Aerospace and Electronic Systems Magazine November 2017 - 18

Provisioning for a Distributed ATM Security Management: The GAMMA Approach
5. The system shall correlate these individual indicators and send
an alert to the SMP.
In the design of the SACom prototype, points 1 and 2 above are
addressed by the means of voice pattern analysis methods developed
in GAMMA and reported in [27]. For speaker verification purposes,
all persons who shall be recognized as authorized persons must be
introduced to the application with a so-called voice enrollment.
Points 3 and 4 are resolved by the means of conformance monitoring methods as described in [28]. Originally, these algorithms
were designed to detect safety problems (navigation failures, noncompliance due to human errors, etc.) and were not used in the
frame of ATM security before. However, the functions described in
points 3 and 4 also require information about the given ATC clearance in real time. To gather this information, a speech recognition
technology, which was developed in another project and described
in [29], has been modified, adapted, and applied here.
Point 5 is addressed by calculating an overall threat indicator
score within a certain time frame considering the single indicators
from the detection modules of the prototype together with weighting factors, defined alert thresholds, and module reliability. One
hypothesis is that single indicators do not distinguish between a
safety and a security problem, but multiple indicators at the same
time may indicate a security issue.
Firstly, SACom shall act as a threat detector to immediately
and automatically send alerts to the SMP. With this automation,
the person responsible for security-related decision-making or the
security manager gets the information in real time. Currently, the
reporting process mostly relies on face-to-face or phone conversation, which takes some time until the information is passed through
and, due to the large number of chained links, there is a risk of
information loss.
Secondly, in order to enable the persons in charge of handling
the security threat tactically, it was also decided to investigate the
benefit of direct presentation of the system output on suitable human machine interfaces (HMIs) in the cockpit or in the controller
working position (CWP).

SECURE GNSS COMMUNICATION
The main weakness of GNSS is its susceptibility to sources of interference, which can be either intentional or unintentional. The
relevant threat scenarios identified in GAMMA are as follows:
C

GNSS jamming:
jamming with low power mobile jammer (e.g. a roadside
vehicle fitted with a personal device driving around an
airport);
jamming with high power fixed jammer (e.g. a stationary
high power jammer aimed at an airport).

GNSS spoofing: spoofing of GNSS signal by broadcasting
false signals with the intent that the receiver misinterpret
them as authentic signals.

A GNSS monitoring system (GMS) is designed to detect, locate, and report sources of jamming and spoofing signals. GNSS
18

alerts are provided to the SMP to support the overall security threat
evaluation. The secure GNSS communication prototype is composed of:
C

GNSS sensors, which are located around the airport. Their
role is to collect the GNSS signal and reception conditions
and to forward the information to the GMS server. For the
GAMMA project, GNSS sensors are simulated with a GNSS
environment simulator;
The GMS secured server elaborates on sensor data, stores information, and forwards them to SMP as GNSS alerts. SMP
then forwards the alerts to the relevant authorities such as ATC.

The GMS alerts are made available via a graphical interface.
Alerts messages are composed of the event start time and duration,
interference classification (jamming or spoofing), and the jammer
location.

INTEGRATED MODULAR COMMUNICATIONS
The IMC is viewed as an integrated standalone on-board processing platform offering multiradio off-board communication to/from
different stakeholders/providers and on-board network connectivity for cockpit and passenger applications [15]. The IMC consists
of the following main subsystems:
C

Router Subsystem (RoS) - Responsible for routing traffic
between on-board applications and IMC processors;
Radio Subsystem (RaS) - Responsible for converting application data into a link level format, and routing this to
one or more transceivers; It comprises a number of software
defined radios and includes a number of radio baseband processors together with associated RF transceiver hardware
which perform the necessary signal processing needed for
the supported bearers;
Control & Management Subsystem (CMS) - Responsible
for managing the overall network and security functions,
and configuring and monitoring of the IMC.

These subsystems are connected via communication buses.
The communication buses provide the IP base-band packet interconnect between the IMC subsystems, and between the RoS
and the aircraft networks. The IMC off-board communication is
via radio links to ground stations. Aircraft on-board applications
(i.e., safety critical, cockpit, and cabin applications) connect to the
IMC via a packet bus. On-board applications utilizing off-board
communications services are connected to IMC via the aircraft
networks. The aircraft networks support applications of differing
safety criticality levels. From the risk assessment analysis, five
categories of threats have been identified for IMC: on-board application attack, off-board application attack, subverted software
or hardware, abuse of management interface, and jamming of data
links. These threats can be mitigated using the existing mechanisms to be considered as built-in security controls/enablers for
IMC, to satisfy the stated C, I, and A security requirements. The
GAMMA Deliverable D4.3 [17] provides more details of func-

IEEE A&E SYSTEMS MAGAZINE

NOVEMBER 2017

Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine November 2017