System and method for providing satellite GTP acceleration for secure cellular backhaul over satellite

1. A method comprising:

receiving a request from a first entity to establish a security association with a second entity, the request being received by a satellite terminal of a satellite communication system, the first entity and the second entity being part of a different communication system;

establishing a first secure tunnel between the satellite terminal and a gateway of the satellite communication system;

establishing a second secure tunnel between the gateway and the second entity based, at least in part, on a certificate belonging to the first entity;

establishing a third secure tunnel between the satellite terminal and the first entity based, at least in part, on a certificate belonging to the second entity, a first entity public key, and a satellite terminal public key;

examining contents of encrypted traffic between the first entity and the second entity; and

applying GTP acceleration to eligible traffic transmitted over the first secure tunnel,

wherein an end to end IPsec tunnel is established between the first entity and the second entity.

2. The method of claim 1 , wherein the first secure tunnel implements AES-256 link layer encryption between the satellite terminal and the gateway.

3. The method of claim 2 , wherein establishing a first secure tunnel comprises establishing an IPsec tunnel between the satellite terminal and the gateway.

4. The method of claim 2 , wherein the GTP acceleration includes at least one of GTP tunnel header reduction, TCP acceleration, data compression, and QoS-based traffic prioritization.

5. The method of claim 1 , wherein establishing a second secure tunnel comprises:

establishing a security association between the gateway and the second entity based on a gateway public key and a second entity public key; and

authenticating the security association based, at least in part, on the first entity certificate.

6. The method of claim 5 , wherein establishing a security association comprises:

replacing a public key contained in the request from the first entity with a public key belonging to the gateway;

transmitting the request to the second entity;

receiving a response from the second entity containing, in part, a public key belonging to the second entity; and

generating a shared key between the gateway and the second entity based on the gateway public key and the second entity public key.

7. The method of claim 5 , wherein authenticating the security association comprises:

encrypting an authentication request received from the first entity, using a shared key between the gateway and the second entity;

transmitting the authentication request to the second entity, the authentication request including a first entity certificate;

receiving an authentication response containing, in part, a second entity certificate; and

forwarding the authentication response to the first entity.

8. The method of claim 1 , wherein establishing a third secure tunnel comprises:

establishing a security association between the first entity and the satellite terminal; and

authenticating the security association based, at least in part, on the second entity certificate.

9. The method of claim 8 , wherein establishing a security association comprises:

retrieving a public key belonging to the first entity from the request;

replacing a public key contained in a response from the second entity with a public key belonging to the satellite terminal;

transmitting the response to the first entity; and

generating a shared key between the first entity and the satellite terminal based on the first entity public key and the satellite terminal public key.

10. The method of claim 8 , wherein authenticating the security association comprises:

receiving an authentication request containing, in part, a first entity certificate;

forwarding the authentication request to the second entity;

encrypting an authentication response received from the second entity, using a shared key between the first entity and the satellite terminal; and

transmitting the authentication response to the first entity, the authentication response including a second entity certificate.

11. A system comprising:

a gateway including one or more processors, one or more transceivers, and one or more communication interfaces;

a satellite terminal including at least one processor, at least one transceiver, and at least one communication interface; and

a satellite for facilitating communication between the gateway and the satellite terminal,

the satellite terminal being configured to:

receive a request from a first entity to establish a security association with a second entity,

establish a first secure tunnel with the gateway,

establish a third secure tunnel with the first entity based, at least in part, on a certificate belonging to the second entity, a first entity public key, and a satellite terminal public key,

examine contents of encrypted traffic from the first entity, and

apply GTP acceleration to eligible traffic transmitted over the first secure tunnel,

the gateway being configured to:

establish a second secure tunnel with the second entity based, at least in part, on a certificate belonging to the first entity,

examine contents of encrypted traffic from the second entity, and

apply GTP acceleration to eligible traffic transmitted over the first secure tunnel,

wherein the first entity and the second entity are part of a different communication system, and

wherein an end to end IPsec tunnel is established between the first entity and the second entity.

12. The system of claim 11 , wherein the satellite terminal is further configured to establish the first secure tunnel using AES-256 link layer encryption.

13. The system of claim 11 , wherein the first secure tunnel comprises an IPsec tunnel between the satellite terminal and the gateway.

14. The system of claim 11 , wherein the GTP acceleration includes at least one of GTP tunnel header reduction, TCP acceleration, data compression, and QoS-based traffic prioritization.

15. The system of claim 11 , wherein the gateway is further configured to establish the second secure tunnel by:

establishing a security association with the second entity based on a gateway public key and a second entity public key; and

facilitate authentication of the security association based, at least in part, on the first entity certificate.

16. The system of claim 15 , wherein the gateway is configured to establish a security association by:

replacing a public key contained in the request from the first entity with a public key belonging to the gateway;

transmitting the request to the second entity;

receiving a response from the second entity containing, in part, a public key belonging to the second entity; and

generating a shared key between the gateway and the second entity based on the gateway public key and the second entity public key.

17. The system of claim 15 , wherein the gateway is configured to authenticate the security association by:

encrypting an authentication request received from the first entity, using a shared key between the gateway and the second entity;

transmitting the authentication request to the second entity, the authentication request including a first entity certificate;

receiving an authentication response containing, in part, a second entity certificate; and

forwarding the authentication response to the first entity.

18. The system of claim 11 , wherein the satellite terminal is further configured to establish a third secure tunnel by:

establishing a security association between the first entity and the satellite terminal; and

facilitate authentication of the security association based, at least in part, on the second entity certificate.

19. The system of claim 18 , wherein the satellite terminal is configured to establishing a security association by:

retrieving a public key belonging to the first entity from the request;

replacing a public key contained in a response from the second entity with a public key belonging to the satellite terminal;

transmitting the response to the first entity; and

generating a shared key between the first entity and the satellite terminal based on the first entity public key and the satellite terminal public key.

20. The system of claim 18 , wherein the satellite terminal is configured to facilitate authentication of the security association by:

receiving an authentication request containing, in part, a first entity certificate;

forwarding the authentication request to the second entity;

encrypting an authentication response received from the second entity, using a shared key between the first entity and the satellite terminal; and

transmitting the authentication response to the first entity, the authentication response including a second entity certificate.