LPG: Raise Your Location Privacy Game in Direct-to-Cell LEO Satellite Networks

Multi-tenant direct-to-cell (D2C) Low Earth Orbit (LEO) satellite networks pose significant risks to users' location privacy by linking Mobile Network Operator (MNO)-managed identities with Satellite Network Operator (SNO)-visible locations. Existing privacy solutions are ill-suited to the resourceconstrained hardware and orbital dynamics of these satellite environments. We present LPG (Location Privacy Game), the first protocol-layer solution offering user-configurable location privacy for D2C LEO. LPG achieves this via identitylocation decoupling: SNOs provide connectivity without visibility of user identity, while MNOs manage service and billing without access to precise location information. LPG enables offline secure authentication and key agreement without revealing user identity to satellites, supports user-configurable location disclosure at chosen geographic granularity for essential service needs, and ensures fair billing between MNOs and SNOs through privacy-preserving settlement. Our implementation on a real-world in-orbit LEO satellite and commercial mobile phones demonstrates that LPG is practical and viable in resource-constrained, highly-dynamic LEO environments. SNO UE MNO User identity User location A. Current D2C architecture. B. Directly migrate terrestrial solution LOCA to D2C LEO architecture. C. LPG (Our proposed approach).