Signal Structure of the Starlink Ku-Band Downlink (2023) [pdf]

Signal Structure of the Starlink Ku-Band Downlink Todd E. Humphreys∗, Peter A. Iannucci∗, Zacharias M. Komodromos†, Andrew M. Graff† ∗Department of Aerospace Engineering and Engineering Mechanics, The University of Texas at Austin †Department of Electrical and Computer Engineering, The University of Texas at Austin Abstract—We develop a technique for blind signal identifica- tion of the Starlink downlink signal in the 10.7 to 12.7 GHz band and present a detailed picture of the signal’s structure. Im- portantly, the signal characterization offered herein includes the exact values of synchronization sequences embedded in the signal that can be exploited to produce pseudorange measurements. Such an understanding of the signal is essential to emerging efforts that seek to dual-purpose Starlink signals for positioning, navigation, and timing, despite their being designed solely for broadband Internet provision. Index Terms—Starlink, signal identification, positioning, time synchronization, low Earth orbit I. INTRODUCTION In addition to revolutionizing global communications, recently-launched broadband low-Earth-orbit (LEO) mega- constellations are poised to revolutionize global positioning, navigation, and timing (PNT). Compared to traditional global navigation satellite systems (GNSS), they offer higher power, wider bandwidth, more rapid multipath decorrelation, and the possibility of stronger authentication and zero-age-of- ephemeris, all of which will enable greater accuracy and greater resilience against jamming and spoofing [1]–[5]. With over 3000 satellites already in orbit, SpaceX’s Starlink constellation enjoys the most mature deployment among LEO broadband providers. Recent demonstrations of opportunistic Doppler-based positioning with Starlink signals [6]–[8] open up exciting possibilities. But whether Starlink signals are more generally suitable for opportunistic PNT—not only via Doppler positioning—and whether they could be the basis of a full-fledged GNSS, as proposed in [5], remains an open ques- tion whose answer depends on details of the broadcast signals, including modulation, timing, and spectral characteristics. Yet whereas the orbits, frequencies, polarization, and beam pat- terns of Starlink satellites are a matter of public record through the licensing databases of the U.S. Federal Communications Commission [9], details on the signal waveform itself and the timing capabilities of the hardware producing it are not publicly available. We offer two contributions to address this knowledge gap. First, we develop a technique for blind signal identification of the Starlink downlink signal in the 10.7 to 12.7 GHz band. The technique is a significant expansion of existing blind orthogonal frequency division multiplexing (OFDM) signal identification methods (see [10]–[12] and the references therein), which have only been successfully applied to simu- lated signals. Insofar as we are aware, blind identification of operational OFDM signals, including exact determination of synchronization sequences, has not been achieved previously. The technique applies not only to the Starlink Ku-band down- link but generally to all OFDM signals except as regards some steps required to estimate synchronization structures that are likely unique to Starlink. Second, we present a detailed characterization of the Star- link downlink signal structure in the 10.7 to 12.7 GHz band. This applies for the currently-transmitting Starlink satellites (versions 0.9, 1.0, and 1.5), but will likely also apply for version 2.0 and possibly later generations, given the need to preserve backward compatibility for the existing user base. Our signal characterization includes the exact values of syn- chronization sequences embedded in the signal that can be exploited to produce pseudorange measurements. Combining multiple pseudorange measurements to achieve multi-laterated PNT, as is standard in traditional GNSS, enables faster and more accurate opportunistic position fixes than the Doppler- based positioning explored in [6]–[8], [13]. and can addition- ally offer nanosecond-accurate timing, whereas even under the optimistic scenario envisioned in [13], extracting timing from Doppler-based processing of LEO signals yields errors on the order of 0.1 to 1 ms. II. SIGNAL CAPTURE To facilitate replication of our work, and as a prelude to our presentation of the signal model, we begin with a detailed description of our signal capture system. One might reasonably wonder whether a standard consumer Starlink user terminal (UT) could be modified to capture wide- band (hundreds of MHz) raw signal samples for Starlink signal identification. Not easily: operating the UT as development hardware, which would permit capture of raw signal samples, requires defeating security controls designed specifically to prevent this. Moreover, the clock driving the UT’s downmixing and sampling operations is of unknown quality and would therefore taint any timing analysis of received signals. We opted instead to develop our own system for Starlink signal capture. Composed of off-the-shelf hardware and cus- tom software, the system enables signal capture from one Starlink satellite at a time with downmixing and sampling referenced to a highly-stable GPS-disciplined oscillator. Whereas the consumer Starlink UT operates as a phased array of many separate antenna elements, our antenna is a steerable 90-cm offset parabolic dish with a beamwidth of approximately 3 degrees. Starlink orbital ephemerides pro- vided publicly by SpaceX guide our selection and tracking of overhead satellites. Only one or two Starlink satellites illuminate a coverage cell at any one time with a data-bearing beam [5]. To guarantee downlink activity, we solicit data by Copyright © 2023 by Todd E. Humphreys, Peter A. Iannucci, Zacharias M. Komodromos, and Andrew M. Graff August 2023 version of paper published in TAES downloading a high-definition video stream through a standard Starlink UT co-located with our signal capture system. Fig. 1 outlines our signal capture hardware and signal pathways. A parabolic dish focuses signals onto a feedhorn connected to a low-noise block (LNB) with a conversion gain of 60 dB and a noise figure of 0.8 dB. The LNB is dual- band, downconverting either 10.7–11.7 GHz (the lower band) to 950–1950 MHz, or 11.7–12.75 GHz (the upper band) to 1100–2150 MHz. The antenna’s nominal gain is 40 dBi at 12.5 GHz, but there are losses of at least 4-5 dB due to lack of a circular-to-linear polarizer and to feedhorn misalignment. The signal capture system allows selection between narrow- band (∼ 60 MHz) and wideband (∼ 1 GHz) signal capture modes. For the narrowband mode, the output of the LNB is fed to a transfer switch that diverts the signal through a tunable bandpass filter for image rejection. Downstream hardware then performs downmixing (consistent with the selected band), additional bandpass filtering, and 16-bit complex sampling at 62.5 Msps. The downmixing operation in the LNB and the downmixing and sampling operations in the downstream hardware are phase-locked to a common GPS-disciplined oven-controlled crystal oscillator (OCXO) to minimize the effects of receiver clock variations on the received signals. A 3-TB data storage array permits archival of several hours of continuous data. Anti-alias filtering prior to sampling reduces the usable bandwidth of the narrowband mode to approximately 60 MHz. Although this is much narrower than a single Star- link channel, multiple overlapping captures can be combined for a comprehensive analysis of all embedded narrowband structures, as will be shown. However, the narrowband mode cannot support a synoptic signal analysis. A second capture mode—the wideband mode—addresses this deficiency. Based on direct digital downconversion of 12-bit samples at 4096 Msps (real), the wideband mode is capable of alias-free capture of the LNB’s entire lower band and most of its upper band. The wideband mode’s limitations are storage, timing, and noise figure: our current hardware permits only 1-second segments of contiguous data to be captured before exhausting the onboard memory, the sampling is not driven by the same clock used for LNB downmixing (due to hardware limitations), and the noise figure results in captured signals with a signal- to-noise ratio (SNR) that is significantly worse than for the narrowband mode. For the analysis described subsequently, signal identifica- tion was based on narrowband-mode-captured data except for estimation of the primary synchronization sequence. III. SIGNAL MODEL Given its widespread use in wireless communications, one might expect OFDM [14]–[18] to be the basis of the Ku- band Starlink downlink. However, OFDM has historically been avoided in satellite communications systems because its high peak-to-average-power ratio leads to inefficient transmit power conversion [19]. Nonetheless, inspection of the Starlink power spectrum generated from captured data reveals spectrally-flat frequency blocks with sharp edges, hallmarks consistent with an OFDM hypothesis. Proceeding under the assumption of an OFDM model, the problem of general signal identification narrows to one of identifying the values of parameters fun- damental to OFDM signaling. This section introduces such parameters as it presents a generic OFDM signal model and a received signal model. A. Generic OFDM Signal Model The serial data sequence carrying an OFDM signal’s infor- mation is composed of complex-valued symbols drawn from the set {Xmik ∈ C : m, i, k ∈ N, k < N, i < Nsf} at a rate Fs, known as the channel bandwidth. The subscript k is the symbol’s index within a length-N subsequence known as an OFDM symbol, i is the OFDM symbol’s index within a length-Nsf sequence of OFDM symbols known as a frame, and m is the frame index. Each symbol Xmik encodes one or more bits of information depending on the modulation scheme (e.g., 1 for BPSK, 2 for 4QAM, 4