Aerospace and Electronic Systems Magazine November 2017 - 52

Feature Article:

DOI. No. 10.1109/MAES.2018.160234

ADS-B Vulnerabilities and a Security Solution with a
Timestamp
Yoohwan Kim, Ju-Yeon Jo, Sungchul Lee, University of Nevada, Las Vegas, NV, USA

INTRODUCTION
Automatic Dependent Surveillance-Broadcast (ADS-B) is the foundation of NextGen Air Traffic Control (ATC) system, and all aircraft
must be equipped with it by January 1, 2020. Despite the importance
of ADS-B, it has been developed without security considerations
and is subject to various types of attacks. A trustworthy ADS-B system will make the NextGen system more reliable and make air transportation safer. But current safety measures are inadequate and many
research proposals are not yet practical or cost-effective.
We developed a practical method that can reject virtually all
spoofed ADS-B messages by monitoring the signal propagation
time between senders and receivers. To measure the actual propagation time, the method uses a small timestamp value; hence, we call
it "ADS-B with Timestamp" (ADS-BT). ADS-BT monitors the discrepancy between the time of flight based on the timestamp values
and the time of flight based on the location data. In spoofed ADSB messages, the discrepancy between the two diverges over time,
which allows us to identify spoofed ADS-B messages accurately.
In this article, we discuss the security vulnerabilities of ADSB, challenges of developing ADS-B security schemes, and current
approaches. We then describe the concept of our proposed ADSBT and show how it can reliably reject attack packets.

ADS-B OPERATION
ADS-B uses a Global Navigation Satellite System, typically a
global positioning system (GPS), to determine the aircraft's position. It then periodically broadcasts the aircraft's position, speed,
and altitude to ground stations or other aircraft in the vicinity [1]
(see Figure 1).
While there are three types of ADS-B transmission frequencies, i.e., 1090 MHz Extended Squitter (ES), 978 MHz Universal
Access Transceiver (UAT), and the very high frequency (VHF)
data link between 108 and 137 MHz, the 1090 ES is considered the
most cost-effective because it is an extension of the existing Mode
Authors' address: University of Nevada, Las Vegas, Computer
Science, 4505 Maryland Parkway, Las Vegas, NV 89154 USA,
E-mail: (Yoohwan.Kim@unlv.edu).
Manuscript received October 30, 2016, revised May 29, 2017,
and ready for publication August 20, 2017.
Review handled by W. Walsh.
0885/8985/17/$26.00 © 2017 IEEE
52

S transponder functions [2]. Mode S-capable transponders reply
with a globally unique 24-bit aircraft identifier to the ground-based
radar upon interrogation. Its data rate is 1 Mbps and the frame size
is either 56 or 112 bits. Mode S transponders also send out unsolicited transmissions once per second to enable Airborne Collision Avoidance System (ACAS), called Mode S Short Squitter
(56-bit), but this frame only contains the 24-bit aircraft identifier
(ID), not the location information. On the other hand, 1090 ES uses
Extended Squitter (112-bit), which contains a 56-bit data field for
the ADS-B data (i.e., location data) which provides the location
accuracy of about 5.1 meters. This frame is continuously broadcast
approximately twice per second (every 0.4 to 0.6 seconds) from
all aircraft. The format of 112-bit ADS-B Position Squitter frame
is shown in Figure 2. The 56-bit location data within the ADSB packet is not the raw GPS data. To reduce the size of the raw
GPS data, ADS-B uses a transformation method called Compact
Position Reporting (CPR) where the data is broken into two pieces
and put in two packets (odd and even). To decode the location,
the receiver must receive both ADS-B packets. This requirement
introduces a further delay in decoding and results in an increased
discrepancy between the true location and the decoded location.
ADS-B is considered the central component of the NextGen
and ADS-B transmitters must be installed in all aircraft by January
1, 2020 [3]. It will replace radar as the primary surveillance method used by ATC. Although prices are dropping [4], ADS-B devices
are still quite expensive. The typical cost for ADS-B Out devices
ranges from $2,000 to $5,000, and ADS-B In devices from $300 to
$1,000 [4], [5]. The percentage of aircraft equipped with ADS-B
receivers is nevertheless steadily increasing, as they are to become
mandatory for most aircraft around the world by 2020. Roughly
70% of all commercial passenger aircraft (80% in Europe, 60% in
the U.S.) are equipped with an ADS-B transponder [6].

ADS-B SECURITY CONCERNS
ADS-B VULNERABILITY
ADS-B has been developed without security considerations and
is therefore subject to various types of attacks [7]. Since ADS-B
does not have any encryption or authentication measures, an attacker can eavesdrop on the communication easily [1], [8], alter
legitimate messages, or inject nonlegitimate messages into the
communication system. Injecting multiple bogus messages can
cause ghost aircraft flooding on the controller's surveillance sys-

IEEE A&E SYSTEMS MAGAZINE

NOVEMBER 2017



Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine November 2017

No label
Aerospace and Electronic Systems Magazine November 2017 - No label
Aerospace and Electronic Systems Magazine November 2017 - Cover2
Aerospace and Electronic Systems Magazine November 2017 - 1
Aerospace and Electronic Systems Magazine November 2017 - 2
Aerospace and Electronic Systems Magazine November 2017 - 3
Aerospace and Electronic Systems Magazine November 2017 - 4
Aerospace and Electronic Systems Magazine November 2017 - 5
Aerospace and Electronic Systems Magazine November 2017 - 6
Aerospace and Electronic Systems Magazine November 2017 - 7
Aerospace and Electronic Systems Magazine November 2017 - 8
Aerospace and Electronic Systems Magazine November 2017 - 9
Aerospace and Electronic Systems Magazine November 2017 - 10
Aerospace and Electronic Systems Magazine November 2017 - 11
Aerospace and Electronic Systems Magazine November 2017 - 12
Aerospace and Electronic Systems Magazine November 2017 - 13
Aerospace and Electronic Systems Magazine November 2017 - 14
Aerospace and Electronic Systems Magazine November 2017 - 15
Aerospace and Electronic Systems Magazine November 2017 - 16
Aerospace and Electronic Systems Magazine November 2017 - 17
Aerospace and Electronic Systems Magazine November 2017 - 18
Aerospace and Electronic Systems Magazine November 2017 - 19
Aerospace and Electronic Systems Magazine November 2017 - 20
Aerospace and Electronic Systems Magazine November 2017 - 21
Aerospace and Electronic Systems Magazine November 2017 - 22
Aerospace and Electronic Systems Magazine November 2017 - 23
Aerospace and Electronic Systems Magazine November 2017 - 24
Aerospace and Electronic Systems Magazine November 2017 - 25
Aerospace and Electronic Systems Magazine November 2017 - 26
Aerospace and Electronic Systems Magazine November 2017 - 27
Aerospace and Electronic Systems Magazine November 2017 - 28
Aerospace and Electronic Systems Magazine November 2017 - 29
Aerospace and Electronic Systems Magazine November 2017 - 30
Aerospace and Electronic Systems Magazine November 2017 - 31
Aerospace and Electronic Systems Magazine November 2017 - 32
Aerospace and Electronic Systems Magazine November 2017 - 33
Aerospace and Electronic Systems Magazine November 2017 - 34
Aerospace and Electronic Systems Magazine November 2017 - 35
Aerospace and Electronic Systems Magazine November 2017 - 36
Aerospace and Electronic Systems Magazine November 2017 - 37
Aerospace and Electronic Systems Magazine November 2017 - 38
Aerospace and Electronic Systems Magazine November 2017 - 39
Aerospace and Electronic Systems Magazine November 2017 - 40
Aerospace and Electronic Systems Magazine November 2017 - 41
Aerospace and Electronic Systems Magazine November 2017 - 42
Aerospace and Electronic Systems Magazine November 2017 - 43
Aerospace and Electronic Systems Magazine November 2017 - 44
Aerospace and Electronic Systems Magazine November 2017 - 45
Aerospace and Electronic Systems Magazine November 2017 - 46
Aerospace and Electronic Systems Magazine November 2017 - 47
Aerospace and Electronic Systems Magazine November 2017 - 48
Aerospace and Electronic Systems Magazine November 2017 - 49
Aerospace and Electronic Systems Magazine November 2017 - 50
Aerospace and Electronic Systems Magazine November 2017 - 51
Aerospace and Electronic Systems Magazine November 2017 - 52
Aerospace and Electronic Systems Magazine November 2017 - 53
Aerospace and Electronic Systems Magazine November 2017 - 54
Aerospace and Electronic Systems Magazine November 2017 - 55
Aerospace and Electronic Systems Magazine November 2017 - 56
Aerospace and Electronic Systems Magazine November 2017 - 57
Aerospace and Electronic Systems Magazine November 2017 - 58
Aerospace and Electronic Systems Magazine November 2017 - 59
Aerospace and Electronic Systems Magazine November 2017 - 60
Aerospace and Electronic Systems Magazine November 2017 - 61
Aerospace and Electronic Systems Magazine November 2017 - 62
Aerospace and Electronic Systems Magazine November 2017 - 63
Aerospace and Electronic Systems Magazine November 2017 - 64
Aerospace and Electronic Systems Magazine November 2017 - Cover3
Aerospace and Electronic Systems Magazine November 2017 - Cover4
http://www.brightcopy.net/allen/aesm/34-2s
http://www.brightcopy.net/allen/aesm/34-2
http://www.brightcopy.net/allen/aesm/34-1
http://www.brightcopy.net/allen/aesm/33-12
http://www.brightcopy.net/allen/aesm/33-11
http://www.brightcopy.net/allen/aesm/33-10
http://www.brightcopy.net/allen/aesm/33-09
http://www.brightcopy.net/allen/aesm/33-8
http://www.brightcopy.net/allen/aesm/33-7
http://www.brightcopy.net/allen/aesm/33-5
http://www.brightcopy.net/allen/aesm/33-4
http://www.brightcopy.net/allen/aesm/33-3
http://www.brightcopy.net/allen/aesm/33-2
http://www.brightcopy.net/allen/aesm/33-1
http://www.brightcopy.net/allen/aesm/32-10
http://www.brightcopy.net/allen/aesm/32-12
http://www.brightcopy.net/allen/aesm/32-9
http://www.brightcopy.net/allen/aesm/32-11
http://www.brightcopy.net/allen/aesm/32-8
http://www.brightcopy.net/allen/aesm/32-7s
http://www.brightcopy.net/allen/aesm/32-7
http://www.brightcopy.net/allen/aesm/32-6
http://www.brightcopy.net/allen/aesm/32-5
http://www.brightcopy.net/allen/aesm/32-4
http://www.brightcopy.net/allen/aesm/32-3
http://www.brightcopy.net/allen/aesm/32-2
http://www.brightcopy.net/allen/aesm/32-1
http://www.brightcopy.net/allen/aesm/31-12
http://www.brightcopy.net/allen/aesm/31-11s
http://www.brightcopy.net/allen/aesm/31-11
http://www.brightcopy.net/allen/aesm/31-10
http://www.brightcopy.net/allen/aesm/31-9
http://www.brightcopy.net/allen/aesm/31-8
http://www.brightcopy.net/allen/aesm/31-7
https://www.nxtbookmedia.com