## 2 System Model  
FSO is known for its narrow optical beam which offers immunity against security attacks. However, the beam spreads out with propagation distance, \(z\), as follows [13; 14]:  
\[\omega(z)=\omega_{\circ}\sqrt{1+\left(\frac{\lambda z}{\pi\omega_{\circ}^{2}} \right)^{2}} \tag{1}\]  
where \(\omega_{\circ}\) and \(\lambda\) are the beam waist and wavelength, respectively, of the laser at the transmitter. Figure 1 shows (a) schematic and (b) geometry of a security attack scenario on a non-terrestrial FSO link between a satellite and ground station as the transmitter ([PERSON]) and receiver ([PERSON]), respectively. The attacker ([PERSON]) is a UAV that interrupted the optical beam. The work in [15] showed that an FSO beam has a spread diameter \(d\approx D\theta+R\) of 50 cm for a divergence angle of \(\theta\) = 0.1 mrad and link length of \(D=5\) km, where \(R\) is the beam diameter at the transmitter. In satellite FSO communications, when the link length ranges from 500 km for low earth orbit satellites, to 500 million km for deep space optical links, the beam radius expands between 6.63 m to 2.19 \(\times\) 10\({}^{5}\) m ([16], p. 164). This beam diameter expansion is 1000 times less than RF-based satellite communications beam [17; 18] and it can be controlled using optics [19; 20]. However, very narrow beam divergence is not desirable because it causes mis-alignment errors due to satellite vibration or platform jitter [17]. With the advances in UAV technologies, a flying attacker of 10 cm receiver aperture can interrupt the broad optical beam and align to the transmitter which exposes the FSO link to security threats [21], as illustrated in Figure 1b. In the terrestrial FSO case, Eve was assumed to be a sufficiently sensitive device that can collect a fraction of leak power \(<\) 10\({}^{-2}\), otherwise, it causes a power reduction that notifies the legitimate peers [PERSON] and [PERSON] [5]. The study in [5] also showed that relying on the physical layer security of the FSO is not sufficient when a fraction of leak power \(>\) 10\({}^{-2}\). Hence, an upper-layer data encryption technique is required. In this study, we propose using a presentation layer data encryption technology to secure the transmission of non-terrestrial FSO communication links. Figure 2 illustrates a block diagram of the secure FSO system under investigation. The system is made in a simulation using the GNU Radio platform and as a prototype using an SDR transceiver and optical hardware. GNU Radio provides the user interface and handles the data processing for the transmitter and receiver in the background. The transmitter end allows a user to enter data to be encoded, encrypted, modulated, and shape burst. At the receiver end, the incoming data will be filtered, demodulated, decrypted, and decoded. Figure 1: Security attack on satellite to ground-station FSO link by a UAV that interrupts the optical beam: (**a**) schematic (not to scale) and (**b**) geometry of the link. The GNU-Radio module, responsible for implementing the encryption techniques, is an out-of-tree module called gr-nacl, developed by [PERSON] et al. [22]. This module uses a well-known library called NaCl that provides functions for high-speed network communication, encryption, and signatures [7,22]. This encryption technique has continuously proven to be secure despite advancements in modern computational power. The most efficient attack on the encryption algorithm (Xsalsa20), which is used in NaCl to generate encryption keys, showed that this technique only breaks 8 of 20 rounds of encryption with time complexity of \(2^{250}\)[23]. This provides sufficient data security against power-limited eavesdroppers [24]. The NaCl library was implemented into this GNU Radio module using another library called libsodium [25]. It aims to wrap all the complex NaCl functions into simple high-speed calling functions. Finally, gr-nacl puts these functions into GNU Radio blocks that can be integrated with the rest of the workspace.