Chapter 2 · Memories of the Huawei Era
The plastic storage bin didn’t hold much, but every item pressed heavily on Lu Yuan’s heart.
A stack of technical notebooks, a few corporate badges, a disassembled RF module, a copy of a non-disclosure agreement stamped with a classified seal. At the very bottom, a group photo—the team photo of Huawei Institute 201’s RF lab, with the 600-million-yuan 6G prototype test rig in the background. A group of people in white lab coats standing before it, their expressions tired and proud.
It was autumn 2048. Lu Yuan was twenty-two, two years out of his master’s at the University of Electronic Science and Technology, the youngest RF engineer in the whole lab. He stood at the edge of the photo, more hair then, brighter eyes, still holding a cup of instant coffee he hadn’t had time to put down.
He looked at that photo for a long time, then opened the first notebook.
- Huawei Institute 201.
Lu Yuan still remembered the feeling of walking into that lab for the first time. Not excitement. Something close to religious awe. The six-meter shielding hall was like a giant Faraday cage, the walls covered in dense pyramidal absorbing foam, deep blue cones like countless mouths screaming in silence. At the center of the hall stood the 6G prototype test rig, codenamed “Taiyue”—a three-meter equipment cabinet connected to a web of RF cables, the low hum of its cooling system like the breathing of some enormous creature.
The RF lab’s working pace was inhuman. In those two years, Lu Yuan almost never saw the sun. He entered the shielding hall at eight in the morning and came out at eleven at night, with only brief breaks to wolf down food. Phone signals were completely blocked. Contact with the outside world was limited to internal messages. He lived like a cave creature, wrestling with himself in that isolated environment.
But he loved that wrestling.
CDMA—Code Division Multiple Access—was the most mature multiple-access technology of that era. Huawei’s 6G prototype attempted to introduce a new signal structure at the physical layer of CDMA, using ultra-high-dimensional orthogonal coding to support a hundred times the concurrent connections on the same frequency band. Lu Yuan’s job was RF front-end linearity optimization. It sounded tedious, and it was even more tedious to do—but it was in that tedium that he stumbled upon the thing that would later keep him awake at night.
It was December 17, 2048. Lu Yuan remembered it clearly. Shenzhen’s winter was damp and cold, but the shielding hall was a constant 22 degrees. He was debugging a power amplifier’s pre-distortion module, the test instrument screen displaying the transmitted signal’s spectrum.
Signal fingerprints—the inherent identity marker of every communication terminal. The principle was simple: every terminal’s RF hardware has microscopic manufacturing tolerances—the power amplifier’s nonlinear distortion, the local oscillator’s frequency offset, the baseband filter’s pulse response deviation. These microscopic hardware differences leave a unique “fingerprint” on the transmitted signal, as unique as a human fingerprint. Starlink’s authentication system was built on this principle: every legitimate terminal had a unique signal fingerprint profile on file. When connecting to the network, the system verified whether the current signal matched the archived fingerprint, rejecting all mismatched connection requests.
That afternoon, Lu Yuan was doing routine work—measuring the Error Vector Magnitude of different power amplifier modules with a vector signal analyzer. He connected two amplifier modules from different production batches to the same signal source and measured their outputs separately. The two spectral curves almost perfectly overlapped, but when zoomed in, you could see subtle differences in phase noise and out-of-band spurs.
He recorded both data sets in the measurement log. Then he did something unintentional: he recorded the output signal of one amplifier, then fed that digital signal file directly into the excitation port of the other amplifier—not as a driving signal, but as a reference template to test the signal analyzer’s fingerprint matching algorithm.
The result stopped him cold.
The signal analyzer reported: Match: 99.97%. System verdict: Same terminal.
What did this mean? It meant that if he recorded a complete transmitted signal from Terminal A, then replayed that signal using an arbitrary waveform generator with sufficient precision, the receiver would think it was Terminal A itself transmitting.
Hardware fingerprints were dead. The signal itself was alive.
Lu Yuan stared at the match percentage on the screen, his mind racing through the implications of this discovery. He double-checked the experiment setup, ruled out all possible interference. Different amplifier modules, different carrier frequencies, different modulation schemes. Three repeat experiments, identical results: the recorded-and-replayed signal passed fingerprint verification at over 99.9% match.
He wrote the finding into the experimental log’s remarks section, his wording cautious:
“Under these test conditions, the signal fingerprint authentication scheme based on the transmit chain is theoretically vulnerable to record-and-replay attacks. Match > 99.9%, exceeding the system’s preset security threshold. It is recommended that the project team monitor this risk.”
Then he switched off the instruments and went to the cafeteria for dinner.
He didn’t know then that this unremarkable test result would, seven years later, become the key that could pry open the gates of the Starlink empire.
The spring 2049 layoffs came without warning, yet were entirely predictable.
Huawei’s communications business division went from a peak of thirty thousand employees to under three thousand. Institute 201 was almost entirely uprooted. The news came on a Monday morning. HR teams filed in, placing a severance agreement and a thank-you letter before every employee. Lu Yuan got N+3 compensation—generous by the standards of the batch—but generosity didn’t ease the vertigo of being torn out by the roots.
Behind the layoffs was Starlink’s full-scale acquisition. Starlink Communications LLC had purchased Huawei’s satellite communications patent portfolio and parts of its ground segment technical team at twice the market valuation. The media called it “the biggest tech acquisition before 2050.” The praise was unanimous: “Starlink will lead humanity into a true era of global connectivity,” “Huawei technology + Starlink infrastructure = golden combination.”
Three months after leaving, Lu Yuan watched with his own eyes as Institute 201’s lab was taken over by Starlink’s engineering team. He stood on the pedestrian bridge across from the building, watching people in Starlink uniforms come and go, disassembling the Taiyue prototype and loading it onto trucks. The equipment he’d guarded day and night was packed into standard shipping containers, affixed with Starlink’s silver tri-ring logo, and disappeared over the elevated highway into the city.
His notebooks weren’t confiscated. When he’d asked if he could take his experimental logs, his supervisor was silent for a moment, then waved a hand—“You wrote it, you take it. Just don’t leave anything behind.”
So those notebooks followed him back to his rented room, along with that inconspicuous line in the experimental log.
He didn’t go to Starlink. Two interview invitations arrived. He deleted them without reading. He couldn’t say whether it was spite or something else, but he simply didn’t want to work for that company. So he opened a phone repair shop, in a lane in Dachong Village. The sign was self-welded LED letters. The shop was five square meters, filled with soldering irons, oscilloscopes, and piles of disassembled phone motherboards.
While repairing phones, he tried not to think about those formulas. At night, when he saw Starlink satellites streaking across the balcony sky, he tried not to think about those formulas. After his daughter was born, he almost never touched those notebooks again. They were sealed in the plastic bin, shoved into the deepest corner under the bed, like a chapter of the past he didn’t want to revisit.
Until today.
Two in the morning. Shenzhen’s power grid had entered load-balancing mode. Streetlights dimmed by two degrees. Air conditioners hummed at low frequency. Lu Yuan sat at the folding table, the desk lamp’s halo encircling the yellowed notebook and his restless fingers.
He was doing something he’d thought he would never do again—reverse-engineering Starlink’s authentication architecture.
Based on public technical white papers, scattered industry papers, and his own memory of the CDMA physical layer, he was trying to reconstruct on paper the complete chain of Starlink terminal network-access authentication. Starting from that signal fingerprint vulnerability in his notes, he extrapolated a bold hypothesis:
Starlink’s physical-layer authentication relied on a mechanism called “Continuous Health Verification.” In simple terms, the terminal continuously transmitted verification signals embedded in the data stream. The system compared the current signal fingerprint against the registered fingerprint database in real time. This was far more secure than traditional one-time authentication—because it wasn’t “pass once, valid forever.” It checked every single frame.
But this system had a theoretical blind spot.
What if the attacker didn’t simply record a signal and replay it—but used hardware precise enough to receive the legitimate terminal’s signal, clone its physical-layer characteristics in real time, frame by frame, and then forward the cloned signal? In other words, build a physical-layer “proxy”—simulating the legitimate terminal’s fingerprint to the uplink, and simulating the base station’s fingerprint to the downlink, acting as a completely transparent relay in between.
The receiver couldn’t tell the difference. Because at the physical layer, every bit of the data stream had perfect fingerprint characteristics.
Lu Yuan drew a preliminary system block diagram on paper. The pencil lines were crooked, but the chain of logic in his head was exceptionally clear.
Three core requirements:
- An SDR (Software-Defined Radio) platform for real-time signal capture and reconstruction.
- A sample of the target terminal’s legally registered signal fingerprint—even a very short segment of communication signal would do.
- A real-time processing algorithm fast enough—signal round-trip delay had to be within microseconds, or the system would detect the anomaly through latency jitter.
The first two he could figure out. The third… required compute power at a certain scale.
That meant tokens. Lots of tokens. Far more than a Copper-tier account could afford.
But this was another path. Now he could at least see the outline of that path—unlike the gray progress bar at the hospital pointing toward despair. This one was black, narrow, leading to an unknown destination.
The sky outside the window was turning fishbelly white. Lu Yuan put down his pen and rubbed his burning eyes. Seven or eight sheets of A4 paper covered in block diagrams and formulas lay scattered across the table, like a madman’s graffiti.
What he didn’t know was that, eight thousand kilometers from Shenzhen, in an office in Belgrade, a middle-aged man was staring at a string of alert logs on his screen, a cup of cold coffee in his hand.
The alert originated from Starlink’s core network anomaly detection system—not triggered by a present intrusion, but tracing back to a seven-year-old copy of a Huawei experimental log that had never been archived, where one page’s marginal note had tripped a semantic association rule.
The note read: “Under these test conditions, the signal fingerprint authentication scheme based on the transmit chain is theoretically vulnerable to record-and-replay attacks.”
Milan Vojnović, Starlink’s chief protocol architect, slowly set down his coffee cup.
He stared at that line, and a highly subtle smile tugged at the corner of his mouth—a smile no bystander could interpret. Like a seed planted seven years ago, finally seeing the season for germination.
He dismissed the alert window. Did not report it. Did not flag it. Took no action at all.
Outside, it was already light. Shenzhen’s morning and Belgrade’s night interwove under the same Starlink network. One hundred twenty thousand satellites faithfully transmitted every data packet, unknowing, unperturbed.
