Aerospace and Electronic Systems Magazine November 2017 - 57

Kim, Jo, and Lee

Figure 4.

Figure 5.

ate under attack? Figure 5 shows a situation with one legitimate
aircraft and one spoofed aircraft.
In Figure 5, an attacker creates a fake path and broadcasts its
fake locations, s1, s2, s3, etc. A legitimate aircraft is receiving the
fake messages at locations, r1, r2, r3, etc. Let a1 be the attacker's
true but unknown location, and we assume that the attacker inserts
the timestamp values observed at his true location. When a legitimate aircraft receives these bogus messages, it tries to confirm the
propagation delays as usual.

of-flight based on the locations (Ls1, Lr1). As both are impossible
physically, we can immediately reject them.

Time-of-flight for ADS-B signal.

Spoofed flight path.

tr1 - ts1 = Tsender ( Ls1 ) + Tpropagation ( Ls1 , Lr1 )

Case 2) tr1 - ts1 > Tsender (Ls1 ) + Tpropagation (Ls1 , Lr1 )
Let us define the rates of change for the distances in two ADS-B
frames, one for true distances (CRs) and the other for fake distances
(CRa). Except for some special cases, they are different.
T
( L , L ) T
( L , L )
CRs =   propagation s 2 r 2 ≠   propagation a 2 r 2  = CRa
Tpropagation ( Ls1 , Lr1 ) Tpropagation ( La1 , Lr1 )
Since CRa is what is actually observed, the following relationship holds for the second ADS-B frame.

tr 2 - ts 2 = Tsender ( Ls 2 ) + Tpropagation ( Ls 2 , Lr 2 )

But since the attacker's true location is a1, the observed relationships are,
tr1 - ts1 = Tsender ( La1 ) + Tpropagation ( La1 , Lr1 )

tr 2 - ts 2 = Tsender ( La1 ) + Tpropagation ( La 2 , Lr 2 )

= Tsender ( La1 ) + Tpropagation ( La1 , Lr1 ) × CRa

However, the receiving airplane believes that the message is
coming from Ls2, and observes the following discrepancy in the
second frame.

tr 2 - ts 2 = Tsender ( La1 ) + Tpropagation ( La1 , Lr 2 )

tr 2 - ts 2 = Tsender ( Ls 2 ) + Tpropagation ( Ls 2 , Lr 2 )

= Tsender ( Ls1 ) + Tpropagation ( Ls1 , Lr1 ) × CRs

Since the locations Ls1 and La1 are different, we get

≠ Tsender ( Ls1 ) + Tpropagation ( Ls1 , Lr1 ) × CRa

tr1 - ts1 ≠ Tsender ( Ls1 ) + Tpropagation ( Ls1 , Lr1 )
tr 2 - ts 2 ≠ Tsender ( Ls 2 ) + Tpropagation ( Ls 2 , Lr 2 )

There are special situations where the attacker can be at a location with the same distance as the spoofed aircraft, but we will
ignore them for now. This discrepancy leads us to two cases.

Case 1) tr1 - ts1 < Tsender (Ls1 ) + Tpropagation (Ls1 , Lr1 )
In this case, either the calculated Tsender value is negative and/or the
actual time-of-flight (= tr1 - ts1) is shorter than the calculated timeNOVEMBER 2017

In reality, the victim airplane does not know CRa or the location of the attacker. All it can observe are tr2, ts2, Tpropagation (Ls1, Lr1),
and Tpropagation (Ls2, Lr2). The only unknown values are Tsender, and the
discrepancy is manifested as an abnormal change in Tsender values.
So, in the case of an attack, we observe
Tsender ( Ls1 ) ≠ Tsender ( Ls 2 ) ≠ Tsender ( Ls 3 ) ≠ ...

A clever attacker may try to spoof the timestamp values to make
the Tsender values appear constant on the receiver side. He can get the
victim's flight path from the victim's ADS-B messages and calculate
the time-of-flight between the fake location and the victim's new

IEEE A&E SYSTEMS MAGAZINE

57



Table of Contents for the Digital Edition of Aerospace and Electronic Systems Magazine November 2017

No label
Aerospace and Electronic Systems Magazine November 2017 - No label
Aerospace and Electronic Systems Magazine November 2017 - Cover2
Aerospace and Electronic Systems Magazine November 2017 - 1
Aerospace and Electronic Systems Magazine November 2017 - 2
Aerospace and Electronic Systems Magazine November 2017 - 3
Aerospace and Electronic Systems Magazine November 2017 - 4
Aerospace and Electronic Systems Magazine November 2017 - 5
Aerospace and Electronic Systems Magazine November 2017 - 6
Aerospace and Electronic Systems Magazine November 2017 - 7
Aerospace and Electronic Systems Magazine November 2017 - 8
Aerospace and Electronic Systems Magazine November 2017 - 9
Aerospace and Electronic Systems Magazine November 2017 - 10
Aerospace and Electronic Systems Magazine November 2017 - 11
Aerospace and Electronic Systems Magazine November 2017 - 12
Aerospace and Electronic Systems Magazine November 2017 - 13
Aerospace and Electronic Systems Magazine November 2017 - 14
Aerospace and Electronic Systems Magazine November 2017 - 15
Aerospace and Electronic Systems Magazine November 2017 - 16
Aerospace and Electronic Systems Magazine November 2017 - 17
Aerospace and Electronic Systems Magazine November 2017 - 18
Aerospace and Electronic Systems Magazine November 2017 - 19
Aerospace and Electronic Systems Magazine November 2017 - 20
Aerospace and Electronic Systems Magazine November 2017 - 21
Aerospace and Electronic Systems Magazine November 2017 - 22
Aerospace and Electronic Systems Magazine November 2017 - 23
Aerospace and Electronic Systems Magazine November 2017 - 24
Aerospace and Electronic Systems Magazine November 2017 - 25
Aerospace and Electronic Systems Magazine November 2017 - 26
Aerospace and Electronic Systems Magazine November 2017 - 27
Aerospace and Electronic Systems Magazine November 2017 - 28
Aerospace and Electronic Systems Magazine November 2017 - 29
Aerospace and Electronic Systems Magazine November 2017 - 30
Aerospace and Electronic Systems Magazine November 2017 - 31
Aerospace and Electronic Systems Magazine November 2017 - 32
Aerospace and Electronic Systems Magazine November 2017 - 33
Aerospace and Electronic Systems Magazine November 2017 - 34
Aerospace and Electronic Systems Magazine November 2017 - 35
Aerospace and Electronic Systems Magazine November 2017 - 36
Aerospace and Electronic Systems Magazine November 2017 - 37
Aerospace and Electronic Systems Magazine November 2017 - 38
Aerospace and Electronic Systems Magazine November 2017 - 39
Aerospace and Electronic Systems Magazine November 2017 - 40
Aerospace and Electronic Systems Magazine November 2017 - 41
Aerospace and Electronic Systems Magazine November 2017 - 42
Aerospace and Electronic Systems Magazine November 2017 - 43
Aerospace and Electronic Systems Magazine November 2017 - 44
Aerospace and Electronic Systems Magazine November 2017 - 45
Aerospace and Electronic Systems Magazine November 2017 - 46
Aerospace and Electronic Systems Magazine November 2017 - 47
Aerospace and Electronic Systems Magazine November 2017 - 48
Aerospace and Electronic Systems Magazine November 2017 - 49
Aerospace and Electronic Systems Magazine November 2017 - 50
Aerospace and Electronic Systems Magazine November 2017 - 51
Aerospace and Electronic Systems Magazine November 2017 - 52
Aerospace and Electronic Systems Magazine November 2017 - 53
Aerospace and Electronic Systems Magazine November 2017 - 54
Aerospace and Electronic Systems Magazine November 2017 - 55
Aerospace and Electronic Systems Magazine November 2017 - 56
Aerospace and Electronic Systems Magazine November 2017 - 57
Aerospace and Electronic Systems Magazine November 2017 - 58
Aerospace and Electronic Systems Magazine November 2017 - 59
Aerospace and Electronic Systems Magazine November 2017 - 60
Aerospace and Electronic Systems Magazine November 2017 - 61
Aerospace and Electronic Systems Magazine November 2017 - 62
Aerospace and Electronic Systems Magazine November 2017 - 63
Aerospace and Electronic Systems Magazine November 2017 - 64
Aerospace and Electronic Systems Magazine November 2017 - Cover3
Aerospace and Electronic Systems Magazine November 2017 - Cover4
http://www.brightcopy.net/allen/aesm/34-2s
http://www.brightcopy.net/allen/aesm/34-2
http://www.brightcopy.net/allen/aesm/34-1
http://www.brightcopy.net/allen/aesm/33-12
http://www.brightcopy.net/allen/aesm/33-11
http://www.brightcopy.net/allen/aesm/33-10
http://www.brightcopy.net/allen/aesm/33-09
http://www.brightcopy.net/allen/aesm/33-8
http://www.brightcopy.net/allen/aesm/33-7
http://www.brightcopy.net/allen/aesm/33-5
http://www.brightcopy.net/allen/aesm/33-4
http://www.brightcopy.net/allen/aesm/33-3
http://www.brightcopy.net/allen/aesm/33-2
http://www.brightcopy.net/allen/aesm/33-1
http://www.brightcopy.net/allen/aesm/32-10
http://www.brightcopy.net/allen/aesm/32-12
http://www.brightcopy.net/allen/aesm/32-9
http://www.brightcopy.net/allen/aesm/32-11
http://www.brightcopy.net/allen/aesm/32-8
http://www.brightcopy.net/allen/aesm/32-7s
http://www.brightcopy.net/allen/aesm/32-7
http://www.brightcopy.net/allen/aesm/32-6
http://www.brightcopy.net/allen/aesm/32-5
http://www.brightcopy.net/allen/aesm/32-4
http://www.brightcopy.net/allen/aesm/32-3
http://www.brightcopy.net/allen/aesm/32-2
http://www.brightcopy.net/allen/aesm/32-1
http://www.brightcopy.net/allen/aesm/31-12
http://www.brightcopy.net/allen/aesm/31-11s
http://www.brightcopy.net/allen/aesm/31-11
http://www.brightcopy.net/allen/aesm/31-10
http://www.brightcopy.net/allen/aesm/31-9
http://www.brightcopy.net/allen/aesm/31-8
http://www.brightcopy.net/allen/aesm/31-7
https://www.nxtbookmedia.com