Secure masking of channel activity for transmission security (transec) enabled terminals in satellite communication networks

A system for implementing link-layer transmission security (TRANSEC) in a satellite communication system, the system comprising:

• one or more processors;
• and
• a non-transitory, processor-readable memory having instructions stored thereon, which, when executed, cause the one or more processors to perform steps comprising:
• receiving a packet data unit (PDU) associated with TRANSEC traffic being sent to a destination TRANSEC-enabled (TE) terminal of a plurality of TE terminals;
• generating a link-layer session key for the PDU;
• encapsulating the PDU into an stream encapsulation (SE) packet according to a TRANSEC stream encapsulation (SE-T) protocol, so that the SE packet includes an SE payload and an SE header, the SE payload comprising the PDU, and the SE header comprising both an inner label and an outer label, the outer label indicating to any of the plurality of TE terminals that a true identifier of the destination TE terminal is represented in the inner label;
• encrypting the SE packet based at least on the link-layer session key, so that the SE payload and the inner label are encrypted, and the outer label is unencrypted;
• and
• transmitting the encrypted SE packet over a satellite outroute to at least the destination TE terminal.

A system for implementing link-layer transmission security (TRANSEC) in a satellite communication system, the system comprising:

• one or more processors;
• and
• a non-transitory, processor-readable memory having instructions stored thereon, which, when executed, cause the one or more processors to perform steps comprising:
• receiving an encrypted stream encapsulation (SE) packet by a receiving TRANSEC-enabled (TE) terminal via a satellite outroute, the SE packet encapsulated prior to transmission over the outroute according to a TRANSEC stream encapsulation (SE-T) protocol, so that the SE packet includes an SE payload and an SE header, the SE payload comprising a PDU destined for a destination TE terminal of a plurality of TE terminals comprising the receiving TE terminal, and the SE header comprising both an inner label and an outer label, the outer label indicating to any of the plurality of TE terminals that a true identifier of the destination TE terminal is represented in the inner label;
• filtering the encrypted SE packet based on the outer label to determine whether the outer label indicates that the true identifier of the destination TE terminal is represented in the inner label;
• decrypting the encrypted SE packet responsive to determining that the outer label indicates that the true identifier of the destination TE terminal is represented in the inner label;
• filtering the decrypted SE packet based on the inner label, subsequent to the decrypting, to determine whether the receiving TE terminal is the destination TE terminal;
• and
• decapsulating the decrypted SE packet to at least partially recover the PDU responsive to determining that the receiving TE terminal is the destination TE terminal.