Aerospace and Electronic Systems Magazine November 2017 - 56

ADS-B Vulnerabilities and a Security Solution with a Timestamp
messages. (There are only 650 ADS-B ground stations in the U.S.
and the distance from the UAS to the ground stations may be dozens
of miles.) Conventional radar systems cannot track them effectively
either. UASs also fly shorter distances and more densely populated
in the airspace than their manned counterparts, potentially as close
as hundreds of feet. Therefore, a more fine-grain control and more
frequent location update are necessary for their traffic control. However, ADS-B ground stations are intended only for high-flying commercial aircraft and are too sparsely located for UAS. Their purpose
is to separate aircraft by 5 to 10 nautical miles, not hundreds of feet
as required in UTM. Thus, it is difficult to use multiple ground stations for UASs with low-power ADS-B transmitters. Furthermore,
the rebroadcast scheme also introduces a further delay, which is not
desirable for UASs flying in close proximity.
To cope with the special requirements in UTM, we need an
onboard ADS-B verification method that can immediately filter
out attack messages without being dependent on expensive and/or
bulky hardware. For BVLOS operation of UAS, we cannot allow
a high false positive or false negative ratio due to a high collision
risk, which requires a very reliable method.

OUR PROPOSED METHOD: ADS-BT
THE BASIC CONCEPT
A radio wave travels at a constant speed, i.e., at the speed of light.
Therefore, for a given distance, the time-of-flight can be precisely
determined. Since all ADS-B frames contain the sender's GPS
coordinates, we can calculate the corresponding time-of-flight
between the sender and receiver. In a naïve approach, we can compare the following two and check if there is any discrepancy.
1. Observed time-of-flight: Time at sender (ts) → Time at receiver
(tr)
2. Calculated time-of-flight from GPS coordinates: Location at
sender (ls) → Location at receiver (lr)
If they don't match, the ADS-B frame may have been spoofed.
However, because of the internal processing time and various errors, the time-of-flight values may not match. As each ADS-B device has different operating characteristics, the internal processing
time is different for each device. So, the time-of-flight comparison
alone cannot be used for identifying a spoofed ADS-B message
and we will need a more elaborate approach. Our method is based
on the premise that an attacker can spoof the GPS coordinates in
the ADS-B messages but not the time-of-flight correctly in multiple frames. Out of the four input data above, the time at sender
(ts) is currently not available in ADS-B, so Automatic Dependent
Surveillance-Broadcast with Timestamp (ADS-BT) introduces a
new timestamp field to record the time of transmission.

DETECTING ATTACK

ADS-B frame transmission.

frames, it will be ignored. Second, the locations in those frames
must follow a reasonable path. If the locations are random, the
frames can be easily rejected.
In a legitimate ADS-B transmission, an ADS-B device receives
the GPS signal, calculates the current location, encodes the ADS-B
data, creates the message frame, and transmits it over the air. Let
Tsender be the time for this internal processing, i.e., from the time of
GPS signal reception to the time of departure for the ADS-B message. The time to reach the destination is denoted by Tpropagation (see
Figure 3). In other words, the total transmission delay (Ttransmission)
is defined as,
Ttransmission = Tsender + Tpropagation
Figure 4 shows a situation with two legitimate aircraft. Let Ls1
be the sender's current location, and Lr1 be the receiver's location.
The propagation delay in seconds for the distance (Ls1, Lr1) in meters is determined as,
Tpropagation ( Ls1 , Lr1 ) = dist ( Ls1 , Lr1 ) / 299,792, 458

Let ts1 be the GPS data reception time at location Ls1, and tr1 be
the ADS-B reception time at Lr1. Then,
tr1 - ts1 = Tsender ( Ls1 ) + Tpropagation ( Ls1 , Lr1 )

Therefore, the unknown value, Tsender (Ls1), can be calculated
trivially. For subsequent pairs of locations, (Ls2, Lr2), (Ls3, Lr3), etc.,
we observe a similar relationship as,
tr 2 - ts 2 = Tsender ( Ls 2 ) + Tpropagation ( Ls 2 , Lr 2 )
tr 3 - ts 3 = Tsender ( Ls 3 ) + Tpropagation ( Ls 3 , Lr 3 )

For all ADS-B frames from a specific ADS-B Out device (i.e.,
having the same aircraft ID), the Tsender value should be relatively
stable, so we get,
Tsender ( Ls1 ) ≈ Tsender ( Ls 2 ) ≈ Tsender ( Ls 3 ) ≈ ...

There are a few assumptions about the attacks. First, the attacker
needs to send multiple ADS-B frames with the same aircraft ID because if just one ADS-B frame is received without any subsequent
56

Figure 3.

If Tsender values fluctuate beyond a tolerance range, we can infer
that the data in the ADS-B message is wrong. Why does it fluctu-

IEEE A&E SYSTEMS MAGAZINE

NOVEMBER 2017

Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine November 2017