EADA: an endogenous active defense architecture for satellite Internet

With the accelerated deployment of low Earth orbit constellations, satellite Internet has become a critical component of global information infrastructure. The space-ground integrated architecture breaks the traditional boundary-domain security model of terrestrial networks, giving rise to cross-domain, highly dynamic, and evolving systemic security risks that existing perimeter-based and passive defense mechanisms cannot adequately address. This paper proposes an endogenous active defense architecture (EADA), which embeds identity authentication, access control, and routing functions into the full system lifecycle to establish a phased evolution of trust boundaries. Guided by hierarchical federated trust, logical isolation, and data-driven intelligent operations, EADA effectively mitigates lateral movement and routing manipulation risks. Performance modeling based on representative LEO constellations shows that EADA limits SRv6 encapsulation overhead to approximately 2.4%, keeps signaling bandwidth consumption below 0.02% under high concurrency, and achieves microsecond-level line-rate processing with only about 2.77% onboard FPGA resource utilization, demonstrating its engineering feasibility in resource-constrained and highly dynamic satellite Internet environments.