Sungyeon Kim is a second-year master’s student in Cybersecurity at the Tallinn University of Technology. Before coming to Estonia, she completed dual bachelor’s degrees in Public Relations & Advertising and IT Engineering in South Korea. Her current research focuses on space cybersecurity, particularly the security of CubeSats and the identification ofvulnerabilities in satellite communication systems.
Heuristic-Based Detection of Encryption in CubeSat Downlink Frames Using Ground Station Data
The increasing deployment of CubeSats has led to a greater interest in assessing the security of their downlink communications. In particular, an understanding of the use of encryption can provide information regarding the potential for telemetry and sensor data exposure.
In this work, we present a heuristic-based approach to determine whether CubeSat downlink frames are encrypted. This utilised data collected from TalTech’s ground station operating in the 433–438 MHz band, at 9600 bps with FSK/GFSK modulation. Our method looked for encryption-like patterns using simple statistical features such as entropy, compression ratio (using zlib), and ASCII character ratio.
To validate the approach, we generated a synthetic random data set as a reference for fully randomised (encryption-like) behaviour. As expected, the random data shows high entropy and low compressibility, while the real satellite data shows more varied behaviour. In several cases, several satellites show elevated ASCII ratios, which suggest that parts of the data may be human-readable.
Across the analysed dataset, we did not find clear evidence of strong encryption. For frames with high ASCII ratios, we further examined the payload and found that some of the data can be directly interpreted as readable text. This suggests that parts of the transmitted data can be accessed and understood by third-party receivers.
Overall, this work shows that simple statistical heuristics can be used to assess whether CubeSat communications utilised encryption without requiring detailed knowledge of specific protocols. Our findings further suggest that some CubeSat transmissions may be vulnerable to unintended data exposure, which raises concerns about small satellite communication security.