Encrypted satellite communications

A method of providing encrypted communications for transmission via satellite, the method comprising:

• providing a transport-layer session with a secure server via satellite;
• generating a cryptographic session public-private key pair using a secure, hardware-based cryptoprocessor;
• transmitting a message including the public session key to the secure server via the transport-layer session;
• receiving a response from the secure server, the response comprising a public key;
• computing, at the hardware-based cryptoprocessor, a shared key using the received public key and the generated private key;
• encrypting payload data using the shared key;
• and
• transmitting the encrypted payload data to the secure server.

A secure router apparatus configured to perform encrypted communications via satellite, the apparatus comprising:

• a hardware-based cryptoprocessor, and
• a processing environment, the secure router apparatus being configured to:
• provide a transport-layer session with a secure server via satellite;
• generate a cryptographic public-private key pair at the hardware-based cryptoprocessor;
• transmit a message including the public key to the secure server via the transport-layer session;
• receive a response from the secure server, the response comprising a public key;
• compute a shared key using the received public key and the generated private key;
• encrypt payload data using the shared key;
• and
• transmit the encrypted payload data to the secure server.