Communication apparatus, comprising: a transmission station which comprises: a processor running software which generates commands in a predetermined command format, responsive to input from a user; hardware encoding logic configured to receive commands in the predetermined command format from the software running on the processor, to convert the received commands into a predefined converted data format of permitted commands including only a limited subset of the commands in the predetermined command format; and a communications processor configured to transmit the converted commands over a communications network; and an uplink controller, comprising: a first hardware interface configured to receive commands from the transmission station over the communications network; a second hardware interface configured to convey the received commands to a protected destination; and hardware logic, which is coupled between the first and second interfaces so as to receive commands from the first interface, to compare the received commands to a set of hardware masks corresponding to permitted commands to check the commands are in the predefined data format, and to pass to the second interface only received commands that match one of the masks. a transmission station which comprises: a processor running software which generates commands in a predetermined command format, responsive to input from a user; hardware encoding logic configured to receive commands in the predetermined command format from the software running on the processor, to convert the received commands into a predefined converted data format of permitted commands including only a limited subset of the commands in the predetermined command format; and a communications processor configured to transmit the converted commands over a communications network; and a processor running software which generates commands in a predetermined command format, responsive to input from a user; hardware encoding logic configured to receive commands in the predetermined command format from the software running on the processor, to convert the received commands into a predefined converted data format of permitted commands including only a limited subset of the commands in the predetermined command format; and a communications processor configured to transmit the converted commands over a communications network; and an uplink controller, comprising: a first hardware interface configured to receive commands from the transmission station over the communications network; a second hardware interface configured to convey the received commands to a protected destination; and hardware logic, which is coupled between the first and second interfaces so as to receive commands from the first interface, to compare the received commands to a set of hardware masks corresponding to permitted commands to check the commands are in the predefined data format, and to pass to the second interface only received commands that match one of the masks. a first hardware interface configured to receive commands from the transmission station over the communications network; a second hardware interface configured to convey the received commands to a protected destination; and hardware logic, which is coupled between the first and second interfaces so as to receive commands from the first interface, to compare the received commands to a set of hardware masks corresponding to permitted commands to check the commands are in the predefined data format, and to pass to the second interface only received commands that match one of the masks.