Abstract
Modern satellite systems increasingly rely on large low earth orbit (LEO) constellations to provide global coverage, low latency, and high availability. These LEO satellites play a critical role in enabling seamless handovers for terrestrial users as they move within the constellation. Handovers require maintaining group keys among proximate LEO satellites for reducing security overhead. Although group key establishment has been studied in the context of satellite networks, existing approaches do not provide quantum-resistant solutions. To address this limitation, we propose PQ-CKEM, a lightweight and quantum-resistant group key establishment protocol. PQ-CKEM adopts a variation of TreeKEM, originally designed to reduce message overhead in group-based communications, but not inherently suitable for wireless broadcast environments. To overcome this limitation, PQ-CKEM forms small clusters by leveraging the connected dominating set (CDS) concept from graph theory and executes an enhanced version of TreeKEM locally within each cluster. Cluster leaders subsequently derive a global group key through a PQ-CKEM exchange among themselves. This lightweight design also enables rapid updates to the group key in response to topology changes. Evaluation of PQ-CKEM using realistic datasets and parameters demonstrates significant reductions in message overhead, communication size, and latency.