Aerospace and Electronic Systems Magazine November 2017 - 35

ing a concept of operations or developing new paradigms in ATM
security management.
The vulnerability of CNS infrastructure to unauthorized radio
sources has been highlighted by academic research groups, such as
the work of Rokitansky's group on automatic dependent surveillance-broadcast [6] and efforts from the software-defined radio
community [1]. On the side of vulnerabilities to global navigation
satellite system (GNSS), some influential work has been done at
the University of Texas [2] and at the German Aerospace Center
(DLR) [7]. Although the vulnerabilities of navigation systems are
markedly different from navigation systems, the issue of data link
spoofing has also received some attention [8], [9].
One key system in CNS is GNSS. Satellite navigation has enabled new capabilities that make air traffic both more efficient and
safer than ever before. However, GNSS is subject to some fundamental vulnerabilities to radio interference [2] that can have severe
implications to the safety of its users. Current research efforts focus on addressing the vulnerabilities, for example, by designing
more adequate antennae, or by resorting to multireceiver setups
[10], [11].
Analysis of threats to the radio frequency (RF) portion of the
CNS infrastructure is usually limited to GNSS-based systems. In
many cases, publications limit themselves to identifying, or even
demonstrating, threats but are at a loss for solutions. Several authors do offer solutions for different vulnerabilities of GNSS, but
they do not stray beyond the scope of satellite navigation. By contrast, our article addresses a wider set of vulnerabilities, foraying
deeper into CNS systems, most of which suffer from variations of
the same limitations as GNSS.

THE VULNERABILITIES

STANDARDIZED SIGNALS
The signals underlying CNS systems are, by nature, standardized,
and the standards are accessible to any individual or organization,
as are the corresponding compliance tests. The three example systems discussed show how accessible standards make it easier for
unauthorized users to replicate signal wave forms, compared with
how this would play out in a closed system.

UNSECURED DATA LINKS
In many CNS systems, data transmission is not secured. One notorious case is GNSS, where open signals coexist with secured signals, but the secured signals are not authorized for civilian CNS
applications. Unsecured signals make it impossible for users to
establish the authenticity of the source of a given received signal
and allow possible attackers to eavesdrop.

OMNIDIRECTIONAL ANTENNAE
Some CNS systems operate with omnidirectional antennae, either
on the airborne side, on the ground, or both. Although omnidirectionality typically favors availability, it also exacerbates the vulnerability to unwanted signals.

THE SCOPE

The DLR conducted an analysis of the vulnerability of several
CNS systems to RF disruption in the context of ARIEL [12]. The
analysis yielded several characteristics of CNS vulnerabilities that
are near ubiquitous in state-of-the-art infrastructure. These characteristics are partly a consequence of CNS systems being designed
when RF disruptions were not nearly as common as they are today.
Some of these characteristics are inherent to the mode of operation of certain systems, meaning that these systems will have
to remain vulnerable for as long as they are operational. In other
cases, however, subtle changes to systems, without a fundamental
NOVEMBER 2017

modification of the technology, can enhance their robustness to radio frequency interference (RFI). The solutions sought after are
such they do not require a fundamental rework but do mitigate the
effects of tampering.

The main driver behind our research effort is, currently, to identify
weak points in the CNS infrastructure and provide strategies for
their solution. At all times, the aim is to highlight shortcomings
without providing instructions on how shortcomings can be exploited; furthermore, a second aim is to provide solutions to all
highlighted issues. Some of the solutions can be synthesized to
specific recommendations. In some cases, it is only possible to provide conceptual sketches, describing how current methods would
need to be developed to make ATM more robust to disruptions
from RFI.

IEEE A&E SYSTEMS MAGAZINE

Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine November 2017