5G NTN | Architecture that integrates satellite or other non-terrestrial access into 5G standards | Standardization and commercialization underway since 3GPP Release 17 |
| 6G NTN | Next-generation research direction aimed at tighter integration between satellites and terrestrial networks | Early stages of research and standardization as of August 2026 |
Basic Terrestrial 5G Architecture and the Role of Satellites
A conventional 5G mobile network can be simplified into three elements:
- User equipment (UE): User devices such as smartphones and IoT devices
- Radio access network (RAN): A base station (gNB) connected wirelessly to the UE
- 5G core network (5GC): The core network responsible for authentication, mobility management, policy and charging, and connectivity to external data networks
As shown in Figure 2, the basic 5G communication path can be viewed as ‘UE → base station → 5G core network → Internet (external data network).’ A satellite is not a required component of a conventional terrestrial 5G network. It can, however, provide backhaul* between the base station and the core network.
* Backhaul: An intermediate communications link that carries and connects traffic aggregated from edge devices—such as user equipment, base stations, and Wi-Fi routers—to the backbone (core network or Internet).
Figure 2. Basic communication flow in terrestrial 5G
Since commercial deployment began in 2019, 5G has spread rapidly. However, networks centered on terrestrial base stations face economic and resilience limitations in places where power and backhaul connectivity are difficult to secure, including oceans, mountains, deserts, and disaster areas. Backhaul can be provided not only through fiber-optic cables, but also through microwave or satellite links. In other words, the challenge is not simply the absence of wired networks, but the overall cost and practical conditions involved in building and maintaining terrestrial infrastructure. According to the International Telecommunication Union’s 2025 statistics, 74% of the global population uses the Internet, yet approximately 2.2 billion people remain offline. Internet usage is 85% in urban areas but only 58% in rural areas [4]. NTN has therefore emerged and evolved as a way to address these terrestrial-network limitations—particularly gaps in geographic coverage and the need for resilient connectivity during disasters.
5G NTN: Connecting Devices and Satellites Within the 5G Standard
The 3rd Generation Partnership Project (3GPP), which develops global mobile communications standards, first incorporated NTN into normative specifications in Release 17 in 2022. At a high level, NTN is divided into NR-NTN for devices based on NR (New Radio), and IoT-NTN for low-power devices using NB-IoT or eMTC* [5].
* NB-IoT (Narrowband Internet of Things): a narrowband technology for the Internet of Things. eMTC (enhanced Machine Type Communication): enhanced machine-type communications.
NR-NTN in 3GPP Release 17 focused on transparent payloads, often described as ‘bent-pipe’ payloads [5]. As shown in Figure 3, a transparent satellite acts as a relay: it converts and amplifies the received radio-frequency signal and forwards it to the ground, while the base-station (gNB) functions and 5G core network remain on the ground. 3GPP TR 38.821 likewise indicates that supporting access through a transparent satellite does not require fundamental changes to the existing NG-RAN (Next Generation Radio Access Network) architecture [6]. This approach can complement the geographic coverage and resilience of terrestrial 5G.
Figure 3. Transparent payload architecture [6]
Next-Generation Satellite Communications: 6G NTN
| ※ As of 2026, 6G is not yet a completed standard. 3GPP Release 20 is conducting 6G studies, and the first normative 6G specifications are expected in Release 21 [7][8]. The discussion below therefore describes directions under consideration in standardization and research projects, not features already finalized for 6G. |
The transition from 5G NTN to 6G NTN can be summarized in three main directions of evolution and expansion. One important point is that regenerative payloads and inter-satellite links (ISLs) are not entirely new concepts appearing for the first time in 6G. These architectures are already addressed in the 5G-Advanced NTN standards of 3GPP Release 19. For 6G, the discussion is moving toward tighter integration and further advancement across multilayer and multi-operator environments [5][10]. The three major directions are:
1. Regenerative payloads and onboard processing: As shown in Figure 4, a regenerative payload does more than relay signals. It performs some or all gNB functions onboard the satellite. Depending on the payload capabilities and functional split, the satellite may also handle functions such as routing, resource management, and edge processing [5][10].
2. Inter-satellite links: With an inter-satellite link (ISL), the satellite serving a user can reach a ground gateway through another satellite even when it does not have direct visibility of a gateway at that moment. As a result, the serving satellite is less dependent on maintaining a direct connection to the same gateway at all times. This increases routing flexibility and can help maintain service continuity [10].
3. Multilayer integration across GEO, MEO, LEO, and HAPS: The International Telecommunication Union’s IMT-2030 framework identifies ubiquitous connectivity as one of 6G’s core usage scenarios [9]. A D3.7 report from the 6G-NTN consortium, supported by the EU’s Horizon Europe/SNS JU program, also presents a three-dimensional multilayer architecture that combines geostationary orbit (GEO), medium Earth orbit (MEO), low Earth orbit (LEO), high-altitude platform stations (HAPS), and terrestrial networks [10].
Figure 4. Regenerative payload architecture [6][10]
Together, these directions could increase flexibility in route selection and resource use across satellite and terrestrial networks, helping improve coverage and service continuity.
Viewing the New Architecture Through a Security Perspective
In the 6G NTN architectures discussed so far, the number of components, interfaces, and operating entities increases, while their relationships become more complex. This can expand both the attack surface and the scope of security management. Protecting assets in such an environment requires more than listing cyber threats. We need to systematically identify the assets to protect, data flows, external dependencies, adversaries, trust boundaries, plausible misuse scenarios, and corresponding mitigations. This process is commonly called threat modeling.
Terrestrial 5G is already complex because of virtualization, network slicing, and multi-operator arrangements. NTN adds moving satellites, time-varying space links, gateways and satellite operations, as well as multiple orbital and cloud service providers. As a result, data paths and lines of responsibility can change more substantially. Three areas deserve particular attention from a security perspective:
1. Shifting trust boundaries: NIST IR 8270 explains that a satellite operations architecture may be controlled by a single operator or divided among multiple public, commercial, and private owners [11]. NIST IR 8441 defines a hybrid satellite network as a combination of independently owned and operated terminals, antennas, satellites, payloads, and other components. Because assurance levels may differ across components, the report emphasizes evaluating both the interfaces among participants and the security posture of each component [12]. When dynamic routing and handovers, along with changes in serving satellites and gateways, are added, the trust zones traversed by traffic can also change over time [10]. In short, security boundaries exist across multiple layers of organizations and interfaces. We therefore need to map not only the current route, but also which new trust zones are crossed when that route changes—and where authentication, encryption, policy enforcement, and log collection take place.
2. Distributed observation points: In a transparent-payload NTN, user traffic passes through a satellite to a ground gateway and then to the gNB and 5GC. Security controls and observation points, however, are distributed across the gateway, gNB, 5GC, management network, and other locations. With regenerative payloads, ISLs, and multiple gateways, the traffic path and some processing locations may change. Logs and detections from the satellite, ISLs, gateways, and core network must therefore be correlated, and security policies must remain consistent even as the route changes, as illustrated in Figure 5.
3. Difficult recovery and lifecycle management: Satellites can also be updated and reconfigured remotely, but unlike terrestrial equipment, their components are difficult to replace through direct physical access. Many satellite systems operate for long periods with limited power, computing, and communications resources, and the range of design changes narrows after launch. Threat models must therefore cover the entire lifecycle: supply-chain and development security, secure remote updates, cryptographic key rotation, failure-recovery modes, and the handling of credentials and data at end of mission.
Figure 5. Example shifts in observation and policy-enforcement points between transparent (top) and regenerative (bottom) payloads
Conclusion
5G NTN is extending mobile coverage to places that terrestrial infrastructure has difficulty reaching. Meanwhile, 6G NTN research is moving toward integrating multiple orbits, platforms, and terrestrial networks to make mobility and resource management across TN and NTN more flexible. This article has offered a conceptual look at these architectural changes and the security considerations they introduce.
6G NTN security remains a cutting-edge field, with standardization and focused research actively underway worldwide. In step with this international movement, our research team is conducting follow-up work based on the architecture and security perspectives presented here. This work identifies key assets and interfaces in 6G NTN environments and develops practical threat scenarios step by step. We hope you will stay tuned and support the research findings to come.
References
[1] Viasat, “KA-SAT Network cyber attack overview,” 2022. 3. 30. https://www.viasat.com/perspectives/corporate/2022/ka-sat-network-cyber-attack-overview/
[2] “Satellite outage affects remote control of 5,800 Enercon turbines,” Renewables Now, 2022. 3. 1. https://renewablesnow.com/news/disrupted-satellite-connection-hits-5800-enercon-turbines-report-775234/
[3] N. Boschetti, N. G. Gordon, G. Falco, “Space Cybersecurity Lessons Learned from the ViaSat Cyberattack,” AIAA ASCEND 2022. https://doi.org/10.2514/6.2022-4380
[4] ITU, “Facts and Figures 2025 – Measuring digital development,” 2025. 11. https://www.itu.int/itu-d/reports/statistics/facts-figures-2025/
[5] 3GPP, “Non-Terrestrial Networks (NTN),” 2024. 5. 14. https://www.3gpp.org/technologies/ntn-overview
[6] 3GPP TR 38.821 V16.0.0 (2019-12), Solutions for NR to support non-terrestrial networks (NTN), Release 16. §4.1 Figure 4.1-1 및 Figure 4.1-2, §5.1, §5.1.3, §5.2.1. https://www.3gpp.org/ftp/Specs/archive/38_series/38.821/
[7] 3GPP, “Release 20.” https://www.3gpp.org/specifications-technologies/releases/release-20
[8] 3GPP, “Release 21.” https://www.3gpp.org/specifications-technologies/releases/release-21
[9] Recommendation ITU-R M.2160-0, “Framework and overall objectives of the future development of IMT for 2030 and beyond,” 2023. 11. https://www.itu.int/rec/R-REC-M.2160
[10] 6G-NTN Project, “D3.7 Report on 3D Multi Layered NTN Architecture,” 2026. 2. https://6g-ntn.eu/wp-content/uploads/2026/02/6G-NTN_D3.7_r1_v00.pdf
[11] M. Scholl, T. Suloway, “Introduction to Cybersecurity for Commercial Satellite Operations,” NIST IR 8270, 2023. 7. https://doi.org/10.6028/NIST.IR.8270
[12] J. McCarthy et al., “Cybersecurity Framework Profile for Hybrid Satellite Networks (HSN),” NIST IR 8441, 2023. 9. https://doi.org/10.6028/NIST.IR.8441
KAIST 사이버보안연구센터 사이버위협분석팀 연구원으로 AI에이전트 보안과 위협모델링 연구를 수행하고 있다.