Aerospace and Electronic Systems Magazine November 2017 - 44

Feature Article:

DOI. No. 10.1109/MAES.2017.160276

ADS-B Jamming Mitigation: A Solution Based on a
Multichannel Receiver
Mauro Leonardi, Emilio Piracci, Gaspare Galati, University of Rome Tor Vergata, Italy

The Automatic Dependent Surveillance-Broadcast (ADS-B) system is one of the major surveillance systems for air traffic management, providing identity, position, and status information of all
cooperating aircraft. It is being used more and more frequently in
modern air traffic management [1]- [4].
The ADS-B is a dependent and cooperative surveillance system used for air traffic control in which aircraft and surface vehicles periodically transmit their own information to any equipped
listener for surveillance scope. The ADS-B system is one of the
pillars of future air traffic systems and estimates suggest that about
80% of all commercial aircraft are now equipped with ADS-B
transponders.
The ADS-B has two services, namely "ADS-B Out" based on
the periodical broadcast of position and identity information from
the equipped aircraft and "ADS-B In", i.e. the capability to receive
ADS-B messages from nearby aircraft to create an on-board image
of the nearby traffic. ADS-B Out provides to the air traffic controllers (or to anyone equipped with an ADS-B receiver) identity, realtime position, velocity, etc. usually with better performance (in
terms of accuracy and renewal time) than the classical radar-based
systems. Figure 1 shows the general ADS-B system architectures.
When compared to the classical radar surveillance, ADS-B has
various advantages, namely: easy implementation, low cost, and
high accuracy. On the other hand, the ADS-B has two fundamental,
intrinsic disadvantages:
C

It is dependent on the on-board derived navigation data (usually based on satellite navigation);
The transmission protocol is simple and open (without authentication or encryption) and can be easily corrupted for
malicious scopes.

The datalink, for commercial aircraft, is based on the 1090
MHz channel widely used for the communication from airborne
transponders to Surveillance Secondary Radar, according to the

extended squitter Mode S protocol (1090ES) [2]. The 1090 MHz
Mode S protocol allows the on board transponder to transmit 56 or
112 data packets every second on the squitter signal; the access to
the channel, for historical reasons, is random, not organized and
without any kind of encryption/authentication.
The squitter is composed of a well-known preamble (composed of four timed pulses) and a data block (composed of 56 or
112 pulses using the Pulse Position Modulation (PPM) techniques
(see Figure 1). The data block includes (depending on the type of
squitter) the 24-bit aircraft identification code, aircraft position,
aircraft velocity, etc. [5].

THE ADS-B SYSTEM VULNERABILITIES
This increasing use of the ADS-B calls for even greater attention to
the safety and security of its radiofrequency channel. The ADS-B
is vulnerable to several forms of attack and even a low-cost jammer may affect an ADS-B receiver reducing its capabilities with
potential impairments on overall air safety. In this section, we will
describe the vulnerabilities of the ADS-B protocol and then propose a solution along with pertinent trials and the results of those
trials.

ATTACK ON THE ADS-B SYSTEM
In 2009 the Federal Aviation Administration (FAA) released the
findings of its security certification and accreditation procedure
[6], concluding that: "...The ADS-B data does not subject an aircraft to any increased risk compared to the risk that is experienced
today" but some authors have major concerns regarding the FAA
report. For example, in [7]-[12] possible attacks to the ADS-B system are shown and classified; in Figure 1 the most vulnerable parts
of the system are highlighted; and the bulleted list below summarizes possible attacks to the ADS-B radiofrequency:
C

Authors' addresses: M. Leonardi, G. Galati, University of
Rome Tor Vergata, Electronic Engineering, Via del Politecnico 1,
Roma, RM 00133 Italy. E-mail: (mauro.leonardi@uniroma2.it).
E. Piracci, Rheinmetall Italia s.p.a., Via Affile, 102-00131 Rome,
Italy.
Manuscript received December 21, 2016, revised July 20, 2017,
and ready for publication August 22, 2017.
Review handled by K. Kramer.
0885/8985/17/$26.00 © 2017 IEEE
44

Eavesdropping: A passive attack that takes the form of listening to the unsecured broadcast transmissions of the ADSB messages and usually forms the basis for a number of
sophisticated active attacks. Eavesdropping is impossible to
be prevented without applying encryption and of course, is
impossible to be detected;
Jamming: The intentional transmission of high power harmful signals in the same band as the ADS-B channel in order to disable the air-ground communication, for a single

IEEE A&E SYSTEMS MAGAZINE

NOVEMBER 2017

Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine November 2017