System for dynamically establishing one or more encrypted tunnels for the transmission of data between a set of on-board equipment comprising one or more terminals, a SIP server, Session Initiation Protocol,, and an onboard router and a second ground assembly comprising a ground router and terminals adapted to communicate by constrained band networks of the satellite link type, said network using a real time communication protocol, said system comprising at least the following: • said one or more terminals on board being configured to transmit a data stream to be routed to another recipient via a satellite S, to said SIP server, • said SIP server being configured to modify an identifier of the port of the real-time protocol on said stream to be encrypted and to transmit it to the router, said onboard router comprising a first encryption module and rules ensuring a path for an identified data flow, • the first onboard encryption module being configured to read the identifier of the real-time protocol port present in a data frame to be encrypted, and if said identifier corresponds to a given value contained in a configuration file, to encrypt the data flow with a key corresponding to the identified port, • said first encryption module being configured to add an identification data field of the encrypted data stream to the encrypted data frame, • the onboard router being configured to apply streaming channel assignment rules to transmit the encrypted data stream(s) to a Satcom modem comprising a module allowing the opening of a number of encrypted tunnels equal to the number of communications or by type of traffic, • the Satcom modem being configured to transmit the different encrypted data streams via the different encrypted channels to the communication satellite S, • a reception station linked to the satellite is configured to distribute the encrypted data streams received from the satellite to the ground routing module comprising an encryption-decryption module, • said encryption-decryption module comprising a table of correspondence between the value contained in the field identifying an encrypted data stream and a port number of the real-time communications protocol and the correspondence between a decryption key to be used and the value of the port identified, said encryption-decryption module being configured to decrypt the data streams and transmit the decrypted data to a set of destination terminals. • said one or more terminals on board being configured to transmit a data stream to be routed to another recipient via a satellite S, to said SIP server, • said SIP server being configured to modify an identifier of the port of the real-time protocol on said stream to be encrypted and to transmit it to the router, said onboard router comprising a first encryption module and rules ensuring a path for an identified data flow, • the first onboard encryption module being configured to read the identifier of the real-time protocol port present in a data frame to be encrypted, and if said identifier corresponds to a given value contained in a configuration file, to encrypt the data flow with a key corresponding to the identified port, • said first encryption module being configured to add an identification data field of the encrypted data stream to the encrypted data frame, • the onboard router being configured to apply streaming channel assignment rules to transmit the encrypted data stream(s) to a Satcom modem comprising a module allowing the opening of a number of encrypted tunnels equal to the number of communications or by type of traffic, • the Satcom modem being configured to transmit the different encrypted data streams via the different encrypted channels to the communication satellite S, • a reception station linked to the satellite is configured to distribute the encrypted data streams received from the satellite to the ground routing module comprising an encryption-decryption module, • said encryption-decryption module comprising a table of correspondence between the value contained in the field identifying an encrypted data stream and a port number of the real-time communications protocol and the correspondence between a decryption key to be used and the value of the port identified, said encryption-decryption module being configured to decrypt the data streams and transmit the decrypted data to a set of destination terminals.