⚡ electrical engineering

Secure Task Offloading and Resource Allocation Design for Multi-Layer Non-Terrestrial Networks

This paper proposes a secure, four-layer non-terrestrial network architecture integrating UAVs, HAPS, and LEO satellites with tag-based physical-layer authentication and a block coordinate descent algorithm to jointly optimize task offloading and resource allocation against malicious actors.

Original authors: Alejandro Flores, Isabella W. G. da Silva, Vu Nguyen Ha, Konstantinos Ntontin, Hien Quoc Ngo, Michail Matthaiou, Symeon Chatzinotas

Published 2026-02-20

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Alejandro Flores, Isabella W. G. da Silva, Vu Nguyen Ha, Konstantinos Ntontin, Hien Quoc Ngo, Michail Matthaiou, Symeon Chatzinotas

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you live in a remote village in the middle of a desert or a mountain range. You have a smart device (like a sensor or a camera) that needs to solve a complex math problem, but your device is too weak to do it alone. It needs to send the problem to a super-computer to get the answer quickly.

In a normal city, your device would just send the data to a nearby cell tower. But in your remote village, there are no towers. This is where Non-Terrestrial Networks (NTNs) come in. Think of these as a "sky-high internet" made of drones, high-altitude balloons, and satellites.

This paper proposes a new, super-secure way to use this sky-high internet to solve your problems, while stopping bad guys from stealing the computer's power.

Here is the story of how they do it, broken down into simple parts:

1. The Setup: A Four-Layer Sky Team

The authors designed a team of four layers working together, like a relay race:

Layer 1 (The Runners): Your IoT devices on the ground.
Layer 2 (The Mules): Drones (UAVs) flying low. They pick up your data and carry it up.
Layer 3 (The Referee): A giant High-Altitude Platform (HAPS), like a massive solar-powered blimp, floating high in the sky. It acts as the boss. It catches the data from the drones, checks who sent it, and decides what to do next.
Layer 4 (The Brains): Satellites orbiting the Earth. These are the super-computers (MEC servers) that actually solve the math problems.

2. The Problem: The "Imposter" at the Door

The sky is open. While this is great for you, it's also great for hackers. A bad actor could pretend to be your device, send a fake request, and trick the satellite into wasting its battery and computing power on nonsense. If enough bad actors do this, the real devices (like your emergency sensors) get locked out. This is called a Denial of Service (DoS) attack.

Usually, to stop this, we use complex passwords and encryption (like a digital lock). But your tiny IoT device is too weak to handle heavy locks; it would run out of battery just trying to unlock the door.

3. The Solution: The "Secret Handshake" (Physical Layer Authentication)

Instead of a heavy digital lock, the authors propose a Physical Layer Authentication (PLA) scheme. Think of this as a secret handshake or a unique voice print.

How it works: Before sending the actual data, your device adds a tiny, invisible "tag" to the signal. This tag is created using a secret key that only you and the "Referee" (the HAPS) know.
The Magic: The Referee listens to the signal. It doesn't just read the message; it analyzes the sound of the signal itself. It checks: "Does this signal have the correct secret tag?"
Why it's cool: It's incredibly fast and light. It doesn't drain your battery. If a hacker tries to copy your message, they can't copy the secret tag because they don't have the key. The Referee instantly spots the fake and kicks them out before they even get a chance to use the satellite's computer.

4. The Decision: Who Gets to Play?

Once the Referee (HAPS) verifies that a device is real, it lets the task through. If the device is fake, it gets rejected immediately.

For the real tasks, the system has to be smart about Resource Allocation. Imagine the satellite is a busy restaurant kitchen with a limited number of chefs.

The system has to decide: "Which orders do we cook?"
"Which chef should cook which dish?"
"How much time do we have?"

The authors created a mathematical algorithm (a fancy recipe) that looks at all the incoming tasks, checks who is real, and then assigns the satellite's computing power in the most efficient way possible to get the answers back to you as fast as possible.

5. The Results: Why It Matters

The paper tested this system with simulations (computer models) and found:

Speed: Because the "secret handshake" is so fast, more tasks get completed on time compared to systems using heavy passwords.
Security: Even if the bad guys try to sneak in, the system catches them 99% of the time, even if the rules for catching them are made slightly looser.
Teamwork: Using more drones (Layer 2) makes the system even better at spotting the real users and filtering out the fakes.

The Big Picture Analogy

Imagine a busy airport (the Satellite).

Old Way: Every passenger (IoT device) has to go through a slow, heavy security check with a passport and visa (Encryption). This clogs the line, and the airport gets overwhelmed.
This Paper's Way: The airport has a special, high-tech scanner at the gate. It instantly recognizes the "vibe" or "signature" of a legitimate passenger's ID card (The Tag).
- If the vibe matches, they walk right through to the gate (the Satellite).
- If the vibe is off (a hacker), they are stopped immediately.
- The gate agents then quickly assign the fastest planes (computing resources) to the people who are actually going on a trip, ensuring no one waits too long.

In short: This paper teaches us how to build a sky-high internet that is fast enough for tiny devices, smart enough to spot fakes instantly, and organized enough to solve everyone's problems without getting overwhelmed.

1. Problem Statement

Remote and resource-constrained Internet-of-Things (IoT) devices often lack terrestrial connectivity, necessitating the use of Non-Terrestrial Networks (NTNs) with Multiaccess Edge Computing (MEC) capabilities. However, the open nature of NTNs exposes them to malicious actors who can inject fake task requests, draining limited onboard computing and backhaul resources (a Denial-of-Service or DoS attack).

Key Challenges:

Security vs. Efficiency: Conventional cryptographic authentication is computationally too heavy for constrained IoT devices.
Resource Management: There is a lack of frameworks that jointly consider physical-layer authentication decisions and subsequent task offloading/resource allocation in multi-layer NTN architectures.
Architecture Complexity: Existing solutions often fail to quantify how authentication outcomes impact the admission of tasks and the allocation of MEC resources in a multi-layer setting involving UAVs, High-Altitude Platform Stations (HAPS), and Low-Earth Orbit Satellites (LEOSats).

2. System Model and Methodology

The authors propose a four-layer MEC-enabled NTN architecture:

Layer 1 (IoT Devices): Legitimate ground devices and malicious nodes.
Layer 2 (UAVs): Unmanned Aerial Vehicles acting as access nodes, relaying signals in an Amplify-and-Forward (AF) manner.
Layer 3 (HAPS): A High-Altitude Platform Station acting as a central coordinator, authenticator, and CPU.
Layer 4 (LEOSats): A constellation of Low-Earth Orbit Satellites acting as remote MEC servers.

A. Physical-Layer Authentication (PLA)

Instead of heavy cryptography, the system uses a tag-based PLA scheme:

Mechanism: Each legitimate device $i$ possesses a unique, time-varying secret key $l_i$ . It generates an authentication tag $t_i$ using a secure hash function $g(s_i, l_i)$ superimposed on the message signal $s_i$ .
Transmission: The transmitted signal is $x_i = \rho_{s,i}s_i + \rho_{t,i}t_i$ , where $\rho_{t,i} \ll \rho_{s,i}$ .
Verification: The HAPS estimates the message, regenerates the expected tag $\tilde{t}_i$ , and extracts the received tag $r_i$ from the residual signal.
Hypothesis Testing: A test statistic $\lambda_i = \mathcal{R}\{\tilde{t}_i^H r_i\}$ $λ_{i} = R {\tilde{t}_{i}^{H} r_{i}}$ is compared against an optimized threshold $\theta_i^*$ $θ_{i}^{*}$ .
- $H_1$ : Legitimate (tag present).
- $H_0$ : Malicious/Impersonation (tag absent).
Metrics: The authors derive closed-form expressions for the Probability of False Alarm ( $P_{FA}$ ) and Probability of Detection ( $P_D$ ) to optimize the threshold.

B. Joint Optimization Framework

Once authentication determines which tasks are admitted ( $\alpha_i = 1$ for legitimate, $0$ otherwise), the system solves a Joint Task Offloading and Resource Allocation problem.

Objective: Minimize the maximum weighted delay across all admitted tasks.
Variables:
- Offloading Decisions ( $B$ ): Binary variables determining which LEOSat processes which task.
- Resource Allocation ( $F$ ): Computing resources (CPU cycles) allocated by LEOSats.
Constraints: Maximum tolerable delay, computing capacity limits of LEOSats, and the requirement that only authenticated tasks consume resources.

C. Proposed Solution Algorithm

The optimization problem is non-convex. The authors propose an iterative Block Coordinate Descent (BCD) algorithm:

Authentication Phase: Compute test statistics and admit/reject tasks based on the derived optimal thresholds.
Offloading Optimization ( $P_o$ ): Relax binary constraints to continuous values, apply a quadratic penalty function (linearized via Taylor approximation), and use Quadratic Transform (QT) to handle non-convex delay terms. Solved as a Linear Program (LP).
Resource Allocation ( $P_f$ ): Solve the convex resource allocation sub-problem for admitted tasks.
Iteration: Repeat steps 2 and 3, increasing the penalty weight until convergence. If the problem is infeasible (due to delay constraints), the task with the highest resource demand is rejected.

3. Key Contributions

Integrated PLA-MEC Framework: First work to co-design tag-based physical-layer authentication with joint task offloading and resource allocation in a multi-layer NTN.
Analytical Derivations: Derived closed-form expressions for test statistic distributions, $P_{FA}$ , $P_D$ , and the optimal detection threshold under fixed false-alarm constraints.
Robust Optimization: Developed an iterative BCD algorithm that couples authentication outcomes with resource allocation, preventing unauthenticated tasks from consuming MEC resources.
Performance Validation: Demonstrated via simulations that the proposed scheme outperforms benchmarks (Public-Key, Blockchain-based) in terms of task feasibility and robustness against malicious attacks.

4. Numerical Results and Performance Evaluation

The system was evaluated with 50 IoT devices, 25 malicious nodes, 25 UAVs, and 3 LEOSats.

Task Feasibility: The PLA-based scheme achieves task feasibility much earlier (at lower delay constraints) than benchmark schemes (Bilinear Pairing, ID-based Blockchain, MSR-Blockchain). This is because PLA operates at the physical layer with minimal signaling overhead, avoiding the extra delay introduced by cryptographic handshakes.
Robustness to Attacks: Even with a relaxed False Alarm rate ( $P_{FA} = 0.05$ ), the proportion of admitted malicious tasks remains extremely low (~1%).
Impact of UAVs: Increasing the number of UAVs significantly improves the detection of legitimate tasks. With 25 UAVs, legitimate task admission exceeds 95% even under strict false-alarm constraints.
Power Allocation: Increasing IoT transmit power reduces offloading delay until the HAPS-LEO link latency becomes the bottleneck. Reducing the power allocated to the authentication tag ( $\rho_{t,i}^2$ ) has minimal impact on total delay, allowing more power to be dedicated to message detection.

5. Significance

This paper addresses a critical gap in the security and efficiency of future 6G-enabled NTN systems. By moving authentication to the physical layer, it enables lightweight, low-latency security suitable for massive IoT deployments in remote areas. The proposed framework ensures that limited satellite computing resources are reserved strictly for legitimate users, effectively mitigating DoS attacks while maintaining high service quality for authorized devices. The integration of authentication decisions directly into the resource allocation loop represents a novel paradigm for secure edge computing in space-air-ground integrated networks.