ADS-Bsec: a holistic framework to secure ADS-B

A method of secure Automatic Dependent Surveillance Broadcast (ADS-bsec) in a system comprising one or more senders located on aircraft and at least one receiver located at an Air Traffic Control (ATC) location, the sender performing the steps of;

• receiving inputs from a flight plan and a GPS satellite;
• receiving inputs from an aircraft prediction module from the flight plan and an aircraft profile from an aircraft data database (BADA), wherein the aircraft prediction module infers flight trajectory combining flight path information with the BADA profiles the aircraft prediction module providing input to a security analysis module which also receives input from the GPS satellite;
• receiving from a secure message generator an input from the security analysis module, the secure message generator also receiving an input from a key management module and providing an output to a secure ADS-B sender;
• during flight, cross-checking by the security analysis module geographical coordinates from the predicted trajectory against those obtained from satellites to detect GPS spoofing attacks, encoding valid coordinates in secure ADS-B messages with a hash message authentication code (HMAC) key input from the key management module;
• and
• transmitting the secure ADS-B message by the secure ADS-B sender;
• the receiver performing the steps of:
• communicating with the sender with a security ADS-B receiver for receiving ADS-B messages;
• passing messages received by the secure ADS-B receiver to a security analysis module, which obtains the HMAC key from a key management module and verifies the validity of the HMAC-based metadata;
• providing an input from an aircraft prediction module to the security analysis module, the aircraft Prediction Module, in turn, receiving inputs from a BADA database and the flight plan;
• computing by the security analysis module a predicted position at a time t, obtained from the aircraft prediction module, when verifying whether the location update inferred from the received ADS-B message is within a normal range, erroneous, or a product of a replayed or fake message;
• and
• causing by the security analysis module fraudulent messages to be quarantined in a quarantine database for further analysis;
• otherwise, causing by the security analysis module the location update to be plotted on a radar display of a visualization module.

A secure Automatic Dependent Surveillance Broadcast (ADS-B) system (ADS-Bsec) comprising one or more senders located on aircraft and at least one receiver located at an Air Traffic Control (ATC) location, the sender comprising:

• inputs from a flight plan and a GPS satellite;
• a security analysis module receiving GPS information;
• an aircraft prediction module which provides input to the security analysis module, the aircraft prediction module receives inputs from the flight plan and an aircraft profile from an aircraft data database (BADA), wherein the aircraft prediction module infers flight trajectory combining flight path information with the BADA profiles;
• a secure message generator which receives an input from the security analysis module, the secure message generator also receives an input from a key management module and provides an output to a secure ADS-B sender, wherein during flight, the security analysis module cross-checks geographical coordinates from the predicted trajectory against those obtained from satellites to detect GPS spoofing attacks, valid coordinates are then encoded in secure ADS-B messages with a Hash Message Authentication Code (HMAC) key input from the key management module and transmitted by the secure ADS-B sender;
• the receiver comprising:
• a security ADS-B receiver which communicates with the sender;
• the security analysis module and a quarantine database each receiving inputs from the security ADS-B receiver;
• a key management module which provides an input to the security analysis module, wherein messages received by the secure ADS-B receiver are passed to the security analysis module, which obtains the HMAC key from the key management module and verifies the validity of the HMAC-based metadata, wherein the HMAC-based metadata replaces a cyclic redundancy code (CRC) in the ADS-B packet format;
• an aircraft prediction module providing an input to the security analysis module, wherein the aircraft prediction module, in turn, receives inputs from a BADA database and the flight plan, and wherein a predicted position at a time t, obtained from the aircraft prediction module is also computed by the security analysis module when verifying whether the location update inferred from the received ADS-B message is within a normal range, erroneous, or a product of a replayed or fake message, the security analysis module causing fraudulent messages to be quarantined in the quarantine database for further analysis, otherwise, the location update is plotted on a radar display of a visualization module,
• wherein ADS-Bsec messages are validated in the security analysis module at the receiver either by an aircraft or a ground component by performing the following steps:
• retrieving the ADS-B message, an International Civil Aviation Organization (ICAO) identifier, and a sequence number from the ADS-B message;
• if ADS-B In is deployed, first retrieving seeds from each key chain for a specific time interval, and next computing a group key;
• using Coordinated Universal Time (UTC) to know the seeds to be used in a given time interval;
• if ADS-B In is deployed in ground components, getting the key to be used for air-to-ground message validation;
• creating and/or retrieving two hash-maps, including icao_hashmap and the seq_hashmap, the icao_hashmap using the ICAO identifier as key to create the seq_hashmap as mapped content, the hash-map seq_hashmap using the sequence numbers as key, and the mapped content is a queue containing at most two ADS-B messages having the same sequence numbers;
• using this double-nested hash-map structure to classify the received messages in buckets;
• generating a concatenated string from the payload of the even and odd ADS-B messages located in the same queue;
• in case ADS-B In is deployed on an aircraft, generating group-based metadata before checking it against the ones retrieved from received messages;
• if a match is found, plotting the corresponding location on the radar display;
• otherwise, quarantining corresponding messages;
• if the ADS-B In is deployed on a ground component, using the ground-to-air HMAC key to verify the metadata;
• and
• triggering a timeout in case one or both ADS-B messages in process of being validated are not received.

A method of secure Automatic Dependent Surveillance Broadcast (ADS-bsec) in a system comprising one or more senders located on aircraft and at least one receiver located at an Air Traffic Control (ATC) location, the sender performing the steps of;

• receiving inputs from a flight plan and a GPS satellite;
• receiving inputs from an aircraft prediction module from the flight plan and an aircraft profile from an aircraft data database (BADA), wherein the aircraft prediction module infers flight trajectory combining flight path information with the BADA profiles the aircraft prediction module providing input to a security analysis module which also receives input from the GPS satellite;
• receiving from a secure message generator an input from the security analysis module, the secure message generator also receiving an input from a key management module and providing an output to a secure ADS-B sender;
• during flight, cross-checking by the security analysis module geographical coordinates from the predicted trajectory against those obtained from satellites to detect GPS spoofing attacks, encoding valid coordinates in secure ADS-B messages with a hash message authentication code (HMAC) key input from the key management module, wherein HMAC-based metadata replaces a cyclic redundancy code (CRC) in the ADS-B packet format;
• and
• transmitting the secure ADS-B message by the secure ADS-B sender;
• the receiver performing the steps of:
• communicating with the sender with a security ADS-B receiver for receiving ADS-B messages;
• passing messages received by the secure ADS-B receiver to a security analysis module, which obtains the HMAC key from a key management module and verifies the validity of the HMAC-based metadata;
• providing an input from an aircraft prediction module to the security analysis module, the aircraft Prediction Module, in turn, receiving inputs from a BADA database and the flight plan;
• computing by the security analysis module a predicted position at a time t, obtained from the aircraft prediction module, when verifying whether the location update inferred from the received ADS-B message is within a normal range, erroneous, or a product of a replayed or fake message;
• causing by the security analysis module fraudulent messages to be quarantined in a quarantine database for further analysis, or otherwise, causing by the security analysis module the location update to be plotted on a radar display of a visualization module;
• validating ADS-Bsec messages in the security analysis module at the receiver either by an aircraft or a ground component by performing the following steps:
• retrieving the ADS-B message, an International Civil Aviation Organization (ICAO) identifier, and a sequence number from the ADS-B message;
• if ADS-B In is deployed, first retrieving seeds from each key chain for a specific time interval, and next computing a group key;
• using Coordinated Universal Time (UTC) to know the seeds to be used in a given time interval;
• if ADS-B In is deployed in ground components, getting the key to be used for air-to-ground message validation;
• creating and/or retrieving two hash-maps, namely icao_hashmap and the seq_hashmap, the icao_hashmap using the ICAO identifier as key to create the seq_hashmap as mapped content, the hash-map seq_hashmap using the sequence numbers as key, and the mapped content is a queue containing at most two ADS-B messages having the same sequence numbers;
• using this double-nested hash-map structure to classify the received messages in buckets;
• generating a concatenated string from the payload of the even and odd ADS-B messages located in the same queue;
• in case ADS-B In is deployed on an aircraft, generating group-based metadata before checking it against the ones retrieved from received messages;
• if a match is found, plotting the corresponding location on the radar display;
• otherwise, quarantining corresponding messages;
• if the ADS-B In is deployed on a ground component, using the ground-to-air HMAC key to verify the metadata;
• and
• triggering a timeout in case one or both ADS-B messages in process of being validated are not received.