Aerospace and Electronic Systems Magazine November 2017 - 23

L-band satellite channels, and VHF Digital Link Mode 2) have no
dedicated cybersecurity features [8].
The LDACS datalink will be the primary long-range terrestrial
datalink of the future IP-based aeronautical telecommunications
network; however, the LDACS specification [15] does not yet
cover cybersecurity.
The objective of this article is to discuss possible cybersecurity options for the LDACS datalink, adding layers of security to
the IP-based aeronautical telecommunications network. The article
focuses on the physical layer, the datalink layer, and the subnetwork layer, because these are the layers implemented in LDACS.
Network-layer security is addressed by the IP-based aeronautical
telecommunications network protocols, and application-layer security is taken into account by context management. Our discussion of LDACS cybersecurity is based on the major outcomes of a
threat analysis. We discuss possible options for implementing the
identified security functionalities in the LDACS system and indicate a way forward in the specification of LDACS. Due to the particular properties of the LDACS system (small bandwidth, narrow
frequency band, and small packet sizes), it is not feasible to adopt
existing security implementation solutions. For example, security
approaches of worldwide interoperability for microwave access
(WiMAX) standards (e.g., Institute of Electrical and Electronics
Engineers [IEEE] Standard 802.16 [16] or IEEE Standard 802.11
[17]), which provide the basis for AeroMACS security and security
approaches used in the field of vehicular ad hoc networks [18], are
not directly portable to LDACS. The security implementation options discussed in this article are therefore novel and specific to the
LDACS air traffic control datalink. However, we believe that once
the proper place for the implementation of security in the LDACS
protocol stack has been identified, well-established algorithms and
schemes (e.g., Diffie-Hellman key exchange [19]) should be utilized [20].

DEFINITIONS
In this article, we define the term "security data" as the metadata
required to achieve security goals (e.g., integrity and confidentiality) for data transmitted via the LDACS datalink. In the technical implementation, this may cover message authentication codes,
NOVEMBER 2017

digital signatures, cryptographic keys, initialization vectors, and
other cryptographic elements that have to be exchanged between
securely communicating parties.
The notions of confidentiality, integrity, and availability are defined according to [21], [22], and the notion of authenticity is defined according to [23]. Confidentiality is defined as the property
that information is not made available or disclosed to unauthorized
individuals, entities, or processes. Integrity is defined as the property that data have not been altered or destroyed. Availability is
defined as the assurance that information and communication services will be ready for use when expected. Authenticity is defined
as a property ensuring that the identity of a subject or resource is
the one claimed. "Message alteration" refers to unauthorized (accidental or intentional) modification of an authentic message [24].
"Robustness" refers to the ability of a system to function correctly
in stressful environmental conditions or in the presence of invalid
inputs [25].
The audit process gathers data about activity in the system and
analyzes it to discover security violations or diagnose their cause.
Analysis may occur offline after the fact or online in real time.
In the latter case, the process is usually called intrusion detection
[26].

LDACS SYSTEM ARCHITECTURE
In 2003, at the 11th International Civil Aviation Organization
(ICAO) Air Navigation Conference, it was agreed that the aeronautical air-ground communication infrastructure has to evolve
to provide the capacity and quality of service required to support
future air traffic management concepts. The U.S. Federal Aviation
Administration and EUROCONTROL, representing the regions
experiencing the most pressure to reform their existing air-ground
communication infrastructure, initiated the action plan 17 activity to jointly identify and assess candidate technologies for future
digital aeronautical communication systems. Action plan 17 came
to an end in late 2007, and the final report concluded that none of
the investigated technology proposals could be fully recommended
in isolation from the other candidates for all airspace domains [27].
However, action plan 17 activities identified several desirable features that the future system should fulfill. Based on these features,

IEEE A&E SYSTEMS MAGAZINE

Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine November 2017