Laurence Duquerroy

SatiPSec : An Optimized Solution for Securing Multicast and Unicast Satellite Transmissions

In satellite networks, the security of data exchanged on the satellite segment is threatened by many types of attacks such as eavesdropping, intrusion of unauthorized satellite terminals, satellite terminal cloning... The integration of security mechanisms is therefore considered today as an essential requirement. Some existing solutions may be recommended, however they do not offer all the necessary security services. For instance, the optional security mechanisms defined in the DVB-RCS standard provide insufficient security support, especially in satellite networks with natural broadcast/multicast capability over large areas. The use of well-known upper layers security protocols such as SSL (Secure Socket Layer) or IPSec/IKE can be considered too, but they are dedicated to unicast communications. The SatIPSec solution has been designed to provide an optimized and adapted security solution for satellite networks. It offers a new way of transparently and efficiently securing unicast and multicast satellite transmissions, with a strong access control, data confidentiality, data integrity, and data authentication as security services. SatIPSec has recently been implemented in a demonstrator developed in the context of the SATIP6 IST project. In this implementation, which allows to manage centrally secure multicast groups and Virtual Private Networks, key distribution is achieved according to the “Flat Multicast Key Exchange” protocol of SatIPSec, and data are encrypted and authenticated according to the IPSec protocol adapted to multicast. This paper introduces the principles of the security mechanisms involved in SatIPSec, and presents the features of the implementation and its results.

Satellite IP Sec: An Optimized Way of Securing Multicast Wireless Communications

The aim of this work is to introduce a new way of transparently securing both unicast and multicast services, optimised for satellite networks, named SatIPSec.