Aerospace and Electronic Systems Magazine November 2017 - 40

Addressing Vulnerabilities of the CNS Infrastructure to Targeted Radio Interference
becomes idle. This mechanism is intended to protect ongoing transmission from interruptions but could also be used to attack VDL2.
An attack on the CSMA protocol would not be required to spoof a
specific waveform or message, because channel busy detection is
solely based on received power sensing [20]. The required power
to trick a VDL2 radio into constant back off is substantially lower
than the power required for jamming. VDL2 receivers dynamically
adapt their sensing threshold to the observed noise level. Therefore,
an interfering signal would be ignored by the channel busy detection
after a certain time. However, this mechanism can be circumvented
by varying the attacking signal in an appropriate manner.

GENERALIZATION: VULNERABILITY OF OTHER CNS
SYSTEMS

Figure 6.

Maximum injectable error for 1 day.

VDL2
The VDL2 is a communication technology for exchanging digital
information between aircraft and ground stations. VDL2 has been
mandated by the Eurocontrol Link 2000+ program as the primary
datalink for controller-pilot data link communications. Aircraft have,
therefore, been equipped with VDL2, and networks of ground stations providing VDL2 service have been deployed by Aeronautical
Radio Incorporated and the Société Internationale de Télécommunication Aéronautique. VDL2 provides data services only, and there
are no provisions to transmit audio information on a real-time basis.
VDL2 uses channels of 25-kHz bandwidth within the aeronautical VHF communications band. A linear modulation scheme
with a raised cosine elementary signal of 0.6 bandwidth expansion
factor is used. Bits are encoded with Eight-ary differential phaseshift keying (D8PSK) at a symbol rate of 10.5 ksymbols/s. This
is equivalent to a raw bit rate of 31.5 kbit/s. Medium access is
p-persistent carrier sense multiple access (CSMA), with the same
parameters in the ground station and in the aircraft. VDL2 does not
provide authentication or encryption [17].
Multiple 25-kHz VHF channels may be used for VDL2. In
Europe, however, only one channel at 136.975 MHz is currently
in use for all aircraft and ground stations, which creates significant operational problems reported in [18]. Due to their extremely
low bandwidth, generating arbitrary VDL2 signals is not difficult.
Time-synchronous signal generation is not required for spoofing in
a CSMA system, such as VDL2 [12].
Jamming VDL2 is possible if the sensitivity of VDL2 receivers and minimum required SIR is known. Typical airborne VDL2
transceivers have a transmit power of 18 W (42.6 dBm). Receivers
require a power density of −90 dBm/m2 [19]. For ground stations,
a minimum power density of −79 dBm/m2 is recommended within
the region of coverage in the International Civil Aviation Organization Annex 10 [14]. From these values, the required transmit
power of a jamming signal and the spatial separation toward a victim VDL2 receiver can be derived in a similar way as for SSR.
It is also conceivable to attack the VDL2 CSMA protocol. In
CSMA, a potential transmitter senses the channel before transmitting. If it detects the channel to be busy, it backs off until the channel
40

In broad terms, it is possible to observe a pattern of vulnerabilities
that repeat themselves across CNS systems. One consequence of
this observation is that fixes to vulnerabilities may be beneficial
across a variety of systems. The proposed fixes to these vulnerabilities are discussed in the following.
A central issue that remains is standardized, unencrypted signals. Although navigation systems typically do not benefit from
source encryption or authentication, data-level encryption is crucial for communication systems and subsystems. The transmission
of unauthenticated data can lead to unauthorized injection of misleading or false information.
The inability of many CNS systems to determine the direction from which a radio signal arrives makes them vulnerable to
unwanted interventions, whether intentional or unintentional. In
many cases, systems can be jammed by transmissions from locations that are not necessarily in the airspace. Basic direction-ofarrival (DoA) estimation would enable systems to detect and even
locate jamming signals or use the direction as a criterion for authenticating a data source.
In some cases, individual systems become critical enablers of a
particular service or category. In such cases, a redundant capability
will reduce the criticality of the system, and service can continue
to be provided during an outage of primary system. One prominent
example is GNSS jamming, which has led to the development of
alternate position, navigation, and timing services.

DISCUSSION: DESIGNING CNS SYSTEMS FOR RFI
ROBUSTNESS
The vulnerabilities discussed for the three case studies SSR,
GBAS, and VDL2 are somewhat typical for current CNS systems.
This section proposes a few principles that would help reduce the
vulnerability of some of these systems to RFI. The discussion focuses on the three example systems before entering a more general
overview of measures that would benefit other services.

ENHANCING THE RFI RESILIENCE OF SSR
A few modifications could be made to SSR, as a way of improving
its robustness to RFI. Although it is unlikely that these changes

IEEE A&E SYSTEMS MAGAZINE

NOVEMBER 2017



Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine November 2017

No label
Aerospace and Electronic Systems Magazine November 2017 - No label
Aerospace and Electronic Systems Magazine November 2017 - Cover2
Aerospace and Electronic Systems Magazine November 2017 - 1
Aerospace and Electronic Systems Magazine November 2017 - 2
Aerospace and Electronic Systems Magazine November 2017 - 3
Aerospace and Electronic Systems Magazine November 2017 - 4
Aerospace and Electronic Systems Magazine November 2017 - 5
Aerospace and Electronic Systems Magazine November 2017 - 6
Aerospace and Electronic Systems Magazine November 2017 - 7
Aerospace and Electronic Systems Magazine November 2017 - 8
Aerospace and Electronic Systems Magazine November 2017 - 9
Aerospace and Electronic Systems Magazine November 2017 - 10
Aerospace and Electronic Systems Magazine November 2017 - 11
Aerospace and Electronic Systems Magazine November 2017 - 12
Aerospace and Electronic Systems Magazine November 2017 - 13
Aerospace and Electronic Systems Magazine November 2017 - 14
Aerospace and Electronic Systems Magazine November 2017 - 15
Aerospace and Electronic Systems Magazine November 2017 - 16
Aerospace and Electronic Systems Magazine November 2017 - 17
Aerospace and Electronic Systems Magazine November 2017 - 18
Aerospace and Electronic Systems Magazine November 2017 - 19
Aerospace and Electronic Systems Magazine November 2017 - 20
Aerospace and Electronic Systems Magazine November 2017 - 21
Aerospace and Electronic Systems Magazine November 2017 - 22
Aerospace and Electronic Systems Magazine November 2017 - 23
Aerospace and Electronic Systems Magazine November 2017 - 24
Aerospace and Electronic Systems Magazine November 2017 - 25
Aerospace and Electronic Systems Magazine November 2017 - 26
Aerospace and Electronic Systems Magazine November 2017 - 27
Aerospace and Electronic Systems Magazine November 2017 - 28
Aerospace and Electronic Systems Magazine November 2017 - 29
Aerospace and Electronic Systems Magazine November 2017 - 30
Aerospace and Electronic Systems Magazine November 2017 - 31
Aerospace and Electronic Systems Magazine November 2017 - 32
Aerospace and Electronic Systems Magazine November 2017 - 33
Aerospace and Electronic Systems Magazine November 2017 - 34
Aerospace and Electronic Systems Magazine November 2017 - 35
Aerospace and Electronic Systems Magazine November 2017 - 36
Aerospace and Electronic Systems Magazine November 2017 - 37
Aerospace and Electronic Systems Magazine November 2017 - 38
Aerospace and Electronic Systems Magazine November 2017 - 39
Aerospace and Electronic Systems Magazine November 2017 - 40
Aerospace and Electronic Systems Magazine November 2017 - 41
Aerospace and Electronic Systems Magazine November 2017 - 42
Aerospace and Electronic Systems Magazine November 2017 - 43
Aerospace and Electronic Systems Magazine November 2017 - 44
Aerospace and Electronic Systems Magazine November 2017 - 45
Aerospace and Electronic Systems Magazine November 2017 - 46
Aerospace and Electronic Systems Magazine November 2017 - 47
Aerospace and Electronic Systems Magazine November 2017 - 48
Aerospace and Electronic Systems Magazine November 2017 - 49
Aerospace and Electronic Systems Magazine November 2017 - 50
Aerospace and Electronic Systems Magazine November 2017 - 51
Aerospace and Electronic Systems Magazine November 2017 - 52
Aerospace and Electronic Systems Magazine November 2017 - 53
Aerospace and Electronic Systems Magazine November 2017 - 54
Aerospace and Electronic Systems Magazine November 2017 - 55
Aerospace and Electronic Systems Magazine November 2017 - 56
Aerospace and Electronic Systems Magazine November 2017 - 57
Aerospace and Electronic Systems Magazine November 2017 - 58
Aerospace and Electronic Systems Magazine November 2017 - 59
Aerospace and Electronic Systems Magazine November 2017 - 60
Aerospace and Electronic Systems Magazine November 2017 - 61
Aerospace and Electronic Systems Magazine November 2017 - 62
Aerospace and Electronic Systems Magazine November 2017 - 63
Aerospace and Electronic Systems Magazine November 2017 - 64
Aerospace and Electronic Systems Magazine November 2017 - Cover3
Aerospace and Electronic Systems Magazine November 2017 - Cover4
http://www.brightcopy.net/allen/aesm/34-2s
http://www.brightcopy.net/allen/aesm/34-2
http://www.brightcopy.net/allen/aesm/34-1
http://www.brightcopy.net/allen/aesm/33-12
http://www.brightcopy.net/allen/aesm/33-11
http://www.brightcopy.net/allen/aesm/33-10
http://www.brightcopy.net/allen/aesm/33-09
http://www.brightcopy.net/allen/aesm/33-8
http://www.brightcopy.net/allen/aesm/33-7
http://www.brightcopy.net/allen/aesm/33-5
http://www.brightcopy.net/allen/aesm/33-4
http://www.brightcopy.net/allen/aesm/33-3
http://www.brightcopy.net/allen/aesm/33-2
http://www.brightcopy.net/allen/aesm/33-1
http://www.brightcopy.net/allen/aesm/32-10
http://www.brightcopy.net/allen/aesm/32-12
http://www.brightcopy.net/allen/aesm/32-9
http://www.brightcopy.net/allen/aesm/32-11
http://www.brightcopy.net/allen/aesm/32-8
http://www.brightcopy.net/allen/aesm/32-7s
http://www.brightcopy.net/allen/aesm/32-7
http://www.brightcopy.net/allen/aesm/32-6
http://www.brightcopy.net/allen/aesm/32-5
http://www.brightcopy.net/allen/aesm/32-4
http://www.brightcopy.net/allen/aesm/32-3
http://www.brightcopy.net/allen/aesm/32-2
http://www.brightcopy.net/allen/aesm/32-1
http://www.brightcopy.net/allen/aesm/31-12
http://www.brightcopy.net/allen/aesm/31-11s
http://www.brightcopy.net/allen/aesm/31-11
http://www.brightcopy.net/allen/aesm/31-10
http://www.brightcopy.net/allen/aesm/31-9
http://www.brightcopy.net/allen/aesm/31-8
http://www.brightcopy.net/allen/aesm/31-7
https://www.nxtbookmedia.com