Aerospace and Electronic Systems Magazine November 2017 - 36

Addressing Vulnerabilities of the CNS Infrastructure to Targeted Radio Interference

TWO DISRUPTION MODELS
In the literature, two terms are often used to categorize unauthorized RF emissions: jamming and spoofing. For assessing CNS vulnerabilities, it is common to have them denote the complexity of an
RFI event and define them as follows. The distinguishing criterion
between jamming and spoofing relates to the interference power at
the user antenna: if the interference signal is above the background
noise, it is usually referred to as jamming, while spoofing tends to
label interferers that work below the noise floor [7]. Note that the
distinction is by no means normative: cases of jamming have been
reported to cause undetected navigation errors [11].

JAMMING
Jamming usually refers to nonspecific interference that can overpower an entire frequency band, leading to a denial of service in
systems operating in that band. Typically, jamming events cause
disruptions in service, but they do not inject misleading information, which typically makes them an availability nuisance, rather
than an integrity hazard. Common sources of jamming are personal
privacy devices that are designed to disrupt GNSS and telecommunication services in a local environment [10].

SPOOFING
Spoofing denotes targeted interference, using signals engineered
to impersonate legitimate sources. This type of event can cause
misleading information to be injected into a system and is a serious
concern for the safety of a system. Spoofing interferers are able
to transmit signals that are less powerful than background noise,
making them particularly difficult to detect.

THREE ILLUSTRATIVE EXAMPLES: SSR, GBAS, AND VDL2
This section takes a closer look at three systems that have been
shown, by other authors, to be vulnerable to RF interference; secondary surveillance radar (SSR), the ground-based augmentation
system (GBAS), and the VHF data link mode 2 (VDL2). For each
system, the weaknesses that allow unauthorized users to manipulate critical CNS information are identified.
With systems that are already operational, making significant
changes are not always feasible, due to backward compatibility.
Wherever possible, methods to mitigate vulnerabilities are proposed, but in other cases, the focus is on concepts to be taken into
consideration when designing future systems, so as to make them
robust to known interference threats.

SSR
Current ATM systems rely heavily on SSR, as it offers several benefits over primary surveillance radar (PSR), in that its range of operation is greater and that the position estimates can have a higher
accuracy [13]. The fundamental difference between PSR and SSR
is that SSR requires users to be equipped with a transponder, while
PSR simply measures the signals transmitted from a ground station
and reflected by an aircraft. In both cases, the distance between an
36

Figure 1.

Operation of SSR.

aircraft and a ground station is estimated by measuring the time of
flight of a radio signal.
SSR works as an interrogation reply system, in which a terrestrial station, or "interrogator," broadcasts signals that prompt a
response from airborne "transponders," as illustrated in Figure 1.
The transponder has three different reply modes available that allow it to broadcast various types of information, including its own
position, velocity, and intent, as well as other information relevant
for ATM. [13] The SSR interrogator transmits its signals at 1030
MHz, while airborne transponders reply at 1090 MHz.
Researchers have shown that an unauthorized user can create
illegitimate SSR messages, e.g., injecting ghost aircraft [1], [6]
into the ATM system, but it is also possible to delete SSR messages
[12]. A critical question to assess is how big an area SSR can be
jammed by an unauthorized user with a given transmit power and
antenna gain, without discussing the attack mechanics.
For interference protection, SSR pulses need to be received at
no less than 12 dB above the noise or interference power [14].
Thus, any user able to broadcast sufficient equivalent isotropically
radiated power (EIRP) can prevent SSR systems from receiving
messages. Given the minimum signal-to-interference ratio (SIR) of
12 dB, it is possible to compute the radius beyond which all interrogations will be lost for a given ground station.

Conceptual Setup of Threat
In general, the results largely depend on the geometry of the setup,
as indicated in Figure 2. The elements are the distance from attacker
to interrogator (dG), the distance from attacker to transponder (d1),
the distance from transponder to interrogator (d2), the altitude of the
d
transponder (h), and the reference angle a, such that tan (a) = G .
2h

Vulnerability at the Transponder
Assume an attacker is equipped with an asynchronous pulse signal
generator. The EIRP is a function of the transmit power PT( A) in
dBm, the antenna gain G(A) in dBi and a cable loss CL(A) in decibels.
Then, at the attacker
A
EIRP ( A) = PT( A) + G ( A) − CL( ) .

At the interrogator, a similar expression holds
I
EIRP ( I ) = PT( I ) + G ( I ) − CL( ) ,

where the maximum EIRP is up to to 82.5 dBm, as reported in [15].

IEEE A&E SYSTEMS MAGAZINE

NOVEMBER 2017

Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine November 2017