Patent Description:
European patent application <CIT> is further prior art.

Implementations of the disclosure are directed to preventing unauthorized transmissions of an outdoor Internet Protocol (IP) Radio by an unauthorized user tapping the connection between an indoor unit and the outdoor IP Radio.

In one embodiment, a method comprises: initializing, over an interfacility link (IFL) connecting an indoor unit of a satellite terminal and an outdoor IP Radio of the satellite terminal, a communication link between the indoor unit and the outdoor IP Radio; authenticating, using the indoor unit and the outdoor IP Radio, the communication link between the indoor unit and the outdoor IP radio; and after authenticating the communication link, providing satellite network service to the indoor unit via the outdoor IP Radio.

In some implementations, authenticating the communication link, comprises: authenticating, using one or more security keys stored at the indoor unit and the outdoor IP Radio, the communication link between the indoor unit and the outdoor IP Radio. In some implementations, the one or more security keys are generated by a network management system (NMS) of a satellite communications network; and the method further comprises: after the one or more keys are generated by the NMS, receiving and storing, at the outdoor IP Radio and the indoor unit, the one or more security keys.

In some implementations, receiving, at the outdoor IP Radio and the indoor unit, the one or more security keys, comprises: receiving, at the outdoor IP Radio, a modulated and encoded signal transmitted over an outroute of the satellite communications network; demodulating and decoding the signal at the outdoor IP Radio to extract the one or more security keys; and transmitting, over the IFL, the one or more security keys from the outdoor IP Radio to the indoor unit.

In some implementations, storing, at the outdoor IP Radio and the indoor unit, the one or more security keys, comprises: storing, at the outdoor IP Radio and the indoor unit, the one or more security keys at the time that the satellite terminal is commissioned and installed.

In some implementations, authenticating the communication link, comprises: pinging, over the IFL, using the outdoor IP Radio, the indoor unit; in response to pinging the indoor unit, receiving, at the outdoor IP Radio, a response message from the indoor unit; and confirming, at the outdoor IP Radio, using at least the response message, that the indoor unit is authorized to receive the satellite network service via the outdoor IP Radio. In some implementations, confirming, at the outdoor IP Radio, using at least the response message, that the indoor unit is authorized to receive the satellite network service via the outdoor IP Radio, comprises: confirming, using at least the response message and one or more security keys stored at the outdoor IP Radio, that the indoor unit is authorized to receive the satellite network service via the outdoor IP Radio.

In some implementations, authenticating the communication link, comprises: authenticating the communication link during power up of the indoor unit and the outdoor IP Radio.

In some implementations, authenticating the communication link, comprises: periodically authenticating the communication link between the indoor unit and the outdoor IP Radio.

In some implementations, the IFL is a coaxial cable link.

In one embodiment, a satellite terminal comprises: an indoor unit; an outdoor IP Radio, one or more processors; and one or more non-transitory computer-readable mediums having executable instructions stored thereon that, when executed by the one or more processors, cause the satellite terminal to perform operations, comprising: initializing, over an IFL connecting the indoor unit and the outdoor IP Radio, a communication link between the indoor unit and the outdoor IP Radio; authenticating, using the indoor unit and the outdoor IP Radio, the communication link between the indoor unit and the outdoor IP radio; and after authenticating the communication link, providing satellite network service to the indoor unit via the outdoor IP Radio. In some implementations, the satellite terminal is a very small aperture terminal (VSAT).

In one embodiment, an outdoor IP Radio comprises: one or more processors; and one or more non-transitory computer-readable mediums having executable instructions stored thereon that, when executed by the one or more processors, cause the outdoor IP Radio to perform operations, comprising: initializing, over an interfacility link (IFL) connecting the outdoor IP Radio to an indoor unit of the satellite terminal, a communication link between the outdoor IP Radio and the indoor unit; authenticating the communication link between the indoor unit and the outdoor IP radio; and after authenticating the communication link, providing satellite network service to the indoor unit.

Other features and aspects of the disclosure will become apparent from the following detailed description, taken in conjunction with the accompanying drawings, which illustrate, by way of example, the features in accordance with various embodiments. The summary is not intended to limit the scope of the invention, which is defined solely by the claims attached hereto.

The technology disclosed herein, in accordance with one or more embodiments, is described in detail with reference to the following figures. The drawings are provided for purposes of illustration only and merely depict typical or example embodiments of the disclosed technology. These drawings are provided to facilitate the reader's understanding of the disclosed technology and shall not be considered limiting of the breadth, scope, or applicability thereof. It should be noted that for clarity and ease of illustration these drawings are not necessarily made to scale.

The figures are not intended to be exhaustive or to limit the invention to the precise form disclosed. It should be understood that the invention can be practiced with modification and alteration, and that the disclosed technology be limited only by the claims and the equivalents thereof.

In some satellite communication systems, a satellite terminal of a subscribing user includes a satellite indoor unit that communicates with an outdoor Internet Protocol (IP) Radio connected to a satellite antenna. The satellite indoor unit may provide WIFI network access to devices associated with the household of the user. The WIFI network may be secured via a WIFI network security key that prevents unauthorized devices from stealing network service from the subscriber by connecting to and communicating over the same indoor unit. The security key may reside locally to the indoor unit's main processor or a processor dedicated to processing Wi-Fi traffic.

While unauthorized usage of service is typically associated with an unauthorized device gaining access to the subscribing user's WIFI network to allow transmission and reception over the satellite communication link, unauthorized users may also gain access to the satellite communication link and steal satellite service by tapping the coaxial cable link between the user's indoor unit and the outdoor IP Radio coupled to the satellite dish. For example, an unauthorized user could potentially insert a switch between the coaxial cable link and directly wire their own unauthorized indoor unit to the switch. As another example, an unauthorized user could potentially insert a device between the coaxial cable link that broadcasts a new WIFI network that provides access to the subscribing user's satellite service. In these scenarios, the unauthorized user could potentially steal service with the paying customer not being able to use the IP Radio; or the unauthorized device could strategically switch connections between the authorized indoor unit and an unauthorized indoor unit such that the authorized user never detects that their service is being shared. As such, satellite terminal systems provided to subscribing users may not be designed to prevent or deter tapping a wired link between an authorized user's indoor equipment and outdoor equipment.

Implementations of the disclosure are directed to preventing unauthorized transmissions of an outdoor IP Radio by an unauthorized user tapping the connection between an indoor unit and the outdoor IP Radio. In accordance with implementations of the disclosure, the cable link (e.g., Multimedia over Coax Alliance (MoCA) cable link) between a subscribing user's indoor unit and the outdoor IP Radio may be secured during initialization of the communication link between the indoor and outdoor equipment. For example, one or more security keys may be exchanged by the indoor unit and the outdoor IP Radio to qualify authorized communications between the devices. In addition to preventing unauthorized transmissions of an outdoor IP radio, the techniques described herein may be implemented without degrading network performance during operation by securing the communication link between indoor equipment and outdoor equipment during startup communications.

<FIG> illustrates an example satellite network <NUM> comprising a satellite terminal <NUM> including an indoor unit <NUM> and outdoor IP Radio <NUM> with which the MoCA link security techniques described herein may be implemented. Satellite network <NUM> in this example includes a satellite <NUM>, Gateway Earth Station (GW) <NUM>, one or more IP gateways (IPGWs) <NUM>, and a satellite terminal <NUM>. GW <NUM> may be configured as a high capacity earth station with connectivity to ground telecommunications infrastructure. A network management system (NMS) <NUM> may be communicatively coupled to GW <NUM> over a network and direct its operation. NMS <NUM> may be located remotely from GW <NUM> or co-located with GW <NUM>. NMS <NUM> may manage satellite network and subscriber services.

GW <NUM> includes one or more radio frequency terminals (RFT) <NUM> that includes the physical equipment responsible for sending and receiving signals to and from satellite <NUM>, and may provide an interface for GW <NUM>. GW <NUM> may also include one or more inroute group managers (IGMs) <NUM> that function as bandwidth controllers running bandwidth allocation algorithms. The IGMs <NUM> may manage bandwidth of satellite terminal <NUM> and other terminals in the form of inroute groups (IGs), based in part on bandwidth demand requests from the remote terminals.

Although a single satellite <NUM> is shown in this example, it should be appreciated that satellite network <NUM> may be a multi-satellite network where a particular satellite services a satellite terminal <NUM> depending on the present location of the satellite terminal <NUM> and present location of the spotbeam of the satellite. Additionally, although a single GW <NUM> and satellite terminal <NUM> are depicted in this example, it should be appreciated that satellite network <NUM> may comprise multiple GWs and multiple satellite terminals.

Feeder links may carry data between RFT <NUM> and satellite <NUM>, and may include: forward uplink 23a for transmitting data from RFT <NUM> to satellite <NUM>; and return downlink 25a for transmitting data from satellite <NUM> to RFT <NUM>. User links may carry data between satellite <NUM> and satellite terminal <NUM>, and may include: return uplink 25b for transmitting data from satellite terminal <NUM> to satellite <NUM>; and forward downlinks 23b for transmitting data from satellite <NUM> to terminal <NUM>. Forward uplink 23a and forward downlink 23b may form an outroute, and return uplink 25b and return downlink 25a may form an inroute. Satellite <NUM> may transmit satellite signals corresponding to a user spot beam having a coverage area that may be in the geographic region in which terminal <NUM> and other satellite terminals are located and are able to connect to satellite <NUM>.

Satellite <NUM> may be any suitable communication satellite. For example, satellite <NUM> may be a bent-pipe design geostationary satellite, which can accommodate innovations and variations in transmission parameters, operating in the Ka-band, Ku-band or C-band. Satellite <NUM> may use one or more spot beams as well as frequency and polarization reuse to maximize the total capacity of satellite network <NUM>. Signals passing through satellite <NUM> in the forward direction may be based on the DVB-S2 standard (ETSI EN <NUM><NUM>) or DVB-S2X standard using signal constellations up to and including at least <NUM>-APSK. The signals intended to pass through satellite in the return direction from satellite terminals <NUM> may be based on the Internet Protocol over Satellite (IPoS) standard (ETSI TS <NUM><NUM>). Other suitable signal types may also be used in either direction, including, for example higher data rate variations of DVB-S2 or DVB-RCS.

IPGWs <NUM> may include the set of layer <NUM> and layer <NUM> packet processing equipment between GW <NUM> and the Internet. In some implementations, IPGW may be collocated with GW <NUM>. In other implementations, IPGWs <NUM> may be provisioned at another location. In some implementations, multiple IPGWs may be connected to GW <NUM>. IPGWs <NUM> may be an ingress portion of a local network. IP traffic, including TCP traffic originating from a host <NUM> from the internet, may enter GW <NUM> through IPGWs <NUM>.

Data from an Internet intended for a satellite terminal <NUM> may be in the form of IP packets, including TCP packets and UDP packets, or any other suitable IP packets, and may enter GW <NUM> at any one of IPGWs <NUM>. The IP packets may be processed and multiplexed by GW <NUM> along with IP packets from other IPGWs, where the IPGWs may or may not have the same service capabilities and relative priorities. The IP packets may be transmitted to satellite <NUM> on forward uplink 23a using the air interface provided by RFT <NUM>. Satellite <NUM> may them transmit the IP packet to the satellite terminal <NUM> using forward downlink 23b. Similarly, IP packets may enter the network via satellite terminal <NUM>, be processed by a satellite terminal <NUM>, and transmitted to satellite <NUM> on return uplink 25b. Satellite <NUM> may then send these inroute IP packets to GW <NUM> using return downlink 25a.

A satellite terminal <NUM> connects to the Internet or other network through satellite <NUM> and IPGWs <NUM>/GW <NUM>, and provides access to the Internet or other network to one or more user devices <NUM> that connect to satellite terminal <NUM>. Satellite terminal <NUM> includes an indoor unit <NUM> communicatively coupled to an IP Radio <NUM> via coaxial cable link <NUM>. The indoor unit <NUM> may function as an Internet modem. The modem may include an integrated router in some implementations. Communications over coaxial cable link <NUM> may be in accordance with the Multimedia over Coax Alliance (MoCA) protocol. The IP Radio may be a component of an outdoor unit of satellite terminal <NUM> that also includes an antenna <NUM> coupled to IP Radio <NUM>. Antenna <NUM> transmits signals to satellite <NUM> via uplink 25b and receives signals from satellite <NUM> via downlink 23b. Antenna <NUM> may be any suitable antenna design (e.g., small aperture parabolic antenna design) configured to transmit and receive electromagnetic signals to and from one or more satellites.

The satellite terminal <NUM> may be configured as a very-small-aperture terminal (VSAT). In some implementations, the satellite terminal <NUM> may be a satellite terminal of a subscriber's home or premise. In some implementations, the satellite terminal <NUM> may be implemented as a community WiFi terminal that may provide service to multiple households or to users visiting a community access site (e.g., a coffee shop).

Functions that may be performed by network equipment of satellite terminal <NUM> may include, for example, providing IP address and other assignments via the dynamic host configuration protocol (DHCP), and responding to requests for renewal and updates; responding to Address Resolution Protocol (ARP) requests for any IP address on the local subnet; carrying unicast IP (TCP and UDP) packets to the space link via cable <NUM>; carrying multicast UDP/IP packets to the space link if enabled; accepting IP packets directed to its local IP address (e.g., for WebUI); and other functions.

As depicted in the example of <FIG>, a rogue MoCA device <NUM> (e.g., switch) attempts to tap coaxial cable link <NUM> to provide satellite network service to an unauthorized indoor unit <NUM>. For example, the rogue MoCA device <NUM> may be physically connected outdoors in between the indoor unit <NUM> and IP radio <NUM>. The rogue MoCA device <NUM> may connect to the end of coaxial cable link <NUM> intended for IP Radio <NUM>, and provide a second coaxial cable link connection to IP Radio <NUM>. In this manner, the device <NUM> may attempt to switch connections between the authorized indoor unit <NUM> and unauthorized indoor unit <NUM> such that an authorized subscriber associated with satellite terminal <NUM> never detects that their service is being shared.

In accordance with implementations of the disclosure, further discussed below, communications between indoor unit <NUM> and IP Radio <NUM> over coaxial cable link <NUM> may be authenticated and secured when the connection is initialized (e.g., during installation of satellite terminal <NUM>). In this manner, even if rogue MoCA device taps the communication link <NUM>, the unauthorized indoor unit <NUM> is prevented from transmitting or receiving data over the satellite communication network via IP Radio <NUM> and antenna <NUM>.

<FIG> is a block diagram illustrating some components of indoor unit <NUM> and IP radio <NUM> of a satellite terminal <NUM>, in accordance with implementations of the disclosure. As depicted, indoor unit <NUM> may include a power input <NUM> to receive energy to power indoor unit <NUM> and outdoor IP Radio <NUM>, an Ethernet interface <NUM> including one or more Ethernet ports, wireless network interface <NUM>, a MoCA integrated circuit (IC) <NUM>, one or more processing devices <NUM>, and one or more computer-readable mediums (CRM) <NUM>.

In the illustrated example, indoor unit <NUM> functions as a router. It includes a wireless network interface <NUM> to broadcast a WIFI network that user devices <NUM> wirelessly connect to. The one or more user devices <NUM> may include any user device that is providing access to the Internet or other network via a satellite modem of terminal <NUM> (e.g., a satellite modem of IP Radio <NUM>). For example, the one or more user devices <NUM> may be a laptop, a desktop computer, a router, a tablet, a smartphone, a smart television, a smart home device, etc. A user device <NUM> may transmit packets to or receive packets from the modem. The user device <NUM> may wirelessly couple to the indoor unit <NUM> (e.g., over WIFI) or directly couple to the indoor unit <NUM> over an ethernet cable that couples to a port of Ethernet interface <NUM>. In alternative implementations, indoor unit <NUM> does not have an integrated router, and instead may operate as a switch that communicatively couples to a separate router that may provide WIFI access and/or ethernet ports.

The MoCA IC <NUM> enables communication over a coaxial cable <NUM> using the MoCA standard. The MoCA IC <NUM> may be implemented on a suitable chipset that supports coaxial cable transmissions to/from indoor unit <NUM> using the MoCA protocol. For example, the chipset may support MoCA <NUM>, MoCA <NUM>, MoCA <NUM>, MoCA <NUM>, etc. Example cable types that may be used with the IFL link <NUM> include RG-<NUM> dual shield, RG-<NUM> quad shield, and RG-<NUM>.

As depicted, IP Radio <NUM> may include one or more feedhorns <NUM>, upconverter <NUM>, and downconverter <NUM>, a MoCA IC <NUM>, one or more processing devices <NUM>, and one or more CRMs <NUM>.

The one or more feed horns <NUM> may be configured to convey uplink signal 25b and downlink signal 23b to upconverter <NUM> and downconverter <NUM>, respectively. In implementations where a single feed horn <NUM> conveys both uplink and downlink signals, IP radio <NUM> may also include an orthomode transducer (OMT) attached to the feed horn. In such implementations, the OMT may combine or separate the uplink signal and the downlink signal (e.g., by orthogonally polarizing the uplink signal and downlink signal such that the two signals are at <NUM>° to each other).

Upconverter <NUM> may be configured to upconvert and amplify signals received from the indoor unit <NUM> over coaxial cable <NUM>. The signal may be frequency upconverted such that it falls within one of the radio spectrum bands identified for satellite communication, such as the Ku band, Ka band, C band, or other suitable radio frequency band. The frequency upconverted (and amplified) signal may be sent via a feed horn <NUM> to the antenna <NUM>, which may focus the signal into a narrow beam for transmission to a satellite. In some implementations, the upconverter <NUM> may be a block upconverter (BUC).

Downconverter <NUM> may be configured to receive a downlink signal 23b relayed by antenna <NUM> through a feed horn <NUM>. The downconverter <NUM> may combine several different components, such as a low-noise amplifier, local oscillator, and frequency mixer, to convert the downlink signal into a range of intermediate frequencies (IF) for carrying to the received indoor unit <NUM> using coaxial cable <NUM>. In some implementations, the downconverter <NUM> may be a low noise block. In implementations, some or all of feedhorn(s) <NUM>, upconverter <NUM>, and downconverter <NUM>, may be mounted on antenna <NUM>.

The MoCA IC <NUM> enables communication over a coaxial cable <NUM> using the MoCA standard. The MoCA IC <NUM> may be implemented on a suitable chipset that supports coaxial cable transmissions to/from indoor IP Radio <NUM> using the MoCA protocol. For example, the chipset may support MoCA <NUM>, MoCA <NUM>, MoCA <NUM>, MoCA <NUM>, etc. In alternative implementations, indoor unit <NUM> and IP Radio <NUM> may each incorporate some other interfacility link (IFL) IC for enabling communication over a cable. For example, in alternative implementations an Ethernet cable or fiber optic cable may be used to couple the indoor unit <NUM> and IP Radio <NUM>.

As discussed above, conventional satellite terminals include no explicit authentication of service between the indoor unit <NUM> and IP Radio <NUM> when communicating over the coaxial cable <NUM>. As such, without any additional security measures, there exists a possibility that a bad actor could effectively "steal" or tap off service from a customer's IP Radio <NUM> with a compatible indoor MoCA bridge terminal (e.g., using device <NUM> and unauthorized indoor unit <NUM>) that connects to coaxial cable <NUM>.

To avoid this misuse, satellite terminal <NUM> may establish a secured connection between indoor unit <NUM> and IP Radio <NUM> by implementing a handshake authentication process between indoor unit <NUM> and IP Radio <NUM>, after both components are powered up. During this authentication process, processing devices <NUM>, <NUM> of indoor unit <NUM> and IP radio <NUM> may exchange one or more security key(s) <NUM> that may be stored in CRM(s) <NUM> and <NUM>, respectively. With an exclusive key exchange, an additional layer of confirmation of interoperability between distributed hardware terminals may be added. Following authentication, communications between indoor unit <NUM> and IP Radio <NUM> may be authorized. In this instance, by virtue of implementing authentication during startup communications (e.g., during device powerup, after the devices are connected via coaxial cable link <NUM>), it is expected that latency will only be added to startup communications and not impede subsequent traffic between the indoor unit <NUM> and IP Radio <NUM>. As such, the addition is not expected to limit overall link throughput rates once a "partner" has been verified.

In some implementations to further secure the connection between indoor unit <NUM> and IP Radio <NUM>, a trusted execution environment (TEE) may be configured at the indoor unit <NUM> and/or IP Radio <NUM> to store and maintain the security key(s) <NUM>. The TEE may be a secure area of processing device(s) <NUM> and/or <NUM>.

<FIG> is an operational flow diagram illustrating an example method <NUM> that may be implemented at satellite terminal <NUM> to secure a cable link between an outdoor unit <NUM> and IP Radio <NUM>, in accordance with implementations of the disclosure. In implementations, method <NUM> may be implemented by a processing device <NUM> of indoor unit <NUM> executing instructions stored in a CRM <NUM> of indoor unit <NUM>, and/or by a processing device <NUM> of IP Radio <NUM> executing instructions stored in a CRM <NUM> of IP Radio <NUM>. Prior to performing the operations of method <NUM>, the IP Radio may be activated by an NMS. For example, an IP Radio <NUM> may communicate with and be activated by NMS <NUM> over the satellite link.

Operation <NUM> includes: initializing, over an IFL cable connecting the indoor unit of the satellite terminal and the outdoor IP Radio of the satellite terminal, a communication link between the indoor unit and the outdoor IP Radio. The communication link may be initialized during power up of the devices. The IFL cable may be a coaxial cable, and the satellite terminal's indoor unit and the outdoor IP Radio may communicate over the coaxial cable in accordance with the MoCA standard.

Operation <NUM> includes: authenticating, using the indoor unit and the outdoor IP Radio, the communication link between the indoor unit and the outdoor IP radio.

In some implementations, the communication link is authenticated using one or more security keys or some other secure material made available to both devices. The one or more security keys may include a public key and a corresponding private key that may be used to authenticate the indoor unit to the IP Radio. Prior to authentication, the keys may have been exchanged between the devices to enable symmetric key encryption and secure communications. The one or more security keys may be stored at each device (e.g., keys <NUM> stored at CRM <NUM> and CRM <NUM>).

The processing devices of the indoor unit and IP Radio (e.g., processing devices <NUM>, <NUM>) may communicate with the security keys at power up to establish authentication. In some implementations, the IP Radio may ping the indoor unit for a security key match and receive a message from the indoor unit to confirm if there is a match. For example, the message may be encrypted using one of the security keys, and decrypted using another one of the keys. If there is a match, the IP Radio may transmit an acknowledgement message and communication between the devices may continue. Otherwise, the IP Radio may ignore transmissions from the indoor unit and/or not respond with an acknowledgement. As such, even if a rogue indoor unit successfully taps the cable link between the indoor unit and outdoor IP Radio, it may not gain access to the satellite network via the IP Radio.

To avoid network interruptions or degradation (e.g., latency), the authentication need not be validated on a burst to burst basis. In some implementations, authentication occurs only during power up of the indoor unit and IP Radio, and/or after a sustained interruption of the connection (e.g., coaxial cable link) between the devices. In some implementations, for increased security, periodic authentication may be done (e.g., every hour, day, or week). The periodic authentication may be scheduled during times least likely to disrupt service for the subscribing user.

Prior to authentication, the one or more security keys may be generated by an NMS (e.g., NMS <NUM>). In some implementations the one or more security keys generated by the NMS are transmitted to the IP radio over a satellite outroute. The IP Radio may then provide the one or more security keys to the indoor unit. For example, satellite antenna <NUM> may receive, over downlink 23b, a modulated signal encoded with the one or more security keys. In other implementations, the one or more security keys may be loaded by an installer of the satellite terminal <NUM> after they are generated by the NMS <NUM>. The NMS may itself maintain a record (e.g., database or other data structure) of all keys and their associated satellite terminals.

In some implementations, to ensure the security keys are not obtained by a rogue device or user, the security keys are assigned to and stored at the indoor unit and IP Radio only at the time of commissioning and installing the satellite terminal, e.g., when the indoor unit and IP Radio are "married" or linked together. If the indoor unit or IP Radio are swapped out as part of a maintenance or upgrade event, the NMS may again provide a new set of unique keys that are stored and used by the new indoor unit and/or new IP Radio.

Operation <NUM> includes: after authenticating the communication link, providing satellite network service to the indoor unit via the outdoor IP Radio.

<FIG> illustrates a computer system/communication device <NUM> upon which example embodiments according to the present disclosure can be implemented. Computer system <NUM> can include a bus <NUM> or other communication mechanism for communicating information, and a processor <NUM> coupled to bus <NUM> for processing information. Computer system <NUM> may also include main memory <NUM>, such as a random access memory (RAM) or other dynamic storage device, coupled to bus <NUM> for storing information and instructions to be executed by processor <NUM>. Main memory <NUM> can also be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor <NUM>. Computer system <NUM> may further include a read only memory (ROM) <NUM> or other static storage device coupled to bus <NUM> for storing static information and instructions for processor <NUM>. A storage device <NUM>, such as a magnetic disk or optical disk, may additionally be coupled to bus <NUM> for storing information and instructions.

According to one embodiment of the disclosure, satellite terminal cable link security between an indoor unit and an outdoor IP Radio may be provided by computer system <NUM> in response to processor <NUM> executing an arrangement of instructions contained in main memory <NUM>. Such instructions can be read into main memory <NUM> from another computer-readable medium, such as storage device <NUM>. Execution of the arrangement of instructions contained in main memory <NUM> causes processor <NUM> to perform one or more processes described herein. One or more processors in a multi-processing arrangement may also be employed to execute the instructions contained in main memory <NUM>. In alternative embodiments, hard-wired circuitry is used in place of or in combination with software instructions to implement various embodiments. Thus, embodiments described in the present disclosure are not limited to any specific combination of hardware circuitry and software.

Computer system <NUM> may also include a communication interface <NUM> coupled to bus <NUM>. Communication interface <NUM> can provide a two-way data communication coupling to a network link <NUM> connected to a local network <NUM>. Wired and/or wireless links may be implemented. In any such implementation, communication interface <NUM> sends and receives electrical, electromagnetic, or optical signals that carry digital data streams representing various types of information.

Network link <NUM> may provide data communication through one or more networks to other data devices. By way of example, network link <NUM> can provide a connection through local area network <NUM> to network devices, for example including a host computer (PC) <NUM>, a smartphone <NUM>, and the like. Local area network <NUM> may both use electrical, electromagnetic, or optical signals to convey information and instructions. The signals through the various networks and the signals on network link <NUM> and through communication interface <NUM>, which communicate digital data with computer system <NUM>, are example forms of carrier waves bearing the information and instructions.

Computer system <NUM> may send messages and receive data, including program code, through the network(s), network link <NUM>, and communication interface <NUM>. In the Internet example, a server (not shown) might transmit requested code belonging to an application program for implementing an embodiment of the present disclosure through local network <NUM> and communication interface <NUM>. Processor <NUM> executes the transmitted code while being received and/or store the code in storage device <NUM>, or other non-volatile storage for later execution. In this manner, computer system <NUM> obtains application code in the form of a carrier wave.

Computer system <NUM> includes equipment for communication with an external communications network. In particular, the computer system <NUM> may include a transmit-side physical-layer device (TX PHY) <NUM>, a receive-side physical-layer device (RX PHY) <NUM>, a transmit-side media access controller (TX MAC) <NUM>, and a receive-side media access controller (RX MAC) <NUM>. Transmit packets may be provided to the TX MAC <NUM> and TX PHY <NUM>, which provide corresponding signals to the external communications network <NUM>. For example, in a satellite communications network, TX MAC may be a TX satellite link controller (SLC), and TX PHY <NUM> may provide corresponding signals to a satellite using a terrestrial antenna/dish. Signals received from an external communications network <NUM> may be received via RX PHY <NUM> and RX MAC <NUM>, from which receive packets may be obtained.

<FIG> illustrates a chip set <NUM> in which embodiments of the disclosure may be implemented. Chip set <NUM> can include, for instance, processor and memory components described with respect to <FIG> or <FIG> incorporated in one or more physical packages. By way of example, a physical package includes an arrangement of one or more materials, components, and/or wires on a structural assembly (e.g., a baseboard) to provide one or more characteristics such as physical strength, conservation of size, and/or limitation of electrical interaction.

In one embodiment, chip set <NUM> includes a communication mechanism such as a bus <NUM> for passing information among the components of the chip set <NUM>. A processor <NUM> has connectivity to bus <NUM> to execute instructions and process information stored in a memory <NUM>. Processor <NUM> includes one or more processing cores with each core configured to perform independently. Alternatively or in addition, processor <NUM> includes one or more microprocessors configured in tandem via bus <NUM> to enable independent execution of instructions, pipelining, and multithreading. Processor <NUM> may also be accompanied with one or more specialized components to perform certain processing functions and tasks such as one or more digital signal processors (DSP) <NUM>, and/or one or more application-specific integrated circuits (ASIC) <NUM>. DSP <NUM> can typically be configured to process real-world signals (e.g., sound) in real time independently of processor <NUM>. Similarly, ASIC <NUM> can be configured to performed specialized functions not easily performed by a general purposed processor.

Processor <NUM> and accompanying components have connectivity to the memory <NUM> via bus <NUM>. Memory <NUM> includes both dynamic memory (e.g., RAM) and static memory (e.g., ROM) for storing executable instructions that, when executed by processor <NUM>, DSP <NUM>, and/or ASIC <NUM>, perform the process of example embodiments as described herein. Memory <NUM> also stores the data associated with or generated by the execution of the process.

In this document, the terms "machine readable medium," "computer readable medium," and similar terms are used to generally refer to non-transitory mediums, volatile or non-volatile, that store data and/or instructions that cause a machine to operate in a specific fashion. Common forms of machine readable media include, for example, a hard disk, solid state drive, magnetic tape, or any other magnetic data storage medium, an optical disc or any other optical data storage medium, any physical medium with patterns of holes, a RAM, a PROM, EPROM, a FLASH-EPROM, NVRAM, any other memory chip or cartridge, and networked versions of the same.

These and other various forms of computer readable media may be involved in carrying one or more sequences of one or more instructions to a processing device for execution. Such instructions embodied on the medium, are generally referred to as "instructions" or "code. " Instructions may be grouped in the form of computer programs or other groupings. When executed, such instructions may enable a processing device to perform features or functions of the present application as discussed herein.

In this document, a "processing device" may be implemented as a single processor that performs processing operations or a combination of specialized and/or general-purpose processors that perform processing operations. A processing device may include a CPU, GPU, APU, DSP, FPGA, ASIC, SOC, and/or other processing circuitry.

The various embodiments set forth herein are described in terms of exemplary block diagrams, flow charts and other illustrations. As will become apparent to one of ordinary skill in the art after reading this document, the illustrated embodiments and their various alternatives can be implemented without confinement to the illustrated examples. For example, block diagrams and their accompanying description should not be construed as mandating a particular architecture or configuration.

Each of the processes, methods, and algorithms described in the preceding sections may be embodied in, and fully or partially automated by, code components executed by one or more computer systems or computer processors comprising computer hardware. The processes and algorithms may be implemented partially or wholly in application-specific circuitry. The various features and processes described above may be used independently of one another, or may be combined in various ways. Different combinations and subcombinations are intended to fall within the scope of this disclosure, and certain method or process blocks may be omitted in some implementations. Additionally, unless the context dictates otherwise, the methods and processes described herein are also not limited to any particular sequence, and the blocks or states relating thereto can be performed in other sequences that are appropriate, or may be performed in parallel, or in some other manner. Blocks or states may be added to or removed from the disclosed example embodiments. The performance of certain of the operations or processes may be distributed among computer systems or computers processors, not only residing within a single machine, but deployed across a number of machines.

As used herein, the term "or" may be construed in either an inclusive or exclusive sense. Moreover, the description of resources, operations, or structures in the singular shall not be read to exclude the plural. Conditional language, such as, among others, "can," "could," "might," or "may," unless specifically stated otherwise, or otherwise understood within the context as used, is generally intended to convey that certain embodiments include, while other embodiments do not include, certain features, elements and/or steps.

Claim 1:
A method, comprising:
initializing, over an interfacility link (IFL) connecting an indoor unit of a satellite terminal and an outdoor Internet Protocol (IP) Radio of the satellite terminal, a communication link between the indoor unit and the outdoor IP Radio;
authenticating, using the indoor unit and the outdoor IP Radio, the communication link between the indoor unit and the outdoor IP radio; and
after authenticating the communication link, providing satellite network service to the indoor unit via the outdoor IP Radio.