Mobile Network & Connectivity
Mobile Network & Connectivity

Satellite Direct-to-Cell: How Smartphones Connect Without Cell Towers

By David Okonkwo, Embedded Systems Engineer Sep 16, 2026 9 min read

Your phone already has a satellite modem — it just didn't know it was allowed to talk to space. Direct-to-Cell (D2C) turns low-Earth orbit satellites into roaming cell towers at 550 km altitude, using the same LTE bands your phone uses on the ground. No bulky antenna, no satellite phone.

For decades, satellite phones meant expensive, brick-sized terminals with deployable antennas. D2C inverts that model: instead of building a better satellite phone, we put the cell tower in orbit and leave the phone alone. Both SpaceX's Starlink Direct to Cell and AST SpaceMobile's BlueBird do this, but with radically different radio architectures. Understanding why this works — and why it's still narrowband — requires looking at link budgets, 3GPP Non-Terrestrial Networks (NTN), and the brutal physics of a 23 dBm transmitter trying to close a 550 km link.

1. The 3GPP NTN Foundation: A Tower That Moves at Mach 22

Release 17 introduced NTN to the 5G/4G standards, and it solves three problems that make LEO fundamentally different from a terrestrial gNB.

First, propagation delay. A terrestrial cell sees 1–10 µs round-trip. A LEO at 550 km sees 2.7–13 ms depending on elevation angle, exceeding LTE's timing advance window. NTN introduces a large K_offset and extended TA to keep uplink slots orthogonal.

Second, Doppler. At 1910 MHz (PCS uplink), a satellite rising at 27,000 km/h induces +46 kHz shift, sweeping to -46 kHz as it sets — 24 ppm. LTE's subcarrier spacing is 15 kHz, so without correction the signal would smear across three subcarriers. The fix is predictive compensation on both ends: the network broadcasts satellite ephemeris in SIB19/SIB31, the UE's GNSS gets a fix, and both sides pre-rotate frequency.

Third, cell mobility. A terrestrial cell is static; a LEO beam's footprint drags across Earth at ~7.5 km/s. A stationary user will see handovers every 40–90 seconds. NTN adds earth-fixed tracking areas and conditional handover triggers based on satellite ephemeris time, not just RSRP.

Why LTE First, Not 5G NR?
Starlink D2C launched on LTE Band 25/n25 derivatives rather than 5G NR because LTE's narrow 1.4/3/5 MHz channels and robust low-MCS modes survive at the extreme link margins phones have. 5G NTN (Band n256 global) is coming, but LTE lets any phone from the last five years attach today without a new RF front-end. See our Samsung Galaxy S26 Ultra teardown for how modern flagships integrate Band n256 filters without board changes.

2. Closing the Link: The Math That Makes or Breaks D2C

The free-space path loss (FSPL) for 550 km at 2 GHz is about 153 dB. Add ~3 dB atmospheric, ~3 dB body blockage, and ~6 dB fading margin, and you need ~165 dB of link budget. Let's run the uplink — the bottleneck — for a typical phone:

Mobile Connectivity Standards Comparison
Feature 5G NR Wi-Fi 7 Bluetooth 5.4
Peak Throughput20 Gbps46 Gbps2 Mbps
Latency1–4 ms1–2 ms3–6 ms
RangeSeveral km30–50 m100–400 m
Power DrawHighMediumUltra-low
Primary UseCellular dataLocal networkingPeripherals/IoT
// Uplink link budget: Handset → LEO (1910 MHz, 550 km, 45° elevation) TX Power (UE) = 23.0 dBm // 200 mW, Power Class 3 UE Antenna Gain = -1.5 dBi // Linear, near-omnidirectional FSPL (550 km) = -152.8 dB Atmosphere + Shadowing = -6.0 dB Received power at satellite = -137.3 dBm Satellite G/T (Starlink D2C) ≈ 5 dB/K // 64 m² phased array, ~18 dBi element gain Noise floor (5 MHz) = -107 dBm SNR required (QPSK 1/3) = -1.5 dB // with 8x HARQ repetitions Margin = ~2-4 dB // viable but fragile

That 2–4 dB margin explains every design choice: narrow bandwidth, aggressive repetition, and massive satellite antennas. AST SpaceMobile pushes further — its BlueBird Block 2 satellites deploy a 64 m² array (2,500+ elements) delivering ~42 dBi gain, about 13 dB more than Starlink's 5-m² array. That extra gain buys true LTE broadband speeds rather than messaging-only, but at the cost of far larger, more expensive spacecraft.

Starlink D2C Approach

Many small satellites (~1.2 t), eNodeB payload on each, 5 MHz FDD channel, 2–4 Mbps/beam, messaging + voice roadmap.

AST SpaceMobile Approach

Few huge satellites (~1.5 t, 64 m²), full 40 MHz beamformer, up to 120 Mbps/beam, native broadband aim.

For users, the difference shows up in perceived latency and throughput. Both must relay via feeder links (Ka/Ku) to a gateway earth station that connects to the mobile core. There is no inter-satellite laser link handling in the initial D2C voice path — it hairpins to ground.

3. End-to-End Architecture

Satellite Direct-to-Cell System Architecture Block diagram showing smartphone connecting to LEO satellite acting as eNodeB, linked via feeder link to gateway and terrestrial mobile core. SMARTPHONE LTE Band 25 / n256 23 dBm TX • GNSS SIB19 Ephemeris ◯ Uu / NTN 153 dB FSPL • Doppler ±48kHz LEO SATELLITE (550 km) eNodeB / gNB LTE PHY + Scheduler Phased Array 18–42 dBi • 64 beams FEEDER LINK • Ka/Ku • Ground ephemeris Feeder GATEWAY Teleport Earth Station S1 / NG Interface SecGW • Timing Server Ka 20 GHz • High G/T MOBILE CORE EPC / 5GC MME • SGW • PGW + IMS for VoLTE → Internet / PSTN

Figure 1 — D2C as a bent-pipe eNodeB: the satellite is a full LTE base station with a massive phased array, backhauled via Ka-band feeder to a gateway that presents as a normal cell site to the carrier core.

4. Comparative Landscape

Not all satellite-to-phone systems are D2C. Apple’s Emergency SOS via Globalstar and Iridium uses proprietary waveforms and requires custom baseband support. True D2C is defined by 3GPP compliance and no user hardware modifications.

System Orbit / Bands Phone Requirements Throughput Status (2026)
Starlink Direct to Cell
SpaceX + T-Mobile
550 km LEO
PCS 1910–1915 / 1990–1995 MHz (n25)
Any LTE phone; carrier OTA enables NTN 3–7 Mbps / cell
SMS, voice in beta
~300 sats launched; US, NZ, AU roaming
AST SpaceMobile BlueBird 725 km LEO
700–900 MHz & 1800 MHz (MNO spectrum)
Any 4G/5G phone; leased carrier spectrum Up to 35 Mbps / cell (10 MHz), 120 Mbps lab 5 Block-1 sats on orbit; 17 Block-2 in build
Apple / Globalstar 1414 km LEO
L/S band (proprietary)
iPhone 14+ custom Qualcomm X65 NTN stack ~500 bps–2 kbps
Compressed SOS only
Live in 17 countries; Globalstar Gen-2 pending
Lynk Global 500 km LEO
MNO UHF partnerships
Unmodified phones (SMS fallback) SMS only, store & forward 3 sats; commercial SMS in 7 island nations

The strategic split is spectrum: Starlink uses T-Mobile’s PCS G-block nationwide, AST leases dedicated carrier spectrum per market (AT&T, Vodafone, Rakuten), while Apple owns Globalstar’s licensed MSS spectrum outright. This dictates antenna size — lower frequencies (700 MHz) need even larger arrays to achieve the same gain, which is why AST’s aperture is so extreme. For audio quality implications of low-bitrate satellite codecs, read our smartphone speaker and codec quality test.

5. Handset Reality: What Happens Inside the Phone

From the baseband’s view, an NTN cell looks like a high-Doppler, high-delay normal cell. Qualcomm’s Snapdragon X75 and later, MediaTek Dimensity 8300+, and Samsung’s Exynos 5400 all ship with NTN firmware disabled until carriers provision it. Key changes:

// Example: NTN SIB19 content broadcast by D2C satellite (3GPP 38.331) sib19 ::= { ntn-Config { epochTime t0 = 1726425600.0, // seconds since Jan 1, 1970 ephemerisInfo { x= 4123.2, y=-1589.1, z= 5231.4 km; // ECI coords vx= 2.1, vy= 6.8, vz= -1.2 km/s }, commonTA -2.3 ms, k-Offset 12, // slots, compensates 6 ms RTT cellSpecificK-Offset 4 } } // UE: freqCompensation = - (v_sat • unitVector) / c * f_carrier

Power remains the killer constraint. An LTE uplink at maximum power draws ~1.8 A from the battery for ~800 ms per message burst — comparable to a terrestrial weak-signal call, but repeated for HARQ. Continuous satellite data will heat the device and deplete battery 2× faster than terrestrial LTE. That’s why early services throttle to SMS and emergency use; broadband will require discontinuous reception optimizations and perhaps new app-level queuing strategies to batch transmissions.

6. Latency, Handover, and Indoor Limits

Measured round-trip latency for Starlink D2C is 45–80 ms to the gateway, plus 20–40 ms terrestrial backhaul — usable for VoLTE but jittery for gaming. Handovers are the harder problem: unlike terrestrial networks where the UE drives measurement reports, NTN can use time-based triggers. The network predicts when the serving satellite will drop below 30° elevation and pre-allocates a target satellite, pushing a conditional handover command.

Indoors, D2C essentially does not work. Building penetration loss at 2 GHz is 15–25 dB. With only 2–4 dB link margin outdoors, even a wood-frame house adds enough loss to break the link. D2C is an outdoor, sky-visible complement — not a replacement for small cells. For users in dense cities, terrestrial coverage will always be preferred by cell reselection priority.

Security also deserves clarity. D2C inherits carrier authentication (AKA over MILENAGE), so a stolen phone still needs the SIM. However, the long, exposed feeder link becomes a new interception point if not properly encrypted with IPsec. Users concerned about number hijacking should review our guide to SIM swapping prevention — satellite access does not bypass SIM controls, so social engineering at the carrier still works.

7. What Comes Next: 3GPP Rel-19 and Beyond

Three shifts will define the next 18 months. First, Band n256 harmonization (1980–2010 MHz uplink) will let a single phone SKU roam onto any D2C network globally, like roaming today. Second, NR-NTN with 5G SA cores will enable network slicing — a slice for emergency services with guaranteed latency, another for IoT with ultra-low power. Third, direct-to-cell 5G with beamforming on the handset is on the roadmap for 2028 flagships: tiny 2-element patch arrays on the phone back could add 6 dBi on the uplink, doubling data rates, but require rethinking SAR compliance.

For now, the most honest framing is this: D2C solves the “no bars, no Wi-Fi” problem, not the “I want fiber in the wilderness” problem. If you can see sky, you can send a text, share location, and soon place a voice call that routes through a satellite pretending to be a tower. The tower is just moving very, very fast — and your phone’s GNSS and Doppler engine are working overtime to keep up.

Bottom line for engineers
Design for 3–5 MHz channels, QPSK, 2 dB margin, and GNSS-dependent attach. Cache ephemeris, batch uplinks, expect 60-second handovers, and never assume indoor availability. Satellite D2C is a coverage layer — treat it as the most expensive, highest-latency cell in your mobility policy.

Frequently Asked Questions

Can any smartphone use satellite direct-to-cell without hardware changes?
Most phones released after 2021 can. Starlink and Lynk use existing LTE bands, so if your baseband supports extended timing advance and your carrier pushes an NTN carrier bundle, no new chip is needed. You will still need a clear view of the sky and location services enabled for Doppler correction.
Why is direct-to-cell data so slow compared to Starlink broadband?
Physics. A phone's tiny omnidirectional antenna and 0.2 W power limit create a 25 dB deficit versus a Starlink dish. To maintain reliability, the network uses narrow channels (1.4–5 MHz), low-order modulation, and multiple retransmissions. The result is a shared 2–10 Mbps beam, not the 100+ Mbps dedicated to a dish.
How do satellites handle Doppler shift for fast-moving LEO?
Both sides compensate. Satellites broadcast precise orbital ephemeris every 80 ms. Your phone uses its GPS location to compute expected Doppler and pre-corrects its transmit frequency. The satellite's digital beamformer also applies per-beam frequency offsets on the uplink before decoding.
Is satellite direct-to-cell secure against SIM swapping and interception?
The over-the-air link uses the same LTE encryption and SIM authentication as terrestrial networks, so SIM swapping remains a carrier account vulnerability, not a radio one. The satellite feeder link is encrypted at the gateway. Enable carrier PINs and hardware-key account protection as described in our SIM swapping prevention guide.

Further reading: SIM Swapping Prevention · Galaxy S26 Ultra Teardown · Speaker & Codec Quality · App Reverse Engineering Protection

References & Standards: GSMA Intelligence · USB Implementers Forum