Aerospace and Electronic Systems Magazine November 2017 - 28

Datalink Security in LDACS for Air Traffic Management
has been received. This would prevent
the use of both control slots of the same
multiframe (spaced 30 ms apart on average; cf. Figure 4) and increase the protocol latency tremendously (leaving out
the control slots of the same multiframe,
the control slot spacing would effectively increase to 90 ms on average; cf.
Figure 5).
Securing multiframes in their entirety also introduces fate sharing between user data packets transmitted in
the same multiframe. Error detection
and correction (other than the forward
error correction done in the physical
layer) is performed in the DLS operating
on top of the medium access layer. Any
bit error in the multiframe will therefore
cause the security verification to fail for Figure 5.
all packets conveyed in the multiframe. Data packets are transmitted bundled in a resource allocation (black rectangle). The resource allocation is
At a worst-case residual bit error rate7 of announced in a table transmitted in the common control (CC) slot. On the forward link (FL), the resource
allocation is scheduled locally within the ground station. On the reverse link, aircraft have to request re10−5 and multiframe sizes greater than
source allocations in the dedicated control (DC) slot before they can be scheduled by the ground station.
19,656 bits, this would lead to prohibitive multiframe error rates.
In addition, multiframe-based security limits the applicable
s/2,184. Slot-based security would allow using both control slots
trust relationships between a ground station and all participating
of the same multiframe. However, security verification results are
aircraft. In the forward link, the ground station addresses multiple
only available after each slot has been received completely. With
aircraft in a timed order, one after another. If a whole multiframe
an average medium access delay of 30 ms on the forward link and
was protected as one unit, every involved aircraft had to be able to
data slots ending every 58.32 ms, this delay is problematic for digicalculate the integrity verification or the decryption. As a consetal voice transmissions requiring low latency.8
quence, the utilized cryptographic key material has to be known to
Slot-based security suffers also from the fate-sharing problem.
multiple aircraft at the same time, which is problematic for symAny bit error in the slot would cause the security verification of all
metric keys. While this is not necessarily a problem for the integuser data packets transmitted in this slot to fail.
rity of user data, it is not possible to transmit confidential user data
Finally, slot-based security would limit the trust relationship
that is only readable by a single aircraft. In the reverse link, it is not
between a ground station and all aircraft in a way similar to that of
possible to protect complete multiframes, because multiple aircraft
multiframe-based security. Securing the forward link slots might
contribute data to the multiframe and none of them can protect data
be possible, but protecting the reverse link slots as a unit is not
on behalf of other aircraft.
possible for the same reasons as above.

Slot Level

Resource Allocation Level

Each forward link and reverse link multiframe is divided into two
slots: one slot for management and control data (the common control slot on the forward link and dedicated control slot on the reverse
link as described in Figure 4) and one slot for the transmission of
user data. In addition to these slots, a random access slot and broadcast control slot are inserted every 240 ms for the purpose of cell
entries of new aircraft and related management information.
Introducing security at the slot level would require covering
complete slots with security data. Because there are two slots per
multiframes, this would increase the security overhead vs. the
multiframe-based approach. At a minimum slot size of 1 OFDM
frame on the forward link, the worst-case overhead ratio would be

Resource allocation messages scheduling data packets for transmission on the forward link or the reverse link are transmitted in the
common control slot at the beginning of each multiframe according
to a transmission request of an aircraft or the transmission backlog of
the ground station. Data packets are then bundled into this resource
allocation for transmission. This is illustrated in Figures 5 and 6.
Introducing security at the resource allocation level would require covering the transmissions of each user with security data.
Since there may be more than one resource allocation per data slot,
this would introduce at least the same amount of overhead as slotbased security.
A benefit of security at the resource allocation level is that it
has no significant impact on the latency of the LDACS protocol.

The specified working point for LDACS is a residual bit error
rate of 10−6 or better after forward error correction. However,
LDACS is designed to work up to a residual bit error rate of
10−5.

The target latency for voice transmissions is typically <100 ms
for the complete processing chain.

IEEE A&E SYSTEMS MAGAZINE

NOVEMBER 2017

Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine November 2017