NTN · 2026-03-22

Non-Terrestrial Trust Anchors for Identity

By J. W. Bouckaert

The coverage ceiling

Every identity system deployed at global scale today shares a dependency that its architects rarely discuss: terrestrial carrier infrastructure.

Carrier-signal verification—SIM-swap detection, number-porting alerts, device-binding attestation—relies on a chain of ground-based infrastructure: cell towers, fiber backhaul, carrier API gateways, and the signaling networks (SS7/Diameter) that connect them. This infrastructure is dense and reliable in urban corridors. It is sparse at sea. It is absent at altitude. And it is fragile in exactly the scenarios where identity verification matters most: natural disasters, contested environments, and the expanding frontier of remote industrial operations.

The assumption that an identity signal can always reach a terrestrial carrier is a coverage ceiling. It is not visible in the markets where most identity platforms are designed—financial services in North America, e-commerce in Western Europe—but it is already constraining adoption in maritime, aviation, energy, defense, and the growing category of autonomous systems that operate beyond the reach of any cell tower.

The problem exists today, and the telecommunications industry is already building the infrastructure that addresses it.

3GPP NTN standards

The 3rd Generation Partnership Project (3GPP) introduced Non-Terrestrial Network (NTN) specifications in Release 17, frozen in 2022. Release 17 covered both 5G NR over satellite (NR-NTN) and NB-IoT and eMTC over satellite (IoT-NTN), using transparent payloads that relay the signal to a ground base station. Release 18, frozen in 2024, added optimizations for both, including coverage enhancements and mobility between satellite and terrestrial cells. Release 19, frozen in September 2025, adds regenerative payloads, which put base-station functions on the satellite itself.

The standards so far:

The critical implication for identity systems is this: 3GPP NTN standardizes the radio interface between a device and a satellite as a first-class access network. A device connected via LEO satellite is, from the network's perspective, as authenticated as one connected via a macro cell. The SIM, the IMSI, the SUPI—all function identically. The carrier-signal primitives that identity platforms rely on (number verification, SIM-status queries, fraud-risk scoring) are architecturally available over satellite links.

The constraint is not the standard. The constraint is the carrier API ecosystem, which has not yet extended its verification endpoints to satellite-connected subscribers. That gap is closing.

The LEO constellation buildout

Three mega-constellations are driving the infrastructure buildout:

SpaceX Starlink. Starlink operates the largest LEO fleet, with thousands of active satellites in shells between roughly 340 km and 570 km. Its direct-to-cell satellites carry an eNodeB modem and appear to an unmodified phone as a standard LTE cell. With T-Mobile, the service opened a public beta in February 2025, launched commercially as T-Satellite in July 2025 with text messaging, and added data for selected apps in October 2025.

Amazon Leo (formerly Project Kuiper). The FCC authorized Amazon's constellation of 3,236 satellites in July 2020, in three shells at 590 km, 610 km and 630 km. Two prototype satellites launched in October 2023, and the first 27 production satellites launched in April 2025. Amazon's stated enterprise use cases include maritime connectivity, aviation backhaul and industrial IoT, all segments where terrestrial identity signals are absent.

Eutelsat OneWeb. Following the Eutelsat-OneWeb merger completed in 2023, the combined company operates a first-generation fleet of more than 600 LEO satellites at about 1,200 km altitude. OneWeb's focus on enterprise and government connectivity positions it as a backhaul provider for remote-site identity verification—oil platforms, mining operations, and maritime fleets.

LEO satellites orbit far closer than geostationary ones, so the round trip through them is a small fraction of a GEO link's, and identity checks that time out over GEO become practical over LEO.

Connectivity-degraded environments: The market driver

The market for identity in connectivity-degraded environments is large, underpenetrated, and growing.

Maritime. The global maritime industry employs approximately 1.9 million seafarers and operates over 100,000 commercial vessels. Crew identity verification, port-state access control, and financial transaction authentication at sea currently rely on VSAT (Very Small Aperture Terminal) links with latencies of 600 ms or more and bandwidth caps that make real-time carrier-signal verification impractical. LEO constellations reduce maritime connectivity latency by an order of magnitude and make shipboard identity verification architecturally feasible.

Aviation. In-flight connectivity is transitioning from geostationary satellite links (GEO, 35,786 km altitude, 550+ ms latency) to LEO-based systems. Airlines are evaluating passenger authentication, crew identity management, and secure cockpit communications over LEO links. The International Air Transport Association (IATA) runs One ID, a program for digital identity across the air-travel journey, and LEO links bring that kind of verification within reach in flight.

Remote Infrastructure. Oil and gas platforms, mining sites, wind farms, remote data centers, and agricultural operations in regions without reliable cellular coverage require identity verification for physical access control, SCADA system authentication, and regulatory compliance. These environments are early adopters of LEO connectivity and represent a high-value segment for identity platforms that can operate over satellite links.

Defense and Government. Contested and austere environments—where terrestrial infrastructure may be destroyed, denied, or untrusted—represent the most demanding use case for satellite-anchored identity. NATO's Federated Mission Networking (FMN) framework specifies identity federation across coalition networks, many of which rely on satellite backhaul. Identity systems that depend only on terrestrial carrier APIs cannot operate in these environments.

Autonomous Systems. Autonomous vessels, high-altitude UAVs, and orbital platforms operate beyond terrestrial coverage by definition. As these systems proliferate, they require identity delegation, attestation, and revocation capabilities that function without a ground-based carrier signal. The agent-to-agent identity frameworks emerging for AI-driven autonomous systems will need satellite-native trust signals from inception.

Three gaps in satellite-connected environments

The identity industry's dependency on terrestrial carrier signals creates three specific gaps in satellite-connected environments:

1. Signal availability. Carrier-signal verification APIs (Vonage Number Insight, Twilio Lookup, Sinch Verification) were built around terrestrial subscribers. A device connected through Starlink's direct-to-cell service may present a valid MSISDN, but any fraud scoring a provider applies was developed on terrestrial network behavior, and its results for satellite-connected devices have not been characterized publicly.

2. Latency tolerance. Identity verification flows with tight timeouts can fail when the path includes a satellite hop. The serving satellite also changes as satellites move overhead, and the latency shifts with each change, so identity systems need to tolerate variable latency without treating it as a threat signal.

3. Offline verification. Satellite connectivity, unlike terrestrial LTE, is not continuous in all deployment scenarios. Polar regions, equatorial gaps in early-deployment constellations, and shipboard antenna occlusion create periods of disconnection that range from seconds to minutes. Identity systems that cannot verify credentials, validate cached trust proofs, or execute threat playbooks during connectivity gaps are operationally incomplete for satellite-dependent environments.

Satellite-derived trust signals: A new primitive

The LEO constellation buildout does not merely extend terrestrial identity signals to new geographies. It creates an entirely new category of trust signal that has no terrestrial equivalent.

Orbital kinematics. A LEO satellite at 550 km altitude travels at approximately 7.6 km/s relative to the Earth's surface. The Doppler shift experienced by a ground-based receiver changes continuously as the satellite traverses the sky. This Doppler drift rate—the rate of change of the observed frequency shift—is a function of the satellite's velocity, altitude, and the receiver's geographic position. It is predictable (governed by orbital mechanics), specific to a place and moment (the geometry at any given second is unique), and independently verifiable (anyone with the satellite's Two-Line Element set can compute the expected drift for any location and time).

That makes it a different kind of signal from anything in terrestrial networks. A cell tower is stationary, and its signal characteristics are static. A LEO satellite is in constant motion, so a spoofer has to simulate a signal whose Doppler drift matches the real orbit for the claimed location and time, which is harder than replaying a recording.

Constellation geometry. At any given moment, a receiver at a specific location can observe a unique subset of satellites from a given constellation. The set of visible satellites, their relative positions, and their individual Doppler signatures form a constellation geometry fingerprint that is unique to that location and time. This fingerprint can be used as an entropy source for cryptographic operations or as an attestation signal that proves the device was at a specific location during a specific orbital pass.

Handover timing. As LEO satellites move across the sky, the serving satellite for a given device changes many times an hour. The timing of these handovers, the sequence of serving satellites, and the signal-strength transitions during handover form a pattern that can be cross-referenced against predicted orbits. An adversary spoofing a satellite-connected identity would need to reproduce the handover sequence, Doppler drift and constellation geometry consistently at once.

The strategic differentiator

For identity platforms operating at global scale, satellite-derived trust signals are useful; what decides the outcome is whether the platform's architecture can ingest them.

Identity systems designed around a single trust primitive—carrier signals, or passkeys, or verifiable credentials—will hit the coverage ceiling when their customers deploy in satellite-dependent environments. Systems designed around a multi-pillar architecture, where carrier signals are one input among several, can integrate satellite-derived signals as an additional pillar without architectural disruption.

The constellations are launching, and the 3GPP standards are published. What remains open is whether carrier APIs extend their verification endpoints to satellite-connected subscribers, and which identity platforms can ingest the new signals when they do.

PasskeyBridge has filed a provisional patent application for NTN Kinematic Trust Anchoring—a system that utilizes LEO satellite Doppler-shift variance as an entropy source and attestation signal for identity verification in non-terrestrial environments. The filing establishes priority on the core methodology without constraining the implementation to a specific constellation or orbital regime. This is forward-looking R&D, positioned to integrate with the platform's existing three-pillar architecture as carrier API ecosystems extend to satellite-connected subscribers.

The timeline so far

• 2020: The FCC authorizes Amazon's 3,236-satellite constellation.
• 2022: 3GPP Release 17 is frozen, with NR-NTN and IoT-NTN.
• 2023: Eutelsat and OneWeb complete their merger. Amazon launches two prototype satellites.
• 2024: 3GPP Release 18 is frozen.
• 2025: T-Mobile and Starlink open a direct-to-cell beta in February, launch T-Satellite in July and add app data in October. Amazon launches its first production satellites in April. 3GPP Release 19, with regenerative payloads, is frozen in September.

Identity systems that use carrier signals as one input among several can add satellite-derived signals as carrier APIs begin to expose them.

Start free · Test the API