Encrypted conjunction assessment
Private screening
Two operators learn whether their satellites will come too close, without either seeing the other’s orbit, even when neither satellite is in the public catalog.
The problem
Why Operators Keep Their Best Data Private
The most precise orbits and planned maneuvers are what keeps satellites apart, and what operators can least afford to publish.
National security
Classified orbits reveal capabilities, coverage gaps and mission intent to adversaries.
Commercial value
Constellation geometry, station-keeping strategy and coverage patterns are trade secrets worth billions.
Maneuver plans
A planned burn tells competitors and adversaries that something is about to change, and when.
Liability
Sharing creates obligations: an operator that shares ephemeris and then misses a conjunction may carry more liability than one that shared nothing.
How it works
Screening Without Sharing
Homomorphic encryption lets a computer do arithmetic on locked numbers. It adds and multiplies them without unlocking them, and the answer stays locked.
Your key stays with you
You lock your trajectory with your own key before it leaves your systems. Nobody else can unlock it.
The other side computes
The other operator works out, on the locked numbers, how close its own satellite comes at each moment. It never sees your orbit, and its own never leaves its systems.
Both learn the answer
Each moment gets one answer, too close or not, and both operators learn it. No third party takes part, and each operator runs it to protect its own satellite.
The arithmetic is |a − b|² = |a|² − 2a·b + |b|², on positions locked with Microsoft SEAL (BFV, 128-bit security), 8,192 moments to each locked block. A separate assessor would add no privacy: whoever can unlock the answer could also unlock the positions it was sent.
Measured
What It Costs
Measured with Microsoft SEAL 4.1.1 on one core of a shared workstation, checking every second of the day for close approaches.
Checking every 10 seconds costs about a tenth as much, with a wider safety margin. Private screening suits pairs and small groups of operators; the open catalog covers everyone else. Sources: the technical paper, section 8.
What it reveals
What Each Side Learns
The answer is meant to say when the other satellite comes too close, and nothing more.
Only the close moments
You learn the moments when the other satellite is within the safety distance. Not where it is, and not how far away it is the rest of the time.
One yes or no per moment
Hiding the distance behind a random multiplier is not enough: in our tests the distance could be recovered within a factor of two at 87% of moments. The answer is therefore a single yes or no per moment, produced by a two-party comparison.
Real close approaches show
In three days, 2,565 objects came within 5 km of a Starlink satellite, half of them three or more times. Any safe system reports those, and enough of them reveal an orbit to the neighbor that sees them.
Defenses
Protection Against Orbit Guessing
Could someone submit invented orbits to find a hidden satellite? Without defenses, yes: about 1,200 questions find one whose altitude is roughly known. In the design, each satellite’s owner enforces these defenses on its own node.
Enforced by the owner
Every answer about your satellite comes from your node, computed with your orbit. Others can run any software they like, modified or not; they cannot make your node answer more, skip a check or drop the noise. Locked data is useless without its owner’s key.
Questions must follow physics
Each satellite gets one locked track, which must obey gravity at every moment and continue from its last time window, with room for a declared maneuver. Your node checks this on the locked values, learns only pass or fail, and refuses invented paths before answering. It needs no public track, so it works between two satellites missing from the public catalog.
Answers only near the asker’s satellite
Where the asker’s satellite has an independent track, from the public catalog or signed by a tracking provider, your node answers only near that track. Everywhere else the answer is “not close”, whatever was sent, so an asker learns nothing far from its own satellites.
Checked afterwards
An asker with a public track hands over each window’s key once the window has passed, and your node checks every moment against independent tracking and orbital physics. An asker with a hidden satellite answers challenges instead: both sides see every alert, and your node may ask for those few minutes of positions and check them with a tracker. A withheld key, a missing answer or a failed check forfeits the asker’s stake and ends its screening.
Fixed rules, limited questions
Positions come at fixed times set by the protocol, and every moment of a window is checked. Each pair of satellites gets one signed answer per window, and no asker may ask about more satellites per window than it has registered. That caps what anyone could learn before a failed check catches them.
Blurred distances
Your node adds random noise (Laplace noise) to each distance before the yes-or-no test, so no answer says exactly how close. The test threshold is raised to match, so the noise can add false alarms but never hides a real one, and the same question always gets the same noise.
Both directions work the same way: when two operators screen each other, each protects its own orbit with its own node. Open source does not weaken this; what protects an orbit is its owner’s key and its owner’s node, not secrecy of the code. What remains is what any safe system reveals: real close approaches between real satellites, and, for an asker willing to lose its identity, at most one time window of questions, near its own satellites or along the orbits it registered.