Low‑earth-orbit satellite links are a fast-growing option for operators to extend mobile coverage into sparsely populated areas where towers are impractical. The technology extends conventional ground infrastructure to extend fixed wireless access to remote homes, keep roaming subscribers connected outside population centers, and ensure emergency services access in rural areas.
Service providers can broaden their addressable market by delivering broadband and voice services to customers that would otherwise be uneconomical to serve. Fixed wireless access over satellite links can approximate fiber‑to‑the‑home in locations where deploying fiber and the supporting terrestrial network infrastructure is impractical. Voice services in these extended footprints can be delivered either through operator IMS cores or by over‑the‑top VoIP, and both approaches are being used in practice as operators balance cost, capability, and customer expectations.
Introducing satellite carriers into the service chain adds a new layer of operational and legal complexity for lawful interception. When a court order targets a subscriber’s identifier, the CSP associated with that MSISDN or IMSI is responsible for producing records and delivering intercepted content. At the same time, the satellite carrier is a separate entity that legally must not be aware of specific interception targets or mediated traffic. SS8 has developed a standards-based non-terrestrial mediation topology that addresses these constraints while preserving auditability and chain‑of‑custody.
Non‑Terrestrial Mediation Challenges
Satellite extension of ground-based mobile networks creates the circumstance where the satellite network passes traffic that only the CSP has legal authority and responsibility to execute lawful orders on. Satellite providers commonly lease core resources in an MVNO/MVNE arrangement, where sessions are handled by the satellite provider’s core and then handed off to the operator. This model is attractive commercially because it minimizes the infrastructure burden, but because the CSP and not the satellite carrier is the legal target of the warrant, the warrant’s existence must be masked from the satellite provider. The CSP must therefore access data specified in the warrant without routing the warrant itself through the satellite provider’s network or actively mediating traffic there.
The need to support traffic from multiple network generations adds further technical complexity, including differences in how subscriber identifiers are represented and where key control plane elements reside in 4G and 5G. In 4G, interfaces such as S1AP and GTP provide places where IMSI, MSISDN, and session context can be observed and correlated. In 5G, the SUPI/SUCI model and the distributed core virtual function model including AMF, AUSF, UDM, SMF, and UPF mean that some identifiers are concealed or only resolvable at specific control plane interfaces.
Mediation must therefore be capable of observing the right interfaces for each generation of technology to correlate control and user plane artifacts without revealing itself to the satellite carrier. In addition, the practical reality of satellite‑backhauled traffic is that the CSP will typically receive an aggregate feed of mirrored traffic from the satellite domain. Filtering that stream to extract only the sessions that match a lawful order is nontrivial and must be done in a way that preserves evidentiary integrity.
SS8 Architecture for Secure, Auditable Compliance
SS8’s topology for non‑terrestrial mediation uses passive probes (when “Active” built-in lawful Interception (LI) interfaces are not supported in 4G EPC or 5GC core Network Elements (NEs)) to listen on standardized control and user plane interfaces to traffic at the satellite provider’s aggregation points. The probes are physically located within the CSP data center and fully under its control, configured to take in the satellite network’s encrypted replication stream, delivered as a sustained, high-volume flow. The probes perform deep packet inspection and protocol‑aware parsing to identify session metadata, then apply filtering logic to pass only the sessions that match active lawful orders to the SS8 mediation function for reconstruction and delivery to the monitoring center.
High-level architecture for satellite interception
Locating the probes and SS8 mediation stack within the CSP‑owned data center limits the satellite provider’s role to providing an encrypted mirror of traffic, without being party to mediation provisioning. The encrypted feed is decrypted and processed inside the operator’s secure environment, where SS8’s Xcipio mediation platform correlates control plane events with user plane flows and reconstructs voice and data sessions for lawful delivery.
Because the solution relies on standardized interfaces and protocol semantics rather than proprietary hooks, the satellite provider can change core vendors or upgrade elements without forcing a rework of the probe‑based collection. That stability reduces operational churn for the CSP and preserves continuity of lawful interception compliance, simplifying the process of expanding services over satellite links.
As a legal and operational design problem, non‑terrestrial mediation must provide both visibility to law enforcement and operational isolation from intermediate carriers. SS8’s probe‑based mediation topology addresses those requirements by keeping target awareness within the CSP’s domain, preserving auditability, and enabling lawful delivery of intercepted material across both 4G and 5G paths. As satellite‑extended services continue to proliferate in the coming years, this architecture will become more common and essential.
About Lynn Herrick
Lynn is an experienced technical solutions architect with 20+ years of pre/post-sales support experience. He has proven consulting expertise working with carrier’s as they migrate voice and data application solutions (VAS- Value Added Services) from 3G, 4G and 5G mobile networks in accordance with the ever-evolving standard bodies e.g., ETSI, 3GPP and IETF; as core networks move from circuit switch, packet switched and the 5GC CUPs architecture.
Lynn is very enthusiastic about introducing next generation solutions and services to network operators as they move to implementing their own standardized private/public cloud solutions to driving business growth and ARPU. Lynn has an in-depth knowledge involved in implementing application solutions into a carrier’s virtualized environments as either a VNF or CNF. You can learn more about Lynn here.
About SS8 Networks
As a leader in Lawful, Location, and Data Intelligence, SS8 is committed to making societies safer. Our mission is to extract, analyze, and visualize critical intelligence, providing real-time insights that help save lives. With 25 years of expertise, SS8 is a trusted partner of the world’s largest government agencies and communication providers, consistently remaining at the forefront of innovation.
Discovery is the latest solution from SS8. Provided as a subscription, it is an investigative force multiplier for local and state police to fuse, filter, and analyze massive volumes of investigative data – in real time.
Intellego® XT monitoring, data fusion, and analytics portfolio is optimized for Law Enforcement Agencies to capture, analyze, and visualize complex data sets for real-time investigative intelligence.
LocationWise delivers the highest audited network location accuracy worldwide, providing active and passive location intelligence for emergency services, law enforcement, and mobile network operators.
Xcipio® mediation platform meets the demands of lawful intercept in any network type and provides the ability to transcode (convert) between lawful intercept handover versions and standard families.
To learn more, contact us at [email protected].
