Abstract:
Network access providers implement interactive procedures and subscriber terminals employ embedded secure authentication structures and procedures to ensure that a satellite modem at the subscriber terminal accurately verifies the identity of a satellite modem terminal system at the location of the network access provider gateway facility during the satellite modem initialization process so that the satellite modem will only attempt to acquire satellite resource from the appropriate (authenticated and authorized) satellite modem termination system. In a virtual downstream channel environment, diverse downstream channel feeds are distinguished by authentication procedures. The present invention differs from standard theft of service prevention because theft of subscriber prevention is in a virtual channel environment, where subscriber terminals have access to a plurality of virtual channels by the nature of the signal.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    The present application is a continuation of PCT Application Serial No. PCT/US2007/079561, filed on Sep. 26, 2007, entitled “Multi-Service Provider Authentication,” and claims benefit under 35 USC119(e) of U.S. provisional Application No. 60/828,021, filed on Oct. 3, 2006, entitled “Multi-Service Provider Subscriber Authentication,” and expressly incorporates by reference each of the following patent applications in their entirety for all purposes:
       PCT Application Serial No. PCT/US07/79577, filed Sep. 26, 2007, entitled “Improved Spot Beam Satellite Ground Systems” (Attorney Docket No. 017018-009510PC);   PCT Application Serial No. PCT/US2007/079565, filed Sep. 26, 2007, entitled “Large Packet Concatenation In Satellite Communication System” (Attorney Docket No. 017018-008210PC);   PCT Application Serial No. PCT/US2007/079569, filed Sep. 26, 2007, entitled “Upfront Delayed Concatenation In Satellite Communication System” (Attorney Docket No. 017018-010510PC);   PCT Application Serial No. PCT/US2007/79571, filed Sep. 26, 2007, entitled “Map-Trigger Dump Of Packets In Satellite Communication System” (Attorney Docket No. 017018-010610PC);   PCT Application Serial No. PCT/US2007/079563, filed Sep. 26, 2007, entitled “Web/Bulk Transfer Preallocation Of Upstream Resources In A Satellite Communication System” (Attorney Docket No. 017018-010710PC);   PCT Application Serial No. PCT/US2007/079567, filed Sep. 26, 2007, entitled “Improved Spot Beam Satellite Systems” (Attorney Docket No. 017018-008010PC);   PCT Application Serial No. PCT/US07/79517, filed Sep. 26, 2007, entitled “Downstream Waveform Sub-Channelization For Satellite Communications” (Attorney Docket No. 026258-002400PC);   PCT Application Serial No. PCT/US07/79523, filed Sep. 26, 2007, entitled “Packet Reformatting For Downstream Links” (Attorney Docket No. 026258-002700PC); and   PCT Application Serial No. PCT/US07/79541, filed Sep. 26, 2007, entitled “Upstream Resource Allocation For Satellite Communications” (Attorney Docket No. 026258-002800PC);   U.S. Provisional Patent Application No. 60/828,044, filed Oct. 3, 2006 for “Web/Bulk Transfer Preallocation Of Upstream Resources In A Satellite Communication System” (Attorney Docket No. 017018-010700US);   U.S. Continuation-in-Part patent application Ser. No. 11/538,431, filed Oct. 3, 2006 for “Code Reuse Multiple Access For A Satellite Return Link” (Attorney Docket No. 017018-001212US);   U.S. Continuation-in-Part patent application Ser. No. 11/538,429, filed Oct. 3, 2006 for “Method For Congestion Management” (Attorney Docket No. 017018-006110US);       
 
     
    
     FIELD OF THE INVENTION 
       [0014]    The present invention relates to wireless communications in general and, in particular, to a satellite communications network. 
       BACKGROUND OF THE INVENTION 
       [0015]    Consumer broadband satellite services are gaining traction in North America with the start up of star network services using Ka band satellites. While such first generation satellite systems may provide multi-gigabit per second (Gbps) per satellite overall capacity, the design of such systems inherently limits the number of customers that may be adequately served. Moreover, the fact that the capacity is split across numerous coverage areas further limits the bandwidth to each subscriber. 
         [0016]    While existing designs have a number of capacity limitations, the demand for such broadband services continues to grow. The past few years have seen strong advances in communications and processing technology. This technology, in conjunction with selected innovative system and component design, may be harnessed to produce a novel satellite communications system to address this demand. 
       Multi-Service Provider Subscriber Authentication  
       [0017]    Unlike the world of information distribution via terrestrial cable systems, where there are safeguards against the theft of service, by unauthorized users from the single authorized legitimate cable service provider, which operates under the DOCSIS technology (Data-Over-Cable Service Interface Specification), in the satellite information delivery world, there is a risk of “theft of subscriber” through unauthorized use of a terminal that is intended for use to access one service provider to access the services of another service provider. What is needed is a mechanism to minimize such a risk. 
       SUMMARY OF THE INVENTION 
       [0018]    According to the invention, in a data over satellite system, network access providers implement interactive procedures and subscriber terminals employ embedded secure authentication structures and procedures to ensure that a satellite modem (SM) at the subscriber terminal accurately verifies the identity of a satellite modem terminal system at the location of the network access provider gateway facility during the satellite modem initialization process so that the satellite modem will only attempt to acquire satellite resource from the appropriate satellite modem termination system, namely a termination system that is both authenticated and authorized. In a virtual downstream channel environment, diverse downstream channel feeds are distinguished by authentication procedures. The present invention differs from standard theft of service prevention because theft of subscriber prevention is in a virtual channel environment, where subscriber terminals have access to a plurality of virtual channels by the nature of the signal. 
         [0019]    The invention will be better understood by reference to the following detailed description in connection with the accompanying drawings. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0020]      FIGS. 1A and 1B  are block diagrams of a satellite communication system 
           [0021]      FIGS. 2A and 2B  are maps showing geographical distributions of beams. 
           [0022]      FIG. 3  is a block diagram of a gateway system. 
           [0023]      FIG. 4  is a block diagram of a control system. 
           [0024]      FIG. 5  is a block diagram of communication and control elements of a satellite relay. 
           [0025]      FIGS. 6A and 6B  are block diagrams of upstream and downstream translators of  FIG. 5 . 
           [0026]      FIG. 7  is a block diagram of a subscriber facility with a subscriber terminal. 
           [0027]      FIG. 8  is a timing diagram of a forward channel superframe. 
           [0028]      FIG. 9  is a timing diagram of a typical return channel superframe. 
           [0029]      FIG. 10  is a block diagram of a gateway transmitter. 
           [0030]      FIG. 11  is a block diagram of a gateway receiver. 
           [0031]      FIGS. 12A and 12B  are diagrams illustrating frequency allocation of a gateway. 
           [0032]      FIG. 13  is a block diagram of a forward channel and return channels in a relay satellite. 
           [0033]      FIG. 14  is a diagram illustrating steps of the user initialization and process and of the system architecture without the authentication process. 
           [0034]      FIG. 15  is a diagram of the architecture for management of authentication according to the invention. 
           [0035]      FIG. 16  is a diagram of the gateway SMTS validation chain at the user SM. 
           [0036]      FIG. 17  is a diagram illustrating implementation of the user terminal satellite modem (SM) initialization process with an added the Network Access Provider Authentication (NAPA) procedure. 
           [0037]      FIG. 18  is a flow chart of the process at the SM for performing the authentication operations in the broadcast phase. 
           [0038]      FIG. 19  is a flow chart of the process at the SM for performing the authentication operations in the interactive phase. 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0039]    Various embodiments of the present invention comprise systems, methods, devices, and software for a novel broadband satellite network. This description provides exemplary embodiments only, and is not intended to limit the scope, applicability or configuration of the invention. Rather, the ensuing description of the embodiments will provide those skilled in the art with an enabling description for implementing embodiments of the invention. Various changes may be made in the function and arrangement of elements without departing from the spirit and scope of the invention. 
         [0040]    Thus, various embodiments may omit, substitute, or add various procedures or components as appropriate. For instance, it should be appreciated that in alternative embodiments, the methods may be performed in an order different than that described, and that various steps may be added, omitted or combined. Also, features described with respect to certain embodiments may be combined in various other embodiments. Different aspects and elements of the embodiments may be combined in a similar manner. Also, a number of steps may be required before, after, or concurrently with the following embodiments. 
         [0041]    It should also be appreciated that the following systems, methods, devices, and software may be a component of a larger system, wherein other procedures may take precedence over or otherwise modify their application. 
         [0042]      FIG. 1A  is a block diagram of an exemplary satellite communications system  100  configured according to various embodiments of the invention. The satellite communications system  100  includes a network  120 , such as the Internet, interfaced with a gateway  115  that is configured to communicate with one or more subscriber terminals  130 , via a satellite  105 . A gateway  115  is sometimes referred to as a hub or ground station. Subscriber terminals  130  are sometimes called modems, satellite modems or user terminals. As noted above, although the communications system  100  is illustrated as a geostationary satellite  105  based communication system, it should be noted that various embodiments described herein are not limited to use in geostationary satellite based systems, for example some embodiments could be low earth orbit (LEO) satellite based systems. 
         [0043]    The network  120  may be any type of network and can include, for example, the Internet, an IP network, an intranet, a wide-area network (“WAN”), a local-area network (“LAN”), a virtual private network, the Public Switched Telephone Network (“PSTN”), and/or any other type of network supporting data communication between devices described herein, in different embodiments. A network  120  may include both wired and wireless connections, including optical links. Many other examples are possible and apparent to those skilled in the art in light of this disclosure. As illustrated in a number of embodiments, the network may connect the gateway  115  with other gateways (not pictured), which are also in communication with the satellite  105 . 
         [0044]    The gateway  115  provides an interface between the network  120  and the satellite  105 . The gateway  115  may be configured to receive data and information directed to one or more subscriber terminals  130 , and can format the data and information for delivery to the respective destination device via the satellite  105 . Similarly, the gateway  115  may be configured to receive signals from the satellite  105  (e.g., from one or more subscriber terminals) directed to a destination in the network  120 , and can format the received signals for transmission along the network  120 . 
         [0045]    A device (not shown) connected to the network  120  may communicate with one or more subscriber terminals, and through the gateway  115 . Data and information, for example IP datagrams, may be sent from a device in the network  120  to the gateway  1   15 . The gateway  115  may format a Medium Access Control (MAC) frame in accordance with a physical layer definition for transmission to the satellite  130 . A variety of physical layer transmission modulation and coding techniques may be used with certain embodiments of the invention, including those defined with the DVB-S2 and WiMAX standards. The link  135  from the gateway  115  to the satellite  105  may be referred to hereinafter as the downstream uplink  135 . 
         [0046]    The gateway  115  may use an antenna  110  to transmit the signal to the satellite  105 . In one embodiment, the antenna  110  comprises a parabolic reflector with high directivity in the direction of the satellite and low directivity in other directions. The antenna  110  may comprise a variety of alternative configurations and include operating features such as high isolation between orthogonal polarizations, high efficiency in the operational frequency bands, and low noise. 
         [0047]    In one embodiment, a geostationary satellite  105  is configured to receive the signals from the location of antenna  110  and within the frequency band and specific polarization transmitted. The satellite  105  may, for example, use a reflector antenna, lens antenna, array antenna, active antenna, or other mechanism known in the art for reception of such signals. The satellite  105  may process the signals received from the gateway  115  and forward the signal from the gateway  115  containing the MAC frame to one or more subscriber terminals  130 . In one embodiment, the satellite  105  operates in a multi-beam mode, transmitting a number of narrow beams each directed at a different region of the earth, allowing for frequency re-use. With such a multibeam satellite  105 , there may be any number of different signal switching configurations on the satellite, allowing signals from a single gateway  115  to be switched between different spot beams. In one embodiment, the satellite  105  may be configured as a “bent pipe” satellite, wherein the satellite may frequency convert the received carrier signals before retransmitting these signals to their destination, but otherwise perform little or no other processing on the contents of the signals. A variety of physical layer transmission modulation and coding techniques may be used by the satellite  105  in accordance with certain embodiments of the invention, including those defined with the DVB-S2 and WiMAX standards. For other embodiments a number of configurations are possible (e.g., using LEO satellites, or using a mesh network instead of a star network), as evident to those skilled in the art. 
         [0048]    The service signals transmitted from the satellite  105  may be received by one or more subscriber terminals  130 , via the respective subscriber antenna  125 . In one embodiment, the antenna  125  and terminal  130  together comprise a very small aperture terminal (VSAT), with the antenna  125  measuring approximately 0.6 meters in diameter and having approximately 2 watts of power. In other embodiments, a variety of other types of antennas  125  may be used at the subscriber terminal  130  to receive the signal from the satellite  105 . The link  150  from the satellite  105  to the subscriber terminals  130  may be referred to hereinafter as the downstream downlink  150 . Each of the subscriber terminals  130  may comprise a single user terminal or, alternatively, comprise a hub or router (not pictured) that is coupled to multiple user terminals. Each subscriber terminal  130  may be connected to consumer premises equipment (CPE)  160  comprising, for example computers, local area networks, Internet appliances, wireless networks, etc. 
         [0049]    In one embodiment, a Multi-Frequency Time-Division Multiple Access (MF-TDMA) scheme is used for upstream links  140 ,  145 , allowing efficient streaming of traffic while maintaining flexibility in allocating capacity among each of the subscriber terminals  130 . In this embodiment, a number of frequency channels are allocated which may be fixed, or which may be allocated in a more dynamic fashion. A Time Division Multiple Access (TDMA) scheme is also employed in each frequency channel. In this scheme, each frequency channel may be divided into several timeslots that can be assigned to a connection (i.e., a subscriber terminal  130 ). In other embodiments, one or more of the upstream links  140 ,  145  may be configured with other schemes, such as Frequency Division Multiple Access (FDMA), Orthogonal Frequency Division Multiple Access (OFDMA), Code Division Multiple Access (CDMA), or any number of hybrid or other schemes known in the art. 
         [0050]    A subscriber terminal, for example  130 - a,  may transmit data and information to a network  120  destination via the satellite  105 . The subscriber terminal  130  transmits the signals via the upstream uplink  145 - a  to the satellite  105  using the antenna  125 - a.  A subscriber terminal  130  may transmit the signals according to a variety of physical layer transmission modulation and coding techniques, including those defined with the DVB-S2 and WiMAX standards. In various embodiments, the physical layer techniques may be the same for each of the links  135 ,  140 ,  145 ,  150 , or may be different. The link from the satellite  105  to the gateway  115  may be referred to hereinafter as the upstream downlink  140 . 
         [0051]    Turning to  FIG. 1B , a block diagram is shown illustrating an alternative embodiment of a satellite communication system  100 . This communication system  100  may, for example, comprise the system  100  of  FIG. 1A , but is in this instance described with greater particularity. In this embodiment, the gateway  115  includes a Satellite Modem Termination System (SMTS), which is based at least in part on the Data-Over-Cable Service Interface Standard (DOCSIS). The SMTS in this embodiment includes a bank of modulators and demodulators for transmitting signals to and receiving signals from subscriber terminals  130 . The SMTS in the gateway  115  performs the real-time scheduling of the signal traffic through the satellite  105 , and provides the interfaces for the connection to the network  120 . 
         [0052]    In this embodiment, the subscriber terminals  135  use portions of DOCSIS-based modem circuitry, as well. Therefore, DOCSIS-based resource management, protocols, and schedulers may be used by the SMTS for efficient provisioning of messages. DOCSIS-based components may be modified, in various embodiments, to be adapted for use therein. Thus, certain embodiments may utilize certain parts of the DOCSIS specifications, while customizing others. 
         [0053]    While a satellite communications system  100  applicable to various embodiments of the invention is broadly set forth above, a particular embodiment of such a system  100  will now be described. In this particular example, approximately 2 gigahertz (GHz) of bandwidth is to be used, comprising four 500 megahertz (MHz) bands of contiguous spectrum. Employment of dual-circular polarization results in usable frequency comprising eight 500 MHz non-overlapping bands with 4 GHz of total usable bandwidth. This particular embodiment employs a multi-beam satellite  105  with physical separation between the gateways  115  and subscriber spot beams, and configured to permit reuse of the frequency on the various links  135 ,  140 ,  145 ,  150 . A single Traveling Wave Tube Amplifier (TWTA) is used for each service link spot beam on the downstream downlink, and each TWTA is operated at full saturation for maximum efficiency. A single wideband carrier signal, for example using one of the 500 MHz bands of frequency in its entirety, fills the entire bandwidth of the TWTA, thus allowing a minimum number of space hardware elements. Spotbeam size and TWTA power may be optimized to achieve maximum flux density on the earth&#39;s surface of −118 decibel-watts per meter squared per megahertz (dbW/m 2 /MHz). Thus, using approximately 2 bits per second per hertz (bits/s/Hz), there is approximately 1 Gbps of available bandwidth per spot beam. 
         [0054]    With reference to  FIG. 12A , an embodiment of a forward link distribution system  1200  is shown. The gateway  115  is shown coupled to an antenna  110 , which generates four downstream signals. A single carrier with 500 MHz of spectrum is used for each of the four downstream uplinks  135 . In this embodiment, a total of two-frequencies and two polarizations allow four separate downstream uplinks  135  while using only 1 GHz of the spectrum. For example, link A  135 -A could be Freq 1U (27.5-28.0 GHz) with left-hand polarization, link B  135 -B could be Freq 1U (27.5-28.0) GHz with right-hand polarization, link C could be Freq 2U (29.5-30 GHz) with left-hand polarization, and link D could be Freq 2U (29.5-30 GHz) with left-hand polarization. 
         [0055]    The satellite  105  is functionally depicted as four “bent pipe” connections between a feeder and service link. Carrier signals can be changed through the satellite  105  “bent pipe” connections along with the orientation of polarization. The satellite  105  converts each downstream uplink  135  signal into a downstream downlink signal  150 . 
         [0056]    In this embodiment, there are four downstream downlinks  150  that each provides a service link for four spot beams  205 . The downstream downlink  150  may change frequency in the bent pipe as is the case in this embodiment. For example, downstream uplink A  135 -A changes from a first frequency (i.e., Freq 1U) to a second frequency (i.e., Freq 1D) through the satellite  105 . Other embodiments may also change polarization between the uplink and downlink for a given downstream channel. Some embodiments may use the same polarization and/or frequency for both the uplink and downlink for a given downstream channel. 
         [0057]    Referring next to  FIG. 12B , an embodiment of a return link distribution system is shown. This embodiment shows four upstream uplinks  145  from four sets of subscriber terminals  125 . A “bent pipe” satellite  105  takes the upstream uplinks  145 , optionally changes carrier frequency and/or polarization (not shown), and then redirects them as upstream downlinks  140  to a spot beam for a gateway  115 . In this embodiment, the carrier frequency changes between the uplink  145  and the downlink  140 , but the polarization remains the same. Because the feeder spot beams to the gateway  115  is not in the coverage area of the service beams, the same frequency pairs may be reused for both service links and feeder links. 
         [0058]    Turning to  FIGS. 2A and 2B , examples of a multi-beam system  200  configured according to various embodiments of the invention are shown. The multi-beam system  200  may, for example, be implemented in the network  100  described in  FIGS. 1A and 1B . Shown are the coverage of a number of feeder and service spot beam regions  225 ,  205 . In this embodiment, a satellite  215  reuses frequency bands by isolating antenna directivity to certain regions of a country (e.g., United States, Canada or Brazil). As shown in  FIG. 2A , there is complete geographic exclusivity between the feeder and service spot beams  205 ,  225 . But that is not the case for  FIG. 2B  where there may in some instances be service spot beam overlap (e.g.,  205 - c ,  205 - d,    205 - e ), while there is no overlap in other areas. However, with overlap, there are certain interference issues that may inhibit frequency band re-use in the overlapping regions. A four color pattern allows avoiding interference even where there is some overlap between neighboring service beams  205 . 
         [0059]    In this embodiment, the gateway terminals  210  are also shown along with their feeder beams  225 . As shown in  FIG. 2B , the gateway terminals  210  may be located in a region covered by a service spotbeam (e.g., the first, second and fourth gateways  210 - 1 ,  210 - 2 ,  210 - 4 ). However, a gateway may also be located outside of a region covered by a service spotbeam (e.g., the third gateway  210 - 3 ). By locating gateway terminals  210  outside of the service spotbeam regions (e.g., the third gateway  210 - 3 ), geographic separation is achieved to allow for re-use of the allocated frequencies. 
         [0060]    There are often spare gateway terminals  210  in a given feeder spot beam  225 . The spare gateway terminal  210 - 5  can substitute for the primary gateway terminal  210 - 4  should the primary gateway terminal  210 - 4  fail to function properly. Additionally, the spare can be used when the primary is impaired by weather. 
         [0061]    Referring next to  FIG. 8 , an embodiment of a downstream channel  800  is shown. The downstream channel  800  includes a series of superframes  804  in succession, where each superframe  804  may have the same size or may vary in size. This embodiment divides a superframe  804  into a number of virtual channels  808 ( 1 - n ). The virtual channels  808 ( 1 - n ) in each superframe  804  can be the same size or different sizes. The size of the virtual channels  808 ( 1 - n ) can change between different superframes  804 . Different coding can be optionally used for the various virtual channels  808  ( 1 - n ). In some embodiments, the virtual channels are as short as one symbol in duration. 
         [0062]    With reference to  FIG. 9 , an embodiment of an upstream channel  900  is shown. This embodiment uses MF-TDMA, but other embodiments can use CDMA, OFDM, or other access schemes. The upstream channel  900  has 500 MHz of total bandwidth in one embodiment. The total bandwidth is divided into m frequency sub-channels, which may differ in bandwidth, modulation, coding, etc. and may also vary in time based on system needs. 
         [0063]    In this embodiment, each subscriber terminal  130  is given a two-dimensional (2D) map to use for its upstream traffic. The 2D map has a number of entries where each indicates a frequency sub-channel  912  and time segment  908 ( 1 - 5 ). For example, one subscriber terminal  130  is allocated sub-channel m  912 - m,  time segment one  908 - 1 ; sub-channel two  912 - 2 , time segment two  908 - 2 ; sub-channel two  912 - 2 , time segment three  908 - 3 ; etc. The 2D map is dynamically adjusted for each subscriber terminal  130  according to anticipated need by a scheduler in the SMTS. 
         [0064]    Referring to  FIG. 13 , an embodiment of a channel diagram is shown. Only the channels for a single feeder spot beam  225  and a single service spot beam  205  are shown, but embodiments include many of each spot beam  225 ,  205  (e.g., various embodiments could have 60, 80, 100, 120, etc. of each type of spot beam  225 ,  205 ). The forward channel  800  includes n virtual channels  808  traveling from the gateway antenna  110  to the service spot beam  205 . Each subscriber terminal  130  may be allocated one or more of the virtual channels  808 . m MF-TDMA channels  912  make up the return channel  900  between the subscriber terminal (ST) antennas  125  and the feeder spot beam  225 . 
         [0065]    Referring next to  FIG. 3 , an embodiment of a ground system  300  of gateways  115  is shown in block diagram form. One embodiment could have fifteen active gateways  115  (and possibly spares) to generate sixty service spot beams, for example. The ground system  300  includes a number of gateways  115  respectively coupled to antennas  110 . All the gateways  115  are coupled to a network  120  such as the Internet. The network is used to gather information for the subscriber terminals. Additionally, each SMTS communicates with other SMTS and the Internet using the network  120  or other means not shown. 
         [0066]    Each gateway  115  includes a transceiver  305 , a SMTS  310  and a router  325 . The transceiver  305  includes both a transmitter and a receiver. In this embodiment, the transmitter takes a baseband signal and upconverts and amplifies the baseband signal for transmission of the downstream uplinks  135  with the antenna  110 . The receiver downconverts and tunes the upstream downlinks  140  along with other processing as explained below. The SMTS  310  processes signals to allow the subscriber terminals to request and receive information and schedules bandwidth for the forward and return channels  800 ,  900 . Additionally, the SMTS  310  provides configuration information and receives status from the subscriber terminals  130 . Any requested or returned information is forwarded via the router  325 . 
         [0067]    With reference to  FIG. 11 , an embodiment of gateway receiver  1100  is shown. This embodiment of the receiver  1100  processes four return channels  900  from four different service spot beams  205 . The return channels  900  may be divided among four pathways using antenna polarization and/or filtering  1104 . Each return channel is coupled to a low-noise amplifier (LNA)  1108 . Down conversion  1112  mixes down the signal into its intermediate frequency. Each of the upstream sub-channels  912  is separated from the signal by a number of tuners  1116 . Further processing is performed in the SMTS  310 . 
         [0068]    Referring next to  FIG. 10 , an embodiment of a gateway transmitter  1000  is shown. The downstream channels  800  are received at their intermediate frequencies from the SMTS  310 . With separate pathways, each downstream channel  800  is up-converted  1004  using two different carrier frequencies. A power amplifier  1008  increases the amplitude of the forward channel  900  before coupling to the antenna  110 . The antenna  110  polarizes the separate signals to keep the four forward channels  800  distinct as they are passed to the satellite  105 . 
         [0069]    With reference to  FIG. 4 , an embodiment of a SMTS  310  is shown in block diagram form. Baseband processing is done for the inbound and outbound links  135 ,  140  by a number of geographically separated gateways  115 . Each SMTS  310  is generally divided into two sections, specifically, the downstream portion  305  to send information to the satellite  105  and the upstream portion  315  to receive information from the satellite  105 . 
         [0070]    The downstream portion  305  takes information from the switching fabric  416  through a number of downstream (DS) blades  412 . The DS blades  412  are divided among a number of downstream generators  408 . This embodiment includes four downstream generators  408 , with one for each of the downstream channels  800 . For example, this embodiment uses four separate 500 MHz spectrum ranges having different frequencies and/or polarizations. A four-color modulator  436  has a modulator for each respective DS generator  408 . The modulated signals are coupled to the transmitter portion  1000  of the transceiver  305  at an intermediate frequency. Each of the four downstream generators  408  in this embodiment has J virtual DS blades  412 . 
         [0071]    The upstream portion  315  of the SMTS  310  receives and processes information from the satellite  105  in the baseband intermediate frequency. After the receiver portion  1100  of the transceiver  305  produces all the sub-channels  912  for the four separate baseband upstream signals, each sub-channel  912  is coupled to a different demodulator  428 . Some embodiments could include a switch before the demodulators  428  to allow any return link sub-channel  912  to go to any demodulator  428  to allow dynamic reassignment between the four return channels  908 . A number of demodulators are dedicated to an upstream (US) blade  424 . 
         [0072]    The US blades  424  serve to recover the information received from the satellite  105  before providing it to the switching fabric  416 . The US scheduler  430  on each US blade  424  serves to schedule use of the return channel  900  for each subscriber terminal  130 . Future needs for the subscriber terminals  130  of a particular return channel  900  can be assessed and bandwidth/latency adjusted accordingly in cooperation with the Resource Manager and Load Balancer (RM/LB) block  420 . 
         [0073]    The RM/LB block  420  assigns traffic among the US and DS blades. By communication with other RM/LB blocks  420  in other SMTSes  310 , each RM/LB block  420  can reassign subscriber terminals  130  and channels  800 ,  900  to other gateways  115 . This reassignment can take place for any number of reasons, for example, lack of resources and/or loading concerns. In this embodiment, the decisions are done in a distributed fashion among the RM/LB blocks  420 , but other embodiments could have decisions made by one master MR/LB block or at some other central decision-making authority. Reassignment of subscriber terminals  130  could use overlapping service spot beams  205 , for example. 
         [0074]    Referring next to  FIG. 5 , an embodiment of a satellite  105  is shown in block diagram form. The satellite  105  in this embodiment communicates with fifteen gateways  115  and all STs  130  using sixty feeder and service spot beams  225 ,  205 . Other embodiments could use more or less gateways/spot beams. Buss power  512  is supplied using a power source such as chemical fuel, nuclear fuel and/or solar energy. A satellite controller  516  is used to maintain attitude and otherwise control the satellite  105 . Software updates to the satellite  105  can be uploaded from the gateway  115  and performed by the satellite controller  516 . 
         [0075]    Information passes in two directions through the satellite  105 . A downstream translator  508  receives information from the fifteen gateways  115  for relay to subscriber terminals  130  using sixty service spot beams  205 . An upstream translator  504  receives information from the subscriber terminals  130  occupying the sixty spot beam areas and relays that information to the fifteen gateways  115 . This embodiment of the satellite can switch carrier frequencies in the downstream or upstream processors  508 ,  504  in a “bent-pipe” configuration, but other embodiments could do baseband switching between the various forward and return channels  800 ,  900 . The frequencies and polarization for each spot beam  225 ,  205  could be programmable or preconfigured. 
         [0076]    With reference to  FIG. 6A , an embodiment of an upstream translator  504  is shown in block diagram form. A Receiver and Downconverter (Rx/DC) block  616  receives all the return link information for the area defined by a spot beam  205  as an analog signal before conversion to an intermediate frequency (IF). There is a Rx/DC block  616  for each service spot beam area  205 . An IF switch  612  routes a particular baseband signal from a Rx/DC block  616  to a particular upstream downlink channel. The upstream downlink channel is filled using an Upconverter and Traveling Wave Tube Amplifier (UC/TWTA) block  620 . The frequency and/or polarization can be changed through this process such that each upstream channel passes through the satellite  105  in a bent pipe fashion. 
         [0077]    Each gateway  115  has four dedicated UC/TWTA blocks  620  in the upstream translator  504 . Two of the four dedicated UC/TWTA blocks  620  operate at a first frequency range and two operate at a second frequency range in this embodiment. Additionally, two use right-hand polarization and two use left-hand polarization. Between the two polarizations and two frequencies, the satellite  105  can communicate with each gateway  115  with four separate upstream downlink channels. 
         [0078]    Referring next to  FIG. 6B , an embodiment of a downstream translator  508  is shown as a block diagram. Each gateway  115  has four downstream uplink channels to the satellite  105  by use of two frequency ranges and two polarizations. A Rx/DC block  636  takes the analog signal and converts the signal to an intermediate frequency. There is a Rx/DC block  636  for all sixty downstream uplink channels from the fifteen gateways  115 . The IF switch  612  connects a particular channel  800  from a gateway  115  to a particular service spot beam  205 . Each IF signal from the switch  628  is modulated and amplified with a UC/TWTA block  632 . An antenna broadcasts the signal using a spot beam to subscriber terminals  130  that occupy the area of the spot beam. Just as with the upstream translator  504 , the downstream translator  508  can change carrier frequency and polarization of a particular downstream channel in a bent-pipe fashion. 
         [0079]      FIG. 7  comprises a block diagram illustrating a set of subscriber equipment  700  which may be located at a subscriber location for the reception and transmission of communication signals. Components of this set of subscriber equipment  700  may, for example, comprise the antenna  125 , associated subscriber terminal  130  and any consumer premises equipment (CPE)  160 , which may be a computer, a network, etc. 
         [0080]    An antenna  125  may receive signals from a satellite  105 . The antenna  125  may comprise a VSAT antenna, or any of a variety other antenna types (e.g., other parabolic antennas, microstrip antennas, or helical antennas). In some embodiments, the antenna  125  may be configured to dynamically modify its configuration to better receive signals at certain frequency ranges or from certain locations. From the antenna  125 , the signals are forwarded (perhaps after some form of processing) to the subscriber terminal  130 . The subscriber terminal  130  may include a radio frequency (RF) frontend  705 , a controller  715 , a virtual channel filter  702 , a modulator  725 , a demodulator  710 , a filter  706 , a downstream protocol converter  718 , an upstream protocol converter  722 , a receive (Rx) buffer  712 , and a transmit (Tx) buffer  716 . 
         [0081]    In this embodiment, the RF frontend  705  has both transmit and receive functions. The receive function includes amplification of the received signals (e.g., with a low noise amplifier (LNA)). This amplified signal is then downconverted (e.g., using a mixer to combine it with a signal from a local oscillator (LO)). This downconverted signal may be amplified again with the RF frontend  705 , before processing of the superframe  804  with the virtual channel filter  702 . A subset of each superframe  804  is culled from the downstream channel  800  by the virtual channel filter  702 , for example, one or more virtual channels  808  are filtered off for further processing. 
         [0082]    A variety of modulation and coding techniques may be used at the subscriber terminal  130  for signals received from and transmitted to a satellite. In this embodiment, modulation techniques include BPSK, QPSK, 8PSK, 16APSK, 32PSK. In other embodiments, additional modulation techniques may include ASK, FSK, MFSK, and QAM, as well as a variety of analog techniques. The demodulator  710  may demodulate the down-converted signals, forwarding the demodulated virtual channel  808  to a filter  706  to strip out the data intended for the particular subscriber terminal  130  from other information in the virtual channel  808 . 
         [0083]    Once the information destined for the particular subscriber terminal  130  is isolated, a downstream protocol converter  718  translates the protocol used for the satellite link into one that the DOCSIS MAC block  726  uses. Alternative embodiments could use a WiMAX MAC block or a combination DOCSIS/WiMAX block. A Rx buffer  712  is used to convert the high-speed received burst into a lower-speed stream that the DOCSIS MAC block  726  can process. The DOCSIS MAC block  726  is a circuit that receives a DOCSIS stream and manages it for the CPE  160 . Tasks such as provisioning, bandwidth management, access control, quality of service, etc. are managed by the DOCSIS MAC block  726 . The CPE can often interface with the DOCSIS MAC block  726  using Ethernet, WiFi, USB and/or other standard interfaces. In some embodiments, a WiMax block  726  could be used instead of a DOCSIS MAC block  726  to allow use of the WiMax protocol. 
         [0084]    It is also worth noting that while a downstream protocol converter  718  and upstream protocol converter  722  may be used to convert received packets to DOCSIS or WiMax compatible frames for processing by a MAC block  726 , these converters will not be necessary in many embodiments. For example, in embodiments where DOCSIS or WiMax based components are not used, the protocol used for the satellite link may also be compatible with the MAC block  726  without such conversions, and the converters  718 ,  722  may therefore be excluded. 
         [0085]    Various functions of the subscriber terminal  130  are managed by the controller  715 . The controller  715  may oversee a variety of decoding, interleaving, decryption, and unscrambling techniques, as known in the art. The controller may also manage the functions applicable to the signals and exchange of processed data with one or more CPEs  160 . The CPE  160  may comprise one or more user terminals, such as personal computers, laptops, or any other computing devices as known in the art. 
         [0086]    The controller  715 , along with the other components of the subscriber terminal  130 , may be implemented in one or more Application Specific Integrated Circuits (ASICs), or a general purpose processor adapted to perform the applicable functions. Alternatively, the functions of the subscriber terminal  130  may be performed by one or more other processing units (or cores), on one or more integrated circuits. In other embodiments, other types of integrated circuits may be used (e.g., Structured/Platform ASICs, Field Programmable Gate Arrays (FPGAs) and other Semi-Custom ICs), which may be programmed in any manner known in the art. The controller may be programmed to access memory unit (not shown). It may fetch instructions and other data from the memory unit, or write data to the memory-unit. 
         [0087]    As noted above, data may also be transmitted from the CPE  160  through the subscriber terminal  130  and up to a satellite  105  in various communication signals. The CPE  160 , therefore, may transmit data to DOCSIS MAC block  726  for conversion to the DOCSIS protocol before that protocol is translated with an upstream protocol converter  722 . The slow-rate data waits in the Tx buffer  716  until it is burst over the satellite link. 
         [0088]    The processed data is then transmitted from the Tx buffer  716  to the modulator  725 , where it is modulated using one of the techniques described above. In some embodiments, adaptive or variable coding and modulation techniques may be used in these transmissions. Specifically, different modulation and coding combinations, or “modcodes,” may be used for different packets, depending on the signal quality metrics from the antenna  125  to the satellite  105 . Other factors, such as network and satellite congestion issues, may be factored into the determination, as well. Signal quality information may be received from the satellite or other sources, and various decisions regarding modcode applicability may be made locally at the controller, or remotely. The RF frontend  705  may then amplify and upconvert the modulated signals for transmission through the antenna  125  to the satellite. 
         [0089]    Herein follows a description of a specific aspect of the invention 
       Multi-Service Provider Subscriber Authentication  
       [0090]      FIG. 14  illustrates the system architecture of the satellite communication system as hereinabove described, further illustrating the user SM initialization process without the use of Network Access Provider Authentication (NAPA) according to the present invention. 
         [0091]    The following assumptions are made:
       The following entities are secure and trusted. If any of the entities below is compromised, the Network Access Provider Authentication (NAPA) will likely break down.
           SM codes and configurations   Authentication algorithm (i.e., the RSA digital signature algorithm)   Private key (for the RSA digital signature algorithm)   
           The following entities are not secure or not trusted.
           Satellite communications channel (i.e., eavesdropping)   SMTS at other Network Access Providers (NAPs)   
           The certificate management architecture of the present invention has the structure as shown in  FIG. 15 , where a plurality of NAPs each have associated therewith an SMTS certificate. Note that the certificate management architecture for BPI+ is beyond the scope of this disclosure, and it is shown for reference purpose only.   The SM validates the SMTS Certificate through the validation chain as shown in  FIG. 16 , namely through a public key NAPA CA certificate, typically by means of public key encryption.   The network access provicer (NAP) undertakes the responsibility for enabling/provisioning the NAPA for the SMTS.   An assumption, though not a specific requirement is that the user terminal satellite modem manufacturer undertakes the responsibility for enabling/provisioning the NAPA for the user SM, and is thus the source of relevant safeguards.       
 
         [0103]    The NAPA procedure is described herein. The NAPA procedure is incorporated into the user SM initialization process. When the NAPA procedure is enabled, the user SM verifies the NAP identify upon entering the network. Thereupon the protocol operation of the NAPA procedure after the NAPA is enabled/provisioned. The enabling/provisioning of the NAPA procedure is explained hereinafter. 
         [0104]      FIG. 17  shows the SM initialization process that adds the NAPA procedure. The NAPA procedure consists of the following two phases. In the first phase (also referred to as the broadcast phase), the SM verifies the NAP identifier that is broadcasted in the downstream. In the second phase (also referred to as the interactive phase), the SM further verifies the NAP identity by using the challenge/response protocol. Both phases are described in details below. 
         [0105]    The broadcast phase follows immediately after the downstream acquisition step in the SM initialization process. During the broadcast phase, the SM verifies that it acquires the downstream from the rightful NAP (before advancing to the upstream acquisition step and transmitting on the upstream in the ranging step). The SMTS broadcasts the NAP identifier that is carried in a new MAC Management message, referred to as the NAP Identification (NAPID) message in this paper. The SMTS may broadcast the NAPID message along with every UCD message; alternatively, the SMTS may reduce the frequency of the NAPID message broadcast for reducing the bandwidth overhead. The NAPID message includes the following information:
       SMTS identification data (e.g., SMTS serial number, SMTS manufacturer, SMTS manufacturing location, etc),   SMTS Certificate, that contains the SMTS identification data and the SMTS RSA public key (to be used in the NAPA interactive phase, and also referred to as the SMTS public key or NAPA public key), for verifying the SMTS identification data and for verifying the binding between the SMTS identification data and the SMTS public key. (The SMTS Certificate is signed by the NAP Certificate Authority private key.  FIG. 15  shows the certificate management architecture).       
 
         [0108]      FIG. 18  shows the user SM operational flow chart for the broadcast phase. During the broadcast phase, the user SM validates the SMTS Certificate in the NAPID message and determines whether to continue advancing the initialization process on the current downstream/upstream (in the case of receiving a valid SMTS Certificate) or to scan for another downstream (in the case of receiving an invalid SMTS Certificate). The SM validates the SMTS Certificate using the following criteria. A SMTS Certificate is valid if:
       The SMTS Certificate chains to the NAP Certificate in the SM; and   The SMTS Certificate signature can be verified with the public key in the NAP Certificate in the SM; and   The SMTS identification data in the SMTS Certificate matches the SMTS identification data in the NAPID message.         
         [0112]    The SMTS Certificate uniquely identifies the NAP of each SMTS chassis. If the SM acquires the downstream from the rightful NAP/SMTS, the SM will receive a valid SMTS Certificate in the NAPA broadcast phase and will continue advancing the initialization process on the current downstream/upstream; otherwise, the SM will receive an invalid SMTS Certificate and will scan for another downstream. 
         [0113]    The NAPA broadcast phase is vulnerable to the malicious NAP that launches playback attacks by cloning/broadcasting the SMTS identification data and SMTS Certificate. The NAPA interactive phase repairs the above vulnerability. However, the broadcast phase alone may be sufficient during the early stage of the subject network deployment (because these NAPs do not compete with each other). 
         [0114]    The interactive phase follows immediately after the ranging step in the SM initialization process. The interactive phase employs the signature algorithm described in for example, RSA Laboratories, “PKCS #1 v2.0: RSA Cryptography Standard,” Oct. 1, 1998, and the challenge/response authentication mechanism.  FIG. 19  shows the SM operational flow chart for the interactive phase. The SM sends “challenge” values that are embedded in the initial ranging request (RNG-REQ) message. The challenge values include the SM MAC address (as part of the MAC Management message header in the initial RNG-REQ message) and the mini-slot counter index (as derived from the upstream MAP timing reference). Note that the initial RNG-REQ message is not altered for carrying these two challenge values above; thus, the challenge values do not consume additional upstream bandwidth. Upon receiving the SM challenge (i.e., the initial RNG-REQ message), the SMTS generates the digital signature of the challenges values using the SMTS private key (i.e., NAPA private key). Then, the SMTS replies to the SM challenge with the digital signature (i.e., the “response”) that is carried in a new time-length-value tuple (TLV) in the initial ranging response (RNG-RSP) message. Upon receiving the SMTS response (i.e., the initial RNG-RSP message), the SM validates the digital signature by using the SMTS public key (i.e., NAPA public key) that is received from the NAPID message during the broadcast phase. If the SM successfully authenticates the NAP, then the SM advances to the device-provisioning step (i.e., DHCP/ToD/TFTP) in the initialization process; otherwise, the SM returns to the downstream acquisition step. 
         [0115]    The details of the interactive phase are subject to changes. There exist two other alternative options for inserting the interactive phase into the SM initialization process:
       Where the interactive phase is a stand-alone step that follows immediately after the ranging step, and   Where the interactive phase is embedded in the registration step.       
 
         [0118]    The protocol operation of these two options would work very similarly to the baseline above. The major differences are in implementation-related implications. The details of these two options are omitted for now to simplify the explanation. 
         [0119]    It should be noted that the systems, methods, and software discussed above are intended merely to be exemplary in nature. It must be stressed that various embodiments may omit, substitute, or add various procedures or components as appropriate. For instance, it should be appreciated that in alternative embodiments, the methods may be performed in an order different than that described, and that various steps may be added, omitted or combined. Also, features described with respect to certain embodiments may be combined in various other embodiments. Different aspects and elements of the embodiments may be combined in a similar manner. Also, it should be emphasized that technology evolves and, thus, many of the elements are exemplary in nature and should not be interpreted to limit the scope of the invention. 
         [0120]    Specific details are given in the description to provide a thorough understanding of the embodiments. However, it will be understood by one of ordinary skill in the art that the embodiments may be practiced without these specific details. For example, well-known circuits, processes, algorithms, structures, and techniques have been shown without unnecessary detail in order to avoid obscuring the embodiments. 
         [0121]    Also, it is noted that the embodiments may be described as a process which is depicted as a flow chart, a structure diagram, or a block diagram. Although they may describe the operations as a sequential process, many of the operations can be performed in parallel or concurrently. In addition, the order of the operations may be re-arranged. A process is terminated when its operations are completed, but could have additional steps not included in the figure. 
         [0122]    Moreover, as disclosed herein, the terms “storage medium” or “storage device” may represent one or more devices for storing data, including read only memory (ROM), random access memory (RAM), magnetic RAM, core memory, magnetic disk storage mediums, optical storage mediums, flash memory devices or other computer readable mediums for storing information. The term “computer-readable medium” includes, but is not limited to, portable or fixed storage devices, optical storage devices, wireless channels, a sim card, other smart cards, and various other mediums capable of storing, containing or carrying instructions or data. 
         [0123]    Furthermore, embodiments may be implemented by hardware, software, firmware, middleware, microcode, hardware description languages, or any combination thereof. When implemented in software, firmware, middleware or microcode, the program code or code segments to perform the necessary tasks may be stored in a machine readable medium such as a storage medium. Processors may perform the necessary tasks. 
         [0124]    Having described several embodiments, it will be recognized by those of skill in the art that various modifications, alternative constructions, and equivalents may be used without departing from the spirit of the invention. For example, the above elements may merely be a component of a larger system, wherein other rules may take precedence over or otherwise modify the application of the invention. Also, a number of steps may be required before the above elements are considered. Accordingly, the above description should not be taken as limiting the scope of the invention, which is defined in the following claims.