Aerospace and Electronic Systems Magazine November 2017 - 41

Osechas et al.
would become part of the standard, it is interesting to discuss them
as a way of "learning from past mistakes."
The first proposed fix is to add RFI monitoring to SSR interrogators: for example, in the form of stationary receivers, in the
1090-MHz band, that locate the source or the direction of an incoming signal. With this addition, an SSR interrogator can check
the consistency of the information provided by the transponder
with the signal characteristics.
A second proposal is to fuse SSR data with PSR measurements.
The technical details of such a setup are discussed in [21]. Essentially, the proposal boils down to a consistency check between two
different systems. This consistency check would detect SSR replies
that are inconsistent with PSR observation, thus removing the vulnerability to ghost aircraft. Furthermore, it would make jamming
attacks observable by detecting the presence of PSR measurements
when no SSR data are available.
Authentication from DoA is useful for SSR interrogators authenticating transponder signals. Relative to the current vulnerability, any amount of DoA-based authentication would be an improvement. Finally, the potential to compute multilateration-based
estimates of the position of an SSR transponder would provide
excellent consistency, checking between the position broadcast
through SSR mode S and the actual position of a spoofer.

MAKING GBAS MORE ROBUST TO RFI
Among the modifications to GBAS that would improve the robustness to RFI, a few elements are identified as bearing resemblance
with the solutions to SSR vulnerabilities. This will contribute to a
list of solutions that will benefit many other CNS systems in their
RFI robustness.
Equip GBAS reference receivers with controlled reception pattern antennae. In the GBAS context, this will, on the one hand, reduce interference power from sources other than GNSS satellites.
Conversely, it will provide a means of authentication by DoA.
Monitor the performance of broadcast corrections in real time.
In principle, this notion is similar to the executive monitoring functions enabled in other CNS systems, such as an instrument landing systems. Having receivers at known locations monitor the data
broadcast by the VDB enables the GBAS facility to detect spoofing of the reference receivers that would otherwise go undetected.
Adding data encryption to the differential correction message
would likely require a separate communications channel, other
than the VDB. A second channel would provide redundancy to
the user of differential corrections, but at least as significant as
the redundancy is the potential to encrypt or authenticate the data.
Transmission of GBAS differential corrections is a prime application of air-to-ground digital communications systems, for which
major research efforts are under way [22].

IMPROVING THE RESILIENCE OF VDL2
The resilience of VDL2 can be improved by the deployment of
multiple channels rather than just a single one. This approach is being discussed to overcome the capacity limitations and operational
problems of the single VDL2 channel currently in use. However,
NOVEMBER 2017

the introduction of additional channels would also improve the resilience of the system against jamming at the same time.
The introduction of additional VDL2 channels would also allow deploying multicoverage. In a multicoverage VDL2 deployment, several VDL2 cells would be available at the same location.
This measure would (locally) improve the resilience of the system
in the same way as having multiple channels.
Further improvements of the robustness of the VDL2 system
are possible on the protocol level, i.e., adjusting and fine-tuning
suitable protocol parameters. Carefully choosing improved probability settings of the p-persistent CSMA algorithms is one possible approach. Currently, the aircraft and ground VDL2 terminals
use the same probability setting, which is known to be suboptimal.
The previously mentioned measures may increase the robustness of the system against jamming. However, improved resilience
against spoofing without encryption and authentication is hardly
doable in VDL2. Adding data encryption to VDL2 would require
replacing VDL2 with a new communication link for which major
research efforts are under way [22].

ROBUSTNESS BY DESIGN
Looking at the three case studies presented previously, four principles are identified that will benefit the robustness of state-of-theart CNS systems to RFI. These principles have been shown to hold
beyond the specific technologies discussed and are meant to guide
future efforts of designing CNS systems with RFI robustness in
mind.
For information transfer, it is crucial to encrypt the data transmitted through the CNS infrastructure. Whether this pertains to
GBAS differential corrections, SSR mode S data, or other information, authenticating sources is critical in guaranteeing safety-oflife performance. Unfortunately this recommendation is limited to
communication systems, as the time criticality of time-of-arrival-
based positioning systems makes it unfeasible to encrypt navigation messages.
Consistency is a key component in assuring performance. The
consistency of a piece of information can be leveraged in many
ways for integrity purposes. In the case of monitoring for intentional faults, such as RFI, consistency is equally important, though
it may be harder to make a quantitative prediction of performance
during off-nominal behavior, as RFI events do not necessarily follow a known probability of occurrence.
Directional antennae, whether implemented as physical reflectors or smart patch antennae, provide the capability of adding
DoA-based consistency checking. This capability would detect unauthorized broadcasts, unless they manage to situate themselves
exactly in the line of sight between user and provider.
Redundancy is another key factor in providing RFI robustness.
Redundancy is required for checking the consistency between different systems, but it can also be used to verify the nominal operation of a single system, as is typically done with receiver autonomous integrity monitoring. Redundancy can refer to one system
providing more measurements than strictly required for a simple
estimation, or it can mean observing similar phenomena with different measurements or even sensing principles.

IEEE A&E SYSTEMS MAGAZINE

Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine November 2017