NTN · 2026-07-01

HAPS and Stratospheric Backhaul: Identity Implications of 20km-Altitude Cell Towers

By J. W. Bouckaert

A third tier nobody modeled

Identity platforms grew up on a two-tier mental model of mobile infrastructure. Terrestrial macro cells on one side. LEO satellite handoffs, newly operational via Starlink Direct-to-Cell, on the other. Both tiers have been mapped, benchmarked, and priced into carrier-signal risk scoring.

The middle tier does not appear in most of those models. It is filling in quickly.

High-Altitude Platform Stations—solar-electric aircraft and lighter-than-air platforms operating in the stratosphere between roughly 18 km and 25 km—are graduating from demonstrator flights into commercial mobile backhaul. 3GPP Release 17 formalised HAPS as a first-class Non-Terrestrial Network node in 2022, distinct from both GEO and LEO. The programmes that survived Loon's January 2021 shutdown—Airbus-spinout AALTO with the Zephyr platform, SoftBank's Non-Terrestrial Solutions division (formerly HAPSMobile), Sceye in New Mexico, and Stratospheric Platforms Ltd—are now flying multi-week missions and signing MNO trials.

That matters for identity because a HAPS-served cell is a mobile base station at 20 km altitude, neither a terrestrial tower nor a satellite, holding station over a 200 km-diameter footprint and backhauled either directly to a ground gateway or laterally to a peer platform. The assumptions carrier-signal verification depends on—where the tower is, whose jurisdiction it sits in, what the round-trip latency should look like—all shift.

The middle tier today

Commercial HAPS in 2026 is not vaporware, and it is not a single architecture. Four programmes are meaningfully operational:

The engineering matters because it drives the identity behaviour. A HAPS platform at 20 km has three properties no other tier shares:

Propagation delay is a rounding error. Round-trip time from ground to a HAPS platform is approximately 0.13 ms—slower than a terrestrial macro cell, faster than a wireline metro hop, and orders of magnitude below LEO's 3–7 ms one-way. From a latency-baseline perspective, a HAPS-served subscriber looks almost indistinguishable from a rural macro-tower subscriber.

The footprint is geographically enormous but jurisdictionally singular. A single AALTO Zephyr on station covers roughly 50,000 km²—a footprint larger than Switzerland. Unlike a LEO satellite that sweeps across multiple jurisdictions in a single orbit, a HAPS holds station over one operator's licensed spectrum area. The cell it broadcasts is jurisdictionally clean but geographically ambiguous.

Cell identity is stable, but cell location is not. HAPS platforms drift within a station-keeping ellipse—typically several kilometres wide—and hand off between peer platforms during battery recovery cycles. The Cell Global Identity is stable in the way a terrestrial CGI is stable, but the geographic point the CGI represents is a moving target within a 200 km-wide disc.

Assumptions that break

Every meaningful carrier-signal primitive—SIM-swap detection, Number Verification, device-location cross-check, signal freshness TTLs—was designed against terrestrial infrastructure assumptions. Three of those assumptions break at 20 km.

Assumption 1: Geo-IP resolves to a physical location within a few kilometres

Geo-IP databases resolve terrestrial MNO IPs to the metro area of the serving core network. For most terrestrial subscribers the physical location of the device is within a 30 km radius of the geo-IP result. That is enough to power the "is this login coming from where the SIM says it should be" check that most fraud stacks rely on.

A HAPS-served subscriber's geo-IP still resolves to the MNO's core network egress—but the subscriber could be anywhere inside the platform's 50,000 km² footprint. The mismatch between the geo-IP result and the actual subscriber location, previously bounded to metro-area error, expands to something closer to province-area error.

Assumption 2: Latency variance reflects network state

Behavioural risk scoring uses carrier-API response latency variance as a signal. A subscriber whose SIM Swap query normally returns in 18 ms and suddenly returns in 60 ms is treated as anomalous—the working hypothesis is a routing change, a carrier-side degradation, or an interception attempt.

HAPS backhaul introduces a latency envelope no terrestrial subscriber ever sees: a very-low RTT to the platform (0.1–0.3 ms) that briefly widens to 15–25 ms during inter-platform handoffs, when a peer HAPS 200 km away picks up the cell while the original platform enters a battery-recovery loiter. The transition is a scheduled orbital-mechanics event rather than a network problem, and the identity platform cannot distinguish it from a genuine anomaly without HAPS-aware baselines.

Assumption 3: The tower and the subscriber share a jurisdiction

Terrestrial towers and their subscribers sit in the same regulatory zone almost by definition. The GSMA Open Gateway CAMARA APIs—SIM Swap, Number Verification, Device Location—assume that the response is produced by infrastructure in the subscriber's home jurisdiction.

HAPS complicates this in one specific way: cross-border stratospheric operations. AALTO's 2023 push to establish a Zephyr operating base in Kenya foreshadows a regulatory pattern where a stratospheric platform launched under one country's approvals can hold station over another under bilateral spectrum-lease arrangements. The subscriber would see a domestic MNO's cell; the physical infrastructure providing that cell would be nominally operated by a foreign entity. Whether the CAMARA response for such a subscriber crosses a data-residency boundary is unresolved in the current API specification.

Latency and coverage: HAPS vs the adjacent tiers

The identity implications become sharper when HAPS is placed on the same axis as the tiers on either side of it.

Two identity-relevant facts fall out of that table.

First, HAPS produces the lowest handoff frequency of any mobile-serving tier. A subscriber camped on a HAPS cell can stay on the same physical serving platform for a full working day. That reduces the number of GUTI reallocations and paging churn events per session—which is good for session continuity, but means that when a handoff does occur (platform swap, battery-recovery cycle), it is a rare event that risk models have thin baselines for.

Second, HAPS is the only tier where propagation delay is faster than several intra-metro terrestrial paths. A HAPS-backhauled subscriber can produce faster carrier-API round-trips than a subscriber served by a terrestrial cell whose backhaul routes through a distant core. Identity systems that treat "faster than expected" as an implicit trust signal—few explicitly do, but many implicitly do through anomaly-band definitions—will misinterpret HAPS responses.

Location consistency

The SIM has already answered who is the subscriber. The load-bearing question in most carrier-signal fraud checks is is this authentication happening from a place consistent with the subscriber's declared context. For terrestrial subscribers, geo-IP plus Device Location API responses answer that within useful precision. LEO handoff already erodes it, as we've written elsewhere. HAPS erodes it differently.

Consider a subscriber authenticating to a bank from a HAPS-served cell:

• Geo-IP resolves to the MNO's national core network egress. Precision: country-level.
• Device Location API returns the CGI of the HAPS cell. Precision: 100 km radius from the platform's station-keeping point.
• Behavioural latency baseline: normal to sub-normal. No anomaly signal.
• SIM-swap status: fresh. No anomaly signal.

Every signal reports green. Every signal is technically correct. And the fraud team has no way to answer "was this login from Nairobi or from Mombasa"—both cities can fall inside the same platform's footprint.

The failure mode is that carrier signals produce a correct answer at a resolution too coarse for the decision the fraud stack is trying to make. The answer itself is right.

Required adaptations

The identity-layer adaptations for HAPS are more modest than the adaptations for LEO Direct-to-Cell—the physics is friendlier—but they are not zero.

1. Signal-path metadata, again. The proposal in our Starlink handoff analysis—a signalPath field in CAMARA responses—needs a third enum value for HAPS-served subscribers, distinct from both terrestrial and LEO. Identity platforms need to know which physics they are looking at before they interpret the latency and location fields.

2. Footprint-aware location fuzzing. Device Location API responses for HAPS-served subscribers should carry an explicit precision annotation (e.g. a confidence radius) rather than the point-estimate CGI centroid that terrestrial responses provide. A 100 km confidence radius honestly reported is more useful for fraud decisioning than a 100 m centroid that is technically the platform's station-keeping midpoint.

3. Handoff-class differentiation. Inter-HAPS handoff is a scheduled orbital-mechanics event, not a network anomaly. Behavioural risk models need a handoff-class taxonomy—terrestrial soft handoff, LEO satellite pass, HAPS platform swap—with different anomaly weights per class.

4. Multi-pillar independence. The three-pillar model PasskeyBridge is built around—carrier signal, verifiable credentials, biometric binding—degrades gracefully when the carrier-signal pillar loses location precision. A W3C VC presentation carrying a signed jurisdictional claim, cross-referenced with a device-local WebAuthn assertion, does not care that the serving cell is a solar UAV at 20 km. That is the architectural bet: no single infrastructure tier owns the identity decision.

The middle tier is here to stay

Loon shutting down in 2021 taught the industry the wrong lesson. The lesson was not "stratospheric mobile infrastructure isn't viable". The lesson was "stratospheric mobile infrastructure isn't viable if you try to build it as balloons on Alphabet's timeline". The programmes that inherited Loon's problem space—Zephyr, Sunglider, Sceye, SPL—are running multi-week missions with defence, disaster-response, and MNO backhaul customers signed onto commercial contracts. ITU-R WRC-23 formally allocated HAPS-friendly spectrum in the 38–39.5 GHz band. The 3GPP work item for Release 19 HAPS mobility is in flight.

For identity platforms, the operational implication is that HAPS traffic will start showing up in production carrier-signal streams without warning. There is no consumer-facing branding for "your call was routed via a Zephyr" the way there is for "your text was sent by satellite". The platform is just another cell to the phone, just another CGI to the fraud stack, just another green light on the risk dashboard—until someone asks the platform to answer "is this user where they claim to be" and the platform confidently answers "somewhere within 100 km of a solar UAV".

PasskeyBridge's answer is the same answer it gives to LEO handoff, to encrypted-tunnel obfuscation, to any single-signal degradation: don't let one physical tier own the identity decision. The three-pillar architecture that survives Starlink handoff also survives HAPS backhaul, because the pillars that don't depend on the serving cell's precision—VCs and biometrics—carry the trust when the pillar that does starts losing resolution.

The phone still doesn't know it's talking to a stratospheric aircraft. The identity platform has to.

Start free · Test the API