An Empirically Validated, Resilient SDR‐Based CubeSat Communication Architecture Featuring Dynamic AES‐256 and Deterministic Frequency Hopping

ABSTRACT

CubeSats are widely used in low‐cost space missions, but their dependence on commercial off‐the‐shelf (COTS) components and limited onboard resources creates security challenges for telemetry, command, and mission‐data links. This study presents a Software‐Defined Radio (SDR)‐based secure communication architecture evaluated in laboratory conditions for resource‐constrained CubeSat applications. The prototype combines dynamic AES‐256 key rotation, a deterministic 58‐channel Dynamic Channel Switching (DCS) protocol, and a mutual authentication (MuA) mechanism over LoRa modulation. A STRIDE‐based threat model is used to identify relevant attack surfaces and examine the proposed countermeasures for spoofing, replay, information disclosure, and denial‐of‐service scenarios. The system was evaluated through simulation, SDR‐based radio‐frequency (RF) laboratory tests, and hardware‐in‐the‐loop power profiling. The software implementation of AES‐256 required a processing window of 327 μs and accounted for less than 0.02% of the measured packet‐transmission energy. In the tested Partial‐Band Noise Jammer (PBNJ) scenario, where 6 of 58 messaging channels were jammed, the packet error rate remained close to 10%, consistent with the fraction of jammed channels. These results show that dynamic key rotation and channel switching can be implemented in a laboratory CubeSat communication prototype with low processing and energy overhead.