Method and apparatus for improving ADS-B security

Abstract

Security of ADS-B transmissions is improved in a first embodiment to detect position spoofing. The annunciated position source may then be compared with the derived source and a determination is made regarding the difference between the results. Any position difference greater than an amount significantly greater than the combination of the error sources is then a cause for concern and can be used to generate an alert. In a second embodiment, alerting may be based on identification spoofing. From these sources a correlated ID is available which will have an associated confidence based on the number of sources and the level of agreement on the information. Aircraft dynamics may be correlated with the announced ID for consistency. A priori information on the aircraft and location, such as schedule information, and normal operations, may be used to assist in the confidence of aircraft identity. In a third embodiment, alerting may be based on spoofing of identity and position.

Description

FIELD OF THE INVENTION

The present invention relates to a Method and Apparatus to improve ADS-B Security. In particular, the present invention relates to techniques for using other data sources to validate the annunciated position of an aircraft and validate the annunciated identity of an aircraft as reported by ADS-B.

BACKGROUND OF THE INVENTION

Automatic Dependent Surveillance (ADS), a new standard adopted by many aviation authorities worldwide offers a great leap forward in aircraft surveillance capabilities. More information is made available than before with conventional primary and secondary radar technologies, and as ADS-B does not require major conventional radar ground infrastructure, the cost of implementation is far lower than Prior Art techniques.

Whether ADS will allow the decommissioning of primary conventional radars is the subject of many ongoing debates. However, most nations see the benefits in the implementation of a relatively low cost flight tracking technology. Countries with vast tracts of land or mountainous terrain that is not viable for conventional radar see the technology as highly cost beneficial.

Countries ranging from Australia to Taiwan have adopted ADS-B technology. Many working groups consisting of members of the international aviation community have participated in the development of many aircraft avionics and ground systems standards, for example RTCA Special Committee 186, which developed the ADS-B MASPS. A selection of some of the Committee's issue papers are listed below, and incorporated herein by reference. Additional papers, on the subject are available from http://adsb.tc.faa.gov/RFG.htm, also incorporated herein by reference.

The aforementioned Issue Papers, all of which are incorporated here by reference:

File Name (*.PDF)	Size	Date	Status	Description
ASA-ASAS-Issue-	1.5 m	Nov. 23, 2004	—	ZIP file containing all submitted issue
Papers.zip				papers (1–20)
Blank ASAS Issue	8 k	—	—	Blank submission form
Paper.zip
IP01 TCAS ASA	14 k	Apr. 23, 2003	Withdrawn	TCAS Platform Usage
MASPS Issue
IP02 Degraded Target	16 k	Apr. 23, 2003	Closed	Degraded Target Utility Indicator
Utility Indicator
IP03 ASSAP	19 k	Apr. 23, 2003	Closed	Specifications are needed for ASSAP
Ownship Data				processing of Ownship data and
Processing				interfaces from ASSAP to the ADS-B
				transmitting subsystem
IP04 Unknown SIL	15 k	Apr. 23, 2003	Open	Legacy GPS Systems are unable to
				provide values for SIL
IP05 Application	38 k	Apr. 23, 2003	Deferred	Recommendations for changing the
Names and Acronyms				naming and acronym conventions for
				Airborne Surveillance Applications.
IP06 Minimum Data	17 k	Apr. 23, 2003	Closed	Cautions against placing minimum
Quality Requirements				output requirements on ADS-B data.
IP07 Enhanced SIL	21 k	Apr. 23, 2003	Closed	Requests that SIL definitions be
Bit Definitions				extended to include intermediate values
				than those specified in DO-242A.
IP08 CDTI - Ownship	59 k	Apr. 23, 2003	Open	Proposal to address CDTI display
Directionality				requirements when ownship loses its
				directionality information.
IP09 CDTI - Display	54 k	Apr. 23, 2003	Open	Proposal for how CDTI symbology
of Position				might represent position uncertainty.
Uncertainty
IP10 CDTI - Altitude	15 k	Jun. 18, 2003	Open	Requests clarification on best choice of
Usage				altitude source (i.e. baro vs. geo) for
				determining relative and absolute
				altitude of displayed CDTI traffic.
IP11 ASA -	64 k	Jan. 13, 2004	Pending	Identification of an inconsistency of
Continuity in Tables				continuity requirements between Tables
2–3 & 3–1				2–3 and 3–1 in ASA MASPS.
IP12 ASA - Air-	66 k	Jan. 13, 2004	Pending	Problems with ASA MASPS air/Ground
Ground				determination when A/V has no
Determination				automatic detection means.
IP13 ASSAP - TIS-B	58 k	Feb. 13, 2004	Pending	Request to coordinate with WG2 that the
Registration				TIS-B MASPS requires the appropriate
				registration functions between ADS-B
				and ground sensors such as SSR.
IP14 STP - Velocity	64 k	Sep. 10, 2004	Pending	Proposal for new ADS-B field to convey
Lag Indicator				velocity tracker lag.
IP15 ASA - ADS-B	66 k	Sep. 10, 2004	Pending	Question as to whether there needs to be
OUT Power Switch				a requirement for ADS-B Out systems to
				have an ON/OFF switch available to the
				pilot
IP16 ASA - Surface	58 k	Sep. 01, 2004	Pending	Problem of Surface Vehicles which
Vehicles in Tunnels				operate on in tunnels under runways and
				taxiways. How do Aircraft track these
				vehicles without placing them on the
				runways or taxiways?
IP17 CDTI - ADS-B	25 k	Nov. 03, 2004	Open	Summation of issue of whether or not
TCAS Symbol				CDTI should introduce directionality
Directionality				indication onto TCAS targets.
IP18 CDTI - Velocity	718 k	Nov. 03, 2004	Open	Summation of issues related to using
Vector Issues				velocity vectors for CDTI targets.
IP19 ASSAP -	17 k	Nov. 02, 2004	Pending	Since there is no means on the receive
Received NUC means				side to determine if transmitting DO-260
Integrity unknown				compliant systems are also TSO C166
				compliant, integrity must be assumed to
				be ZERO for received data.
IP20 ASSAP - Limit	18 k	Nov. 02, 2004	Pending	NIC & NAC values of 9 or greater are
of NIC & NAC to 8				defined with vertical considerations.
or less				Since initial STP MOPS will not address
				these factors, ASSAP must not use
				values greater than 8 for these fields.

The FAA has also successfully used ADS-B in a program called CAPSTONE, (See, http://www.alaska.faa.gov/capstone/, incorporated herein by reference). The Taiwan CAA started a combined ADS-B and multilateration program in the past few years as detailed on the website: http://www.caa.gov.tw/files/org/CNS_ATMSite/Surveillance.htm, also incorporated herein by reference.

The Taiwan CAA website contains a good description of ADS-C. The website explains that in order to meet the ADS operational requirements, the following four types of contract are supported. The first is the Demand contract 150, in which an aircraft provides data immediately and only once illustrated in FIG. 1, (ADS-C demand contract model). Referring to FIG. 1, control center 140 may send a request 110 for a transmission to aircraft 120. This request 110 may include a transmission number and transmission time (current time). The request is generally sent once only. In response to the request 110, aircraft 120 sends a message transmission 130 which may include aircraft identification and location data and an end of transmission signal. The control center 140 may then use this information to update aircraft position information on a control screen or the like, or for other purposes.

The second type of contract is the Periodic contract 250, in which an aircraft provides data periodically as shown in FIG. 2 (ADS-C periodic contract model). Referring to FIG. 2, control center 240 may send a request 210, which includes a transmission interval of X minutes, to aircraft 220. Aircraft 220 then sends a reply transmission 232 and then after the X minute (or other time interval) a second transmission 234, and a third transmission 236, and so forth. Each transmission 232, 234, 236, et al. may include aircraft identification and position information as well as other aircraft information. The control center 240 may then use this information to update aircraft position information on a control screen or the like, or for other purposes.

The third type of contract is the Event contract, in which an aircraft provides information when certain events are detected by aircraft avionics as shown in FIG. 3 (ADS-C event contract model). In the Event contract, a transmission may be generated by the aircraft whenever one or more events occurs. Examples of such events may include a way point change 310, in which the aircraft passes through a waypoint and/or heads toward another waypoint on an airchart. Another event example may include a speed change 320 in which the aircraft velocity changes (in this example from mach 0.82 to Mach 0.78). A third example is an altitude change, in which an aircraft changes from a particular latitude or from an assigned altitude. A fourth example is a heading/track change, in which an aircraft changes from a particular heading or predetermined track. These four examples of events are not inclusive, and other events may be used to trigger event reporting.

The fourth type of contract is the Emergency contract, in which an aircraft provides data, in the case of an emergency. In this type of contract, a transmission is generated if one or more emergency conditions are triggered, including automatically determined emergency conditions (loss of cabin pressure, engine out, or the like) and pilot indicated emergencies.

With ADS-B, the aircraft transmits aircraft parameters derived from an on-board navigation system via a broadcast data link to other aircraft or the ground control stations, and can be used to monitor the airport surface status as illustrated in FIG. 4 (ADS-B application). Referring to FIG. 4, aircraft 420 may derive position information from signals received from (for example) global positioning system satellite 460. When interrogated by air traffic radar 445 or in response to other indicia, aircraft 420 may emit transponder data (e.g., identification and/or altitude data and/or other data), which may be received by radar 445 such that Air Traffic Management center 440 may track the aircraft.

In addition, aircraft 420 may emit an ADS-B signal, which may be received by antenna 470 and/or other aircraft 425. ADS-B data may include information as to aircraft position and altitude, aircraft identification, and other data. This data may be used to identify and track aircraft and also provide other features, such as collision avoidance.

ADS-B signals may also be multilaterated by measuring the time difference of arrival (TDOA) at multiple antenna sites 470 to indicate aircraft position. The assignee of the present application has developed a number of techniques for implementing such multilateration, as described in the various Patents and applications previously incorporated by reference.

Other aviation authorities have also embraced the use of wide area multilateration coupled with ADS-B, including Austrocontrol as discussed in Aviation Week and Space Technology, Mar. 7, 2005, page 44-45, incorporated herein by reference. Some detractors of the technology have raised security concerns, such as Darryl Phillips, who wrote and distributed ADS-B, Automatic Dependent Surveillance—Broadcast Will ADS-B Increase Safety and Security for Aviation? first written in March 1999, revised July 2000 , by Darryl H. Phillips, AirSport Corporation, 1100 West Cherokee, Sallisaw Okla. 74955. See, http://www.airsport-corp.com/adsb2.htm, also incorporated herein by reference.

Other companies have also raised some security concerns and have come up with various solutions including secure communications links. See, for example Published U.S. Patent Application Publication No. 20040086121, entitled Secure Automatic Dependent Surveillance, also incorporated herein by reference. Others have attempted to develop methods to fuse data from disparate sources, attempting to build high confidence or “robust” data fusion processes, as illustrated for example in Published U.S. Patent Application Publication No. 20040130479, also incorporated herein by reference.

Another security concern is the prevention of a pilot (or terrorist) turning off the ADS-B transponder, as was the case with the hijacked aircraft on Sep. 11, 2001. This has lead to many methods such as Published U.S. Patent Application Publication Nos. 20040148067 and 20030060941, entitled Uninterruptible ADS-B System for Aircraft Tracking, both of which are incorporated herein by reference.

U.S. Pat. App 20030193409 describes a method and apparatus for tracking aircraft and securing against unauthorized access. This approach uses the aircraft's derived surveillance information in conjunction with GIS data to determine if an aircraft is off course. Other methods include building confidence levels in target positions using correlation techniques, such as that described in Published U.S. patent application No. 20030154018, entitled Multi-source target correlation, incorporated herein by reference.

As noted in the references cited above, the threat of ADS-B spoofing is of concern to many parties. Altering the existing ADS-B infrastructure to prevent such spoofing would require extensive investment in revising existing infrastructure and also changing out ADS-B equipment in existing aircraft. Such a radical overhaul of the ADS-B system is not cost-effective or practical. A technique for detecting ADS-B spoofing which is independent of ADS-B systems is required.

The assignee of the present application has developed an array of equipment and software and systems for tracking and identifying aircraft based upon multilateration—using aircraft radio signals to detect position and identification of an aircraft. As multilateration moved from an airport-based system to off airport applications such as wide area it became necessary to find sites off-airport to place the sensors. Off airport sites needed to have power, telecommunication, security and the ability to position antennas at reasonable heights to overcome obstructions to achieve line of site to aircraft.

In some of the earlier sites, such as T.F. Green airport in Providence, R.I. and Hyannis Airport in Barnstable, Mass., off airport sites included tops of various buildings, and Government owned communication towers. Because of the nature of the equipment at that time including the frequency use and large physical size and architecture it was not thought practical that commercial cell phone towers could be used.

SUMMARY OF THE INVENTION

The present invention includes a number of embodiments for improving security of ADS-B transmissions. In a first embodiment, alerting is based on position spoofing. Annunciated position may be provided from various implementations of ADS-B such as the Universal Access Transceiver (UAT), VHF Data Link (VDL), and 1090 MHz ADS-B. Sources such as wide area multilateration, primary and Secondary Surveillance Radar (SSR), conventional rotating radar, and passive radar, such as the Megadata PASSUR (www.megadata.com), may provide derived position.

The annunciated positions may be correlated through a Traffic Information Service Broadcast (TIS-B) system. The annunciated position source may then be compared with the derived source and a determination is made regarding the difference between the results. A nominal difference is expected between the two results as each source has different error sources, which are generally known and are estimable.

Any position difference greater than an amount significantly greater than the combination of the error sources is then a cause for concern and can be used to generate an alert. Averaging of several results may be used to increase confidence in an alert state. Alerts may then be sent to the aircraft, other aircraft, ground positions, and other third parties for interception or targeting.

In a second embodiment, alerting may be based on identification spoofing. Many different sources of the aircraft's ID are shown, ranging from surveillance sources (radar, ADS-B, and the like) and communications sources (ACARS, CPDLC, and the like). Each of these sources offers some of form of identity for the aircraft, be it Mode S/ADS-B 24 bit codes, ATC flight number, or flight number. From these sources a correlated ID is available which will have an associated confidence based on the number of sources and the level of agreement on the information.

Added to this are the dynamics of the aircraft, which include the velocity, flight level, vertical descent/ascent rates, and the like. The aircraft dynamics may be correlated with the announced ID for consistency, for example certain aircraft are capable of operating only at certain flight levels or velocities. Aircraft dynamics are computed from the various surveillance sources.

Add to this, a priori information on the aircraft and location, such as schedule information, and normal operations, to give a further layer of data, which may be used to assist in the confidence of aircraft identity.

In a third embodiment, alerting may be based on spoofing of identity and position. In this embodiment, a combination of the elements of first and second embodiments are used to give a high confidence alert that a particular aircraft is announcing an incorrect identity, position, or both.

All embodiments may be implemented using stand-alone equipment, which does not require an overhaul or modification of existing ADS-B equipment, either on the ground or on the aircraft. This equipment may be mounted at an airport, or even off-site. Through equipment redesign to conform with cell tower use, loading, and other factors, multilateration sensor equipment was approved for installation on cell towers, which, due to their high number and availability, made for a very practical way to set up surveillance network of multilateration and ADS-B sensors.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram illustrating the ADS-C demand contract model.

FIG. 2 is a block diagram illustrating the ADS-C periodic contract model.

FIG. 3 is a block diagram illustrating the ADS-C event contract model.

FIG. 4 is a block diagram illustrating ADS-B Applications.

FIG. 5 illustrates a first embodiment of the present invention.

FIG. 6 illustrates an embodiment to determine spoofing of aircraft identity.

DETAILED DESCRIPTION OF THE INVENTION

In a first embodiment, alerting may be triggered based upon position spoofing. Referring to FIG. 5, the embodiment shows the aircraft tracking data sources 510, 515, 520, 525, 530, and 535 on the left side, where the top three (510, 515, and 520) are derived position and the bottom three (525, 530, 535) are annunciated position. MLAT data source 510 may include aircraft position data generated from an aircraft radio signal multilateration system as described, for example, in the aforementioned Patents and pending Patent Applications previously incorporated by reference, from which the present application claims priority in whole or part.

Annunciated position 555 may be obtained from various implementations of ADS-B such as the Universal Access Transceiver (UAT) 525, VHF Data Link (VDL) 530, and 1090 MHz ADS-B 535, collectively labeled as TIS-B 540. Derived position 545 may be obtained from sources such as wide area multilateration 510, primary and Secondary Surveillance Radar (SSR) 515, conventional rotating radar, and passive radar 510, such as the Megadata PASSUR (www.megadata.com).

Annunciated position 555 may be correlated through a Traffic Information Service Broadcast (TIS-B) system. The annunciated position source may then be compared 550 with the derived source and a determination is made regarding the difference between the results.

A nominal difference 560 may be expected between the two results as each source has different error sources and ranges, which are generally known and are estimable. Any difference significantly greater than the combination of the error sources is then a cause for concern and can be used to generate an alert 565. Averaging of several results may be used to increase confidence in an alert state.

Alerts may then be sent to the aircraft, other aircraft, ground positions, and other third parties for interception or targeting.

FIG. 6 illustrates a second embodiment of the present invention in which alerting may be triggered by identification spoofing. On the left many different sources of the aircraft's ID are shown, ranging from surveillance sources such as radar, ADS-B, and the like, as represented by 610, 5215, 620, 625, 630, and 635 and communications sources such as ACARS 605, CPDLC 695 and the like. Each of these sources offers some of form of identity for the aircraft, be it Mode S/ADS-B 24 bit codes, ATC flight number, or flight number. Aircraft identification may be obtained from various implementations of ADS-B such as the Universal Access Transceiver (UAT) 625, VHF Data Link (VDL) 630, and 1090 MHz ADS-B 635, primary and Secondary Surveillance Radar (SSR) 615, conventional rotating radar, and passive radar 610, such as the Megadata PASSUR (www.megadata.com), collectively labeled as TIS-B 640.

From these sources a correlated ID 645 may be derived which will have an associated confidence based on the number of sources and the level of agreement on the information.

Added to this is the dynamics of the aircraft 670, which is the velocity, flight level, vertical descent/ascent rates and the like. Aircraft dynamics 670 may be correlated with the announced ID 645 for consistency, for example certain aircraft are capable of operating only at certain flight levels or velocities or the like. A Cessna 150 is not going to operate at 35,000 feet, for example, and if aircraft identification data indicates such a discrepancy, the aircraft dynamics module 670 of the present invention will detect such an anomaly in the data. Similarly, if the ADS-B signal from a helicopter indicates that it is in fact a 747, the system may detect such spoofing, if the system shows the helicopter hovering (as determined by position data), a feat impossible for a 747.

Aircraft dynamics may be computed from the various surveillance sources shown on the left of the diagram, and aircraft performance criteria may be manually programmed or retrieved from a number of known aircraft performance databases. Various aircraft performance indicia may include minimum (stall) and maximum (V_NE) velocities, climb rates, maximum altitude (ceiling), as well as other performance characteristics.

Add to this, a priori information 675 on the aircraft and location, such as schedule information, and normal operations, to give a further layer of data that can be use to assist in the confidence of an aircraft's identity. For example, if an aircraft is scheduled to arrive at a particular airport, based upon airline flight schedule information, and the system shows this aircraft arriving at a different airport, identification of the aircraft may be in doubt.

Compare function 650 weights these factors together—the ID confidence 645, as well as the aircraft dynamics 670 and a priori data 675 (collectively derived ID 655). Weighting factors may be used to determine whether an alert 665 should be generated.

In a third embodiment, alerting may be based on spoofing of both identity and position. It is possible to implement an embodiment that uses a combination of the elements of both the first and second embodiments of FIGS. 5 and 6 to give a high confidence alert that a particular aircraft is announcing an incorrect identity, position, or both. In this third embodiment, weighting factors may be applied to each data source and moreover, to each comparison of data sources (or groups of sources). If a number of discrepancies occur, an alert may be generated.

For example, from a priori data, it may be indicated that a flight scheduled to land at Washington National Airport is in fact, landing at Dulles Airport. Of course, such a discrepancy could occur due to weather conditions, mechanical problems, closed runways, or any number of legitimate reasons. The lack of correlation of a priori data may or may not be grounds for generating an alert.

Similarly, position errors can occur due to perfectly innocent causes. For example, if transponder barometric calibration is not properly set, an aircraft may report an incorrect altitude, which when compared to other data may show a discrepancy. Depending upon weighting factors, this error alone may not be enough to trigger an alarm.

However, if this a priori data indicates a discrepancy, and a position error is detected between reported and actual position, an alarm may be generated. This scenario is by way of example only and is not limiting. Weighting factors and combinations of alarm indicia can be fine-tuned dynamically or in the field depending upon the number of false alarms generated and based upon actual experience in the field.

By using data fusion processes pioneered by the Rannoch Corporation, assignee of the present application, the perceived problem of ADS-B and/or other identity spoofing, as described in the Background of the Invention, can be solved. Moreover, since the present invention does not require any changes to existing aircraft equipment or ADS-B infrastructure, the present invention addresses these security concerns without disrupting the existing ADS-B system.

As noted above, the equipment of the present invention may be installed at an airport or even off-site. Multilateration antennas may be adapted for use on cell phone towers to make installation even simpler. As such, a system can be easily and inexpensively installed to detect ADS-B spoofing and thus prevent or at least warn of the nightmare scenarios described in the Prior Art with regard to possible terrorist use of ADS-B spoofing to conceal true aircraft identity and position.

While the preferred embodiment and various alternative embodiments of the invention have been disclosed and described in detail herein, it may be apparent to those skilled in the art that various changes in form and detail may be made therein without departing from the spirit and scope thereof.

Claims

1. A system for authenticating position signals of an aircraft, comprising: a first input for receiving an annunciated aircraft position from at least one aircraft generated source, the annunciated aircraft position indicating an annunciated position of the aircraft,a second input for receiving a derived aircraft position from a non-aircraft generated source, indicating position of the aircraft,a comparator, for comparing the annunciated aircraft position with the derived aircraft position and generating an alarm if the annunciated aircraft position is not within a predetermined range of the derived aircraft position.

2. The system of claim 1, wherein the aircraft generated source includes one or more of ADS-B such as the Universal Access Transceiver (UAT), VHF Data Link (VDL), and 1090 MHz ADS-B.

3. The system of claim 1, wherein the non-aircraft generated source includes one or more of a multilateration system, primary and Secondary Surveillance Radar (SSR), conventional rotating radar, and passive radar.

4. The system of claim 1, wherein annunciated positions may be correlated through a Traffic Information Service Broadcast (TIS-B) system.

5. The system of claim 1, wherein the predetermined range is derived from a combination of the error sources for the annunciated position source and the derived position sources.

6. The system of claim 3, wherein the multilateration system includes a plurality of antennas, at least some of which are mounted to cellular phone towers.

7. A system for authenticating aircraft identification signals of an aircraft, comprising: a first input for receiving an annunciated aircraft identification from at least one aircraft generated source, indicating identification of at least one of aircraft type, aircraft identification, flight identification, and aircraft performance, for the aircraft,a second input for receiving a derived aircraft identification from a non-aircraft generated source, indicating identification of at least one of aircraft type, aircraft identification, flight identification, and aircraft performance,a comparator, for comparing the annunciated aircraft identification with the derived aircraft identification and generating an alarm if the annunciated aircraft identification is not within a predetermined range of the derived aircraft identification.

8. The system of claim 7, wherein the aircraft generated source includes one or more of ADS-B such as the Universal Access Transceiver (UAT), VHF Data Link (VDL), and 1090 MHz ADS-B.

9. The system of claim 7, wherein the non-aircraft generated source includes one or more of a multilateration system, primary and Secondary Surveillance Radar (SSR), conventional rotating radar, and passive radar.

10. The system of claim 7, wherein annunciated identifications may be correlated through a Traffic Information Service Broadcast (TIS-B) system.

11. The system of claim 7, wherein aircraft performance comprises dynamics of the aircraft, which include one or more of minimum and maximum velocities, flight levels, and vertical descent/ascent rates.

12. The system of claim 7, wherein flight identification includes schedule information.

13. The system of claim 9, wherein the multilateration system includes a plurality of antennas, at least some of which are mounted to cellular phone towers.