Aerospace and Electronic Systems Magazine November 2017 - 39

Osechas et al.
tion estimate, than if error models were not taken into account in
the estimation process.
For a ground station with known position, xu is known to within
a few millimeters, and the station is able to measure the error terms
in real time, process the errors into so-called differential corrections, and broadcast them to users in its vicinity. When users apply
these differential corrections, they are able to improve the accuracy
but also the reliability of their position estimates.

GBAS Data Processing
GBAS is a differential GNSS system, in which a ground facility
has GNSS antennae with precisely known positions xref . Knowing the exact position of a GNSS antenna allows its receiver to
compare its pseudorange measurements with a near-truth estimate
of it. Thus, the reference receiver is able to compute a pseudorange
correction (Δρk) from its measured pseudorange ρk and the model
pseudorange ρ k. The model is computed from knowing xref , the
satellite position xk, and the receiver clock bias b

ρ k = xref − x k − b,
Δρ k = ρ k − ρ k .

If the set of corrections Δρk is provided to airborne users, for example, via a VHF data link, the airborne users can correct their
pseudorange measurements to increase the accuracy of the position
estimate. In the simplified version of a GBAS system, as depicted
in Figure 5, the reference receiver knows its position (xref , indicated with a triangle) and clock bias (b), which can be used to
determine the model pseudorange (ρ k, indicated with red dashed
lines). Comparing the measured pseudorange (ρk, indicated with
green lines) with the model value yields the pseudorange correction (Δρk, indicated for one satellite with a blue line). The value of
Δρk is broadcast via a VHF data link to a user, which applies the
corrections to its measured pseudoranges, removing locally correlated common-mode errors from the position solution.
Two further crucial functions of GBAS are providing error
models for the corrected pseudorange measurements and issuing
alerts in cases of satellite faults. Broadcasting error models to airborne users enables them to bound their position error under nominal circumstances, which is usually reflected in the diagonal matrix
W. Fault monitoring, on the other hand, detects whether satellites
are operating within specification. The VHF data broadcast (VDB)
message contains information on the health of the GNSS constellation allows users to assert the nominal operation of the entire
system.
One can define an error vector Δxu as a linear combination of
the projections of all Δρk into the position domain. Simply scaling
each Δρk by some factor ak ∈ [−1,1] gives the bounds on the vector
Δxu as



Δxu  G TWG



1

G TWΔρ,

(8)

where the kth diagonal element is ak. Note that equation (8) defines
a position-domain quantity that does not correspond to any actual
NOVEMBER 2017

Figure 5.

GBAS vulnerabilities concentrate around the computation and transmission of the VDB message.

quantity in GBAS, but it is useful in discussing systematic and
intentional errors.

Vulnerability to Tampering
The GBAS operates multiple GNSS receivers, with the broadcast
corrections averaged over all receivers. However, each reference
receiver can be disrupted with conventional GNSS techniques,
for example, as described by [2], [7]. Figure 5 indicates a GBAS
reference receiver with a red arrow to highlight the potential vulnerability to tampering. A second vulnerability in current GBAS
systems is the VDB, which transmits the differential corrections,
information about current error models, as well as fault monitors.
In Figure 5, another red arrow indicates the vulnerability of GBAS
to external intervention at the VDB.
Tampering with the reference receivers can lead to false computations on individual satellite corrections Δρk or even on the entire vector of corrections Δρ. The impact of tampering with the
reference receivers is that the vector Δρ can be engineered to inject
arbitrary position corrections Δxu. The corrected position estimate
at the user can, therefore, be steered to any location around the
actual, true position, with a few constraints on the consistency of
the pseudorange corrections Δρk.
An attack on the VDB would, in contrast, affect only one user
at a time. If the attacker is able to modify the contents of the correction message, the same arbitrary Δxu can be generated. Altering
the VDB message, however, can also affect integrity information;
in that case, potential "do not use" flags could be overridden during
a satellite fault (leading to integrity hazards), or on the contrary,
they could be set when no faults are present, which could make the
GBAS facility unavailable to that user.
The only consistency check that the user is required to perform
on the corrections is that the horizontal component of each Δρk
shall not exceed 200 m. With this consistency check, the maximally injectable position error is bounded by the geometry G of
the GNSS satellites.
The maximum position that can be injected is far greater than
the alert limit on most relevant approach or landing services, which
makes this particularly hazardous considering that the injectable
errors will likely not be detected in a timely fashion, as the time-toalert requirements of precision approach and landing services are
very strict (2-10 seconds; Figure 6).

IEEE A&E SYSTEMS MAGAZINE

Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine November 2017