IEEE Communications Magazine • May 2014 1110163-6804/14/$25.00 © 2014 IEEE

Martin Strohmeier andIvan Martinovic are withthe University of Oxford.

Matthias Schäfer is withthe University of Kaiser-slautern.

Vincent Lenders is witharmasuisse.

1

http://www.eurocontrol.int/sites/default/files/con-tent/documents/official-documents/forecasts/long-term-forecast-2010-2030.pdf.

INTRODUCTION

The air traffic load has experienced tremendousgrowth over the last decade. The reported aver-age number of registered flight movements overEurope is around 26,000 per day. Large Euro-pean airports may spike to more than 1,500 dailytakeoffs and landings. The tendency is stillincreasing and forecasts assume almost a dou-bling of movements between 2009 and 2030.1

With the growing adoption of unmanned arealvehicle (UAV) technology for civil applications,we may even expect a further boost in air trafficover the coming years.

To avoid accidents and collisions in such adense air space, rules and coordination are fun-damental. The worldwide concept for safe navi-gation is based on a combination of mechanismsfor flight separation and collision avoidance.

Scheduled flights are all separated by altitudeand distance from directives by surveillance per-sonel operating on the ground. Each aircraft isfurther responsible to detect and avoid potentialcollisions that may occur despite the allocatedseparation.

A key feature for both separation and colli-sion avoidance is the ability to continuouslylocalize all aircraft in the sky. The traditionalapproach for aircraft localization is to rely onradar systems that were originally developedfor identification, friend or foe (IFF) systemsused in military applications. Such convention-al radar systems can be classified in primarysurveillance radars (PSR) or secondary surveil-lance radars (SSR). PSRs are independent andthey do not require cooperation from the air-craft. They transmit high-frequency signals,which are reflected by the target. By receivingand evaluating the resulting echoes, the range,angular direction, velocity, and even the sizeand shape can be determined. In contrast, SSRrelies on transponders in the aircraft, whichrespond to interrogations from ground sta-tions. The response contains precise aircraftheight information and other information suchas identification codes or information abouttechnical problems which makes it possible tomeet much higher demands on localization,identification, and status reports compared toPSR. Since the surveillance data is derived bythe aircraft itself, SSR is dependent. It alsorequires cooperation from the aircraft to func-tion properly.

An emerging problem with traditional PSRand SSR systems is their relatively low precisionand detection accuracy [1]. The increasing trafficdensity in the sky requires aircraft localizationtechniques that exceed the inherent limits ofthese radar technologies. A new technology forair traffic monitoring that holds the promise toachieve the required precision and that isplanned to replace conventional radar systems isthe Automatic Dependent Surveillance Broad-cast system (ADS-B). The idea of ADS-B is tocombine satellite-based positioning with a radiofrequency (RF) data-link to continuously and

ABSTRACT

Air traffic is continuously increasing world-wide, with both manned and unmanned aircraftlooking to coexist in the same airspace in thefuture. Next generation air traffic managementsystems are crucial in successfully handling thisgrowth and improving the safety of billions offuture passengers. The Automatic DependentSurveillance Broadcast (ADS-B) system is a corepart of this future. Unlike traditional radar sys-tems, this technology empowers aircraft to auto-matically broadcast their locations and intents,providing enhanced situational awareness. Thisarticle discusses important issues with the cur-rent state of ADS-B as it is being rolled out. Wereport from our OpenSky sensor network inCentral Europe, which is able to capture about30 percent of the European commercial air traf-fic. We analyze the 1090 MHz communicationchannel to understand the current state and itsbehavior under the increasing traffic load. Fur-thermore, the article considers important securi-ty challenges faced by ADS-B. Our insights areintended to help identify open research issues,furthering new interest and developments in thisfield.

ENABLING NEXT-GENERATION AIRBORNECOMMUNICATIONS

Martin Strohmeier, Matthias Schäfer, Vincent Lenders, and Ivan Martinovic

Realities and Challenges ofNextGen Air Traffic Management: The Case of ADS-B

IEEE Communications Magazine • May 2014112

automatically broadcast location updates andintents, instead of merely responding to interro-gations by ground stations. ADS-B has beenstandardized and the FAA as well as EURO-CONTROL have mandated its deployment for2020 as part of next generation air transporta-tion systems NextGen and SESAR. By then atthe latest, all scheduled flights will be requiredto send continuous location updates with ADS-Bcapable transponders.

As of today, most airlines have started toequip their fleet with ADS-B transponders inorder to be ready when the technology becomesmandatory. As a consequence, a significant por-tion of the aircraft traffic is already sending outADS-B signals. Although ADS-B messages aresent unencrypted and anybody may have beencapturing those signals for years, we areunaware of any larger field studies providingdeeper insights on the technology at a widerscale. While preliminary experiments at airports(e.g. [2]) have been reported, these studieswere either limited by the number of stations orthe coverage area. A different option for high-level information are live radar services avail-able freely on the Internet which in themeantime offer extensive coverage of world-wide traffic. These services, too, utilize ADS-Bdata but provide only insights about aggregatedflight tracks, illustrating the increasing trafficdensity (Fig. 1).

This article analyzes the current state of theADS-B system in a comprehensive large-scalemeasurement campaign using OpenSky [3], aresearch sensor network deployed in Central

Europe. As of this writing, OpenSky includeseleven sensor nodes geographically distributedover an area of 720,000km2. Over a period ofnine months, we were able to capture ADS-Btraffic of more than 7,500 flights per day on aver-age, using over 13,500 different aircraft in total;the overall data currently consists of more than4.5 billion ADS-B messages. Using this realisticand rich source of data, we were able to analyzeADS-B communication characteristics in moredetail. With respect to the increasing air traffic inboth manned and unmanned aviation, two issueshave been identified as relevant problems:• The ADS-B system is susceptible to severe

message collisions in dense air spaces. Therandom channel access of the communica-tion protocols using the 1090MHz frequen-cy leads to ADS-B packet error rates above50 percent for typical air space densities asobserved during the day.

• Furthermore, we discuss recently identifiedsecurity concerns surrounding ADS-B.There are practical RF attacks with cheapoff-the-shelf software-defined radios. Anadversary can inject false aircraft positionsor modify the position of existing ones with-out the receiver being able to notice thepresence of these attacks.With the help of a sensor network, we want

to put both of these issues in a real-world con-text, discussing insights that are valuable for thefuture deployment of ADS-B. This work focuseson the current state of deployment of ADS-Band potential indicators for future developments.

OVERVIEW OF ADS-BThis section provides a short overview of thedevelopment of the ADS-B protocol, its historyand current applications.

THE ADS-B PROTOCOLThe American Federal Aviation Administration(FAA) as well as its European counterpartEUROCONTROL named ADS-B as the satel-lite-based successor of radar. Until today, airtraffic control (ATC) relies on interrogation-based SSR, so called modes, to retrieve an air-craft’s identity and altitude. Table 1 comparesthe modes A, C, and S, which are in commonuse for civil aviation. With its creation, ADS-Bconstitutes a paradigm shift in ATC towardcooperative and dependent surveillance. Everyparticipant retrieves their own position andvelocity by using an onboard GPS receiver. Thisand other information such as ID, intent, urgen-cy code, and uncertainty level are then periodi-cally broadcast in a message (typically twice persecond) by the transmitting subsystem calledADS-B Out. The messages are received and pro-cessed by ATC stations on the ground as well asnearby aircraft, if equipped with the receivingsubsystem ADS-B In.

There are two competing ADS-B data linkstandards that have been proposed: UniversalAccess Transceiver (UAT) and 1090MHzExtended Squitter (1090ES). UAT uses the978MHz frequency and has been created specifi-cally for use with aviation services such asADS-B. Since UAT requires fitting new hard-

Figure 1. Live radar picture of ADS-B-equipped aircraft over CentralEurope from flightradar24.com.

IEEE Communications Magazine • May 2014 113

ware, it is currently only used for general avia-tion in EUROCONTROL and FAA-mandatedairspaces. Commercial aircraft employ arevamped version of the traditional SSR proto-col Mode S. This so called Extended Squitteroperates on the 1090MHz frequency and is acombination of ADS-B and Mode S. In otherwords, the ADS-B function can be integratedinto existing Mode S transponders. Figure 2 pro-vides a graphical illustration of the ADS-B sys-tem architecture and the protocol hierarchy.

From here on, we focus on the commerciallyused 1090ES data link. The complete technicaloverview of the ADS-B protocol can be found inthe specification documents [1, 4]; various otherworks give succinct, higher level descriptions ofthe protocol (e.g., [5]).

DEVELOPMENT AND USE CASESWhile there were a number of reasons behindthe switch to a modern air traffic managementsystem, cost has consistently been mentioned asone of the most important throughout the pro-cess; existing radar infrastructures are muchmore expensive to deploy and maintain [6] com-pared to ADS-B. Furthermore, it provides signif-icant operational enhancements for airlines andair traffic managers. The increased accuracy andprecision should improve safety and decrease thelikelihood for air traffic incidents by a large mar-gin. Furthermore, pilots profit from enhancedsituational awareness in their cockpits.

Industry and regulators estimate that in 2013more than 70 percent of all commercial aircraftworldwide were already equipped with ADS-Btransponders [7]. Countries such as Australia andCanada have already deployed full continental cov-erage, with ADS-B sensors being the single meansof ATC in low population areas of the country.

ADS-B was developed to address some mainuse cases: Airport Control:• Runway control/taxiing: GPS-based localiza-

tion improves the handling of aircraft onthe ground where very high precision isneeded.

• Approach/take-off: Improved accuracyincreases ATC safety and makes it possibleto reduce the density of approaches andtake-offs at busy airports, leading to signifi-cant cost reductions.

En-route ATC:• Wide-area regions: ADS-B enables and sig-

nificantly reduces cost for full en-route cov-erage of flights in very low-density regionssuch as the vast open spaces in Canada orAustralia.

• Collision Avoidance: Improved localizationbenefits Traffic Collision Avoidance Sys-tems (TCAS) and reduces the danger ofmid-air collisions. Modern TCAS systemscan utilize ADS-B messages to improveperformance.

• UAV Sense and Avoid: Control and colli-sion avoidance for UAV is shifting to Senseand Avoid (SAA), permitting the UAV toself-separate from potential obstacles.

ADS-B DEPLOYMENT INCENTRAL EUROPE

There are many successful community projectsutilizing ADS-B, such as websites offering liveradar services based on commercially availablehardware. These projects provide high-level dataand the abstract content of received ATC mes-sages. While this is highly useful, a low-levelview on ADS-B and its frequency is needed toconduct a thorough full-scale analysis of the cur-rent state of deployment. Besides purpose-builthardware, modern software-defined radios withspecialized software provide a cheap and flexibleway to collect large amounts of ATC-related data.

We use OpenSky, a sensor network consistingof 11 sensors located in Central Europe, to col-lect ADS-B messages on a large scale. In Open-Sky, all ADS-B messages received from aircraftover the 1090ES data link are stored. We relymainly on commercial SBS-3 stations fromKinetic Avionics as sensors to collect these mes-sages. Since SBS-3 does not report a receivedsignal strength indicator (RSSI), we also use aspecial-purpose software-defined radio receiverfor ADS-B, based on USRP products in combi-nation with the GNU Radio project, to enhancedata collection. Gathering additional informationsuch as RSSI and signal-to-noise ratio (SNR)allows us to conduct a more thorough analysis.For more information on OpenSky, see [3].

Our collected data shows that despite ADS-Bbeing only slowly rolled out and still in the test-

Table 1. Comparison of civil aviation transponder modes.

Messagelength

Frequencies(MHz) Operational mode Use cases

Mode A 12 bit 1030 (up)1090 (down) Independent/Non-selective interrogation Identification

Mode C 12 bit 1030 (up)1090 (down) Independent/Non-selective interrogation

PressureAltitudeExtraction

Mode S 56/112 bit 1030 (up)1090 (down) Independent/Selective interrogation Multiple

ADS-B/1090ES 112 bit 1090 Dependent/Automatic Multiple

Industry and regula-

tors estimate that in

2013 more than 70

percent of all com-

mercial aircraft

worldwide have

already been

equipped with ADS-

B transponders [7].

Countries such as

Australia and Canada

have already

deployed full conti-

nental coverage,

with ADS-B sensors

being the single

means of ATC in low

population parts of

the country.

IEEE Communications Magazine • May 2014114

ing stage, a majority of commercial flights overCentral Europe has already adopted the stan-dard. On average, about two-thirds of all aircraftthat crossed the receiving range of our networkbroadcast ADS-B messages. Since our sensornetwork went online on 31/01/2013, we have seenaround 13,000 aircraft from 98 different coun-tries (see also Table 2). Most aircraft were fromGermany (19.03 percent), the United Kingdom(11.58 percent), and the United States (11.49percent), followed by Switzerland (6.63 percent),Ireland (6.55 percent), and France (6.23 per-cent). Approximately 7,500 flights cross ourreception range every day, even though not allaircraft are even equipped with ADS-B yet andwe only monitor Central Europe as of now. Yetthis constitutes already approximately 30 percentof the overall commercial flight traffic in Europe,where EUROCONTROL records 25,000–30,000flights per day depending on the time of year.

MESSAGE TYPES AND RATESMany aircraft have not yet fully implemented theADS-B standard. Ninety-eight percent of allADS-B equipped aircraft that crossed our net-work’s range at least broadcast their call sign;80.4 percent reported their position; 79.2 per-cent reported their velocity. All three messagetypes are broadcast by 76.9 percent. Miscella-neous messages, including unknown formats aswell as test messages, were sent out by 27.4 per-cent of aircraft, making up less than 3 percent ofall received messages.

Position and velocity are each broadcast twiceper second and the call sign once in five seconds.Combining these three message types, an aver-

age aircraft can therefore be assumed to current-ly have an ADS-B message rate of 4.2 messagesper second. This will increase to 6.2 messagesper second and more when other types such asperiodic status messages are implemented in thefuture [1].

ANALYSIS OF THE ADS-B CHANNELWe used a sample of 53,626,642 messagesrecorded over a 14-day period with a USRP-based receiver to conduct an in-depth analysis ofthe ADS-B channel characteristics.

LOSS AND CHANNEL QUALITYAs an indicator of the channel quality, the sig-nal-to-noise ratio (SNR) of correctly decodedmessages ranged from 2.71dB to 33.13dB, withthe 0.5 and 99.5 percent quantiles at 7.64dB and21.79dB, respectively. Messages with an SNRhigher than about 16dB were highly likely to bedecoded correctly.

In all our measurements, we noticed that wereceived considerably fewer ADS-B messagesthan we should have according to the specifica-tion and the observed aircraft behavior. Themessage loss rate was much stronger than couldbe attributed to weather or other external influ-ences. In looking for the causes, Fig. 3 shows theimpact of several variables on the percentage ofpackets lost at the receiver. Figure 3a illustratesthe loss rate against the distance of the aircraftfrom the receiver. For the most part, we canobserve slow linear growth of the mean from30 percent at 50km to 50 percent at approxi-mately 280km. However, there are two notice-able effects: message loss accelerates significantlypast the 280km mark, and message loss is actual-ly higher (up to 40 percent) below 50km.

On top of this typical signal behavior, wenoticed that loss rates correlate with the time ofday, as seen in Fig. 3b. The loss rates are signifi-cantly lower in the morning and in the evening,i.e. in off-peak traffic times when considerablyfewer aircraft are in transmission range. Follow-ing this pattern, Fig. 3c shows the effect againstthe number of ADS-B equipped aircraft in range.In peak times, it can reach over 40–50 percent onaverage, with some aircraft experiencing pro-hibitively high loss rates of 80 percent or more.

Message Collisions — Going further intodetails, message collisions seemed to have causedthe recorded loss. With only a few aircraft, theloss rate is approximately 10 percent, rising toover 45 percent with 60 ADS-B senders. Consid-

Figure 2. ATC system architecture and protocol hierarchy [3]. The position-al data provided by the satellite navigation system is processed by the air-craft and broadcasted through the ADS-B Out system alongside othersituational information. ATC ground stations and other aircraft (via ADS-B In) receive these messages over the 1090 ES or UAT data link.

Mode 3/A Mode C

ICAO annex 10 volume 4 RTCA DO-282B

RTCA DO-242A

ADS-B

Mode S

1090 ES

UAT

GNSSsensor

GNSSsensor

ADS-Btransmitter

Air trafficcontrolsystems

ADS-Breceiver

ADS-B ground stations

Trafficbroadcast

ADS-Breceiver

Dataprocessing(e.g. TCAS)

1090ES/UATdata link

Positionaldata

GNSS

ADS-B out ADS-B in

RTCA DO-260B

Table 2. OpenSky statistics as of February 2014.

Online since 31/01/2013

Sensors 11

Received messages > 4,500,000,000

Flights per day ca. 7,500

Different aircraft ca. 13,000

IEEE Communications Magazine • May 2014 115

ering this is not an unusual aircraft accumulationin many high-density airspaces around airportswhere hundreds of aircraft can be in communi-cation range, this poses a significant problem.However, our simulations showed that the mes-sage rate of ADS-B alone could not be the rootof the problem.

As mentioned before, it is not only ADS-Bthat is operating on the 1090MHz channel. Inreal-world environments, the interrogations andresponses of Mode S and the related Mode Aand C systems account for a large number ofmessages sent over the channel at any giventime, more than 50 times the amount of ADS-Bmessages in our empirical samples. Mode A/Cand S messages are sent by approximately 1.5times as many aircraft as those that broadcastADS-B. The observed loss of ADS-B messages isconsistent with further simulations that we con-ducted to estimate the amount of collisionsaffecting ADS-B messages. The blue (dashed)line in Fig. 3c shows the results when taking intoaccount all relevant ATC protocols, illustratingthe severity of the problem with typical aircraftnumbers. ADS-B was originally developed tocope with such high-density traffic, and it couldindeed successfully achieve this if it were to usethe 1090MHz frequency exclusively.

In the real world as it presents itself current-ly, ADS-B service is highly erratic when thenumber of aircraft in transmission range increas-es, particularly in high-density airspaces aroundairports during busy hours. These effects certain-ly need to be considered in receiver positioningand protocol development as they constitute asevere problem for the future deployment ofADS-B and other systems utilizing its data suchas TCAS. Antenna design, interrogation ratemanagement, and improved coordinationbetween systems are examples of mitigatingapproaches that need to be examined as well asother previous work on 1090MHz channel capac-ity improvement [8].

FURTHER INSIGHTSWe identify the following typical effects thatinfluence the deployment and usage of sensorsand receivers in a network.

Propagation model: Our measurements veri-fied that the standard log-distance path lossmodel fits the large-scale fading of line-of-sightcommunication of ADS-B systems well, whilesmall-scale fading was log-normally distributedwith standard deviation s = 1.15.

Doughnut effect: There are noticeable “holes”in the reception quality of messages that are sentin close horizontal distance to a sensor with veryhigh transmission power. This clipping effect canbe seen in Fig. 3a, where the loss rate is higherin very close proximity (approximately 10-20km)to the receivers compared to further away.

Antenna effects: Aircraft equipped with ADS-Btypically use two antennas for alternatingly trans-mitting messages, which can lead to differencesin transmission characteristics such as RSSI val-ues. Since there is no indicator on the antennasgiven, a filter would be needed to separate these,making the data analysis more complex.

Duplicate messages: There is some occur-rence of duplicate messages in the data, caused

by multipath effects. This is naturally stronger inmountainous areas and needs to be taken intoaccount for protocol development and furtherprocessing of messages. On top of this, somecurrent ADS-B transponders exhibit unspecifiedbehavior, sending the same message a number oftimes (up to 12 or more in our data).

Figure 3. ADS-B message loss statistics: a) loss vs. distance; b) loss vs. timeof day; and c) loss against number of ADS-B senders in close transmissionrange.

0

0

Loss

(%

)

20

40

60

80

100

50 100 150Distance (km)

200 250 300 350

00:00

0

Loss

(%

)

20

40

60

80

100

04:00 08:00 12:00 16:00 20:00Time of day (h)

00:00

0

0

Loss

(%

)

20

40

60

80

100

15 30 45 60 75Number of aircraft in range

(a)

(b)

(c)

90

95% quantile75% quantileMean

95% quantile75% quantileMean

95% quantile75% quantileMeanSimulation

IEEE Communications Magazine • May 2014116

Weather effects: We found little effect ofweather on RSSI (i.e. around 1dB decreasecaused by rain and humidity, around 2dB for sunsolar activity) and no effect on SNR. There was noconclusive effect on average loss and error rates.

SECURITY CONSIDERATIONSBesides severe problems with message loss,another challenge for ADS-B that has recentlybeen identified are security issues. For example,as seen on hacker conventions [9], ADS-B ishighly susceptible to RF attacks, which generat-ed a notable amount of media attention.2 Just ashigh message loss on the 1090MHz frequency,adversarial action on the ADS-B data link mayhave a severe negative impact on collision avoid-ance and separation abilities of affected aircraft.These recent developments suggest that it isimportant to address those concerns as early aspossible, as they pose a considerable problem forfuture widespread deployment of the protocol.

There are vulnerabilities in ADS-B that areinherent to the broadcast nature of unsecuredRF communication. When the design assump-tions for the ADS-B protocol were first dis-cussed about two decades ago, the manipulationof RF communication was considered a possibili-ty for only the most sophisticated and powerfuladversaries. The required cost and engineeringknowledge were seen as too prohibitive to con-sider further security mechanisms for the ADS-Bprotocol. With the advent of cheap and accessi-ble software-defined radios as well as specializedreceiver hardware for the reception of air trafficcommunication over the past few years, thethreat model shifted considerably. Today, typicalwireless attacks such as eavesdropping, jammingand modification, insertion and deletion of mes-sages, are easily possible by anyone with widelyavailable standard hardware and software, asrecently illustrated in [5, 9, 10] among others. Inthe following, we give an overview of theseattacks and their potential impact. Possible

approaches to address these vulnerabilities havebeen discussed in [11].

VULNERABILITIES OF THE ADS-B DATA LINKAny passive adversary can record and analyzethe unencrypted ADS-B messages. However, anattacker that can actively interfere with ATCcommunication poses a much more severe threatto security than a merely passive one. From thefindings in [10], we can assume that an attackerhas full control over the wireless communicationchannel and is able to inject, delete, and modifyany ADS-B message at will. A number of activeattacks can be carried out with cheap, standardoff-the-shelf hardware:

Ground Station Flooding: Continuous tradi-tional jamming attacks on the 1090MHz channelwould lead to high loss and message deletion inaddition to naturally occurring collisions due tothe random channel access of ADS-B and ModeS. This is a low difficulty attack, only constrainedby the signal power of an adversary. It would forceair traffic controllers to switch to older, lower pre-cision surveillance techniques with potentially fatalconsequences, especially in high density airspacesaround major international airports.

Ghost Aircraft Injection/Flooding: It is possi-ble to inject fake ADS-B messages claiming non-existing aircraft (so-called ghosts) onto the1090MHz channel [5, 12]. Any legitimate ADS-Breceiver would consider these fake messages asindistinguishable from real aircraft, leading toserious confusion for both pilots and air trafficcontrol, particularly under poor signal and visi-bility conditions, when reliance on instruments ishighest.

Besides a targeted, surgical injection attackthat aims to be more subtle and not quicklydetected, it is easily possible to flood ADS-Breceivers with the injection of many aircraft atthe same time. This may lead to a denial of ser-vice of a controller’s airport and airspace surveil-lance systems. Without the support of othersurveillance technologies, management maybecome impossible. Fig. 4 shows an exemplaryimplementation of a ghost aircraft injection andflooding attack on a given radar picture.

Aircraft Disappearance: Deleting all ADS-Bmessages sent by a particular aircraft would leadthe aircraft to disappear completely from anADS-B-based ATC application. The attack ismore subtle and surgical than simple flooding,but similarly controllers have to rely on less pre-cise surveillance systems such as PSR, defeatingthe original purpose of ADS-B. All attacks thatrequire message deletion or modification aremore complex to carry out with regard to tim-ings. Still, by carefully positioning themselves,attack ranges of 100km or more are achievablewith standard software-defined radio hardware.

Virtual Trajectory Modification/False AlarmAttack: This attack aims to modify the positionand trajectory broadcast by a real aircraft. Thiscan be achieved by both selectively jamming theactual messages at the ground sensor and replac-ing them with new ones, modified by the attack-er. Alternatively, ADS-B messages can bemodified directly on the air. If done subtlyenough, the takeover would be hard to noticewith less accurate PSR surveillance technologies

2 For example,http://www.forbes.com/sites/andygreen-berg/2012/07/25/next-gen-air-traffic-control-vulnerable-to-hackers-spoofing-planes-out-of-thin-air/.

Figure 4. Example of a combined ghost aircraft flooding and injectionattack, causing a denial of service on the receiver’s end [10].

IEEE Communications Magazine • May 2014 117

and may lead to problematic situations for airtraffic controllers.

In a more sophisticated version of the attack,ADS-B messages are modified to cause falsealarms. ADS-B offers mechanisms to indicateemergencies or interferences such as aircrafthijacking, which may lead to serious conse-quences if abused.

Aircraft Spoofing: Every aircraft carries a 24-bitidentifier assigned by the ICAO which can sim-ply be changed with a combination of messagedeletion and injection attacks. Masquerading asa known or trusted aircraft may reduce propensi-ty to cause red flags or alarms when an unex-pected aircraft is detected through other meansof surveillance.

FUTURE PERSPECTIVES FORADS-B AND UAVS

Besides traditional aviation, modern unmannedaerial vehicles represent another area in whichADS-B will play a crucial role in the near future,specifically for SAA systems which are critical tocollision avoidance. It has widely been touted asthe future of UAV control, and a number ofreal-world tests have been conducted in therecent past.3 Certification for a UAV requiresthe manufacturer to prove that its capabilitiesare at least as good as a manned counterpart; asof 2013, UAVs have been denied access to civilairspaces. Until now, FAA regulations have beenhighly prohibitive for normal airspaces, expect-ing SAA to work without cooperation by otheraircraft, but this paradigm is shifting as well.There is much recent research being done onSAA systems using a cooperative approach withADS-B, superseding traditional practices utiliz-ing visual means [13]. According to industryreports, the FAA is consequently looking to for-mulate standards on using such electronic meansfor SAA by 2016,4 making the issues discussed inthis article even more pressing.

Recently, broad media exposure led the Inter-national Civil Aviation Organization (ICAO) toput the security of civil aviation on the agenda ofthe twelfth air navigation conference, identifying“cyber security as a high-level impediment toimplementation that should be considered aspart of the roadmap development process” [14]and creating a task force to help with the futurecoordination of the efforts from involved stake-holders. While these problems have been on theagenda of civil aviation stakeholders for sometime now, the thematic constellation of UAVand ADS-B security will need to be assigned ahigher priority, as for example Wesson andHumphreys [15] have also recently pointed outthe severity of the situation. We believe theseconcerns will have to play a major role in aca-demic and industrial research to enable safe cer-tification of ADS-B-based SAA systems by 2020and avoid further costly and embarrassing fail-ures such as Germany’s Euro Hawk recently.Euro Hawk, a spin-off of NATO’s Global Hawk,was cancelled in May 2013 after 13 years ofdevelopment due to ongoing regulatory andtechnical difficulties that made the project infea-sible.

CONCLUSION

In this article, we discussed the ADS-B proto-col, the future standard of air traffic manage-ment. We introduced the development ofADS-B and examined if the historic assump-tions could hold up when it will finally be rolledout until 2020. We argued that there are a num-ber of problems that cause severe concerns forsafety and security of future air traffic, particu-larly with the advent of Sense-and-Avoid-Sys-tems for UAVs. Both issues, serious messageloss caused by growing traffic on the 1090MHzchannel and open security concerns due to thecheap and easy availability of software-definedradios, have severe implications for the finalintegration of ADS-B as a core part of theNextGen ATC system. Our findings stronglysuggest that these issues will have to beaddressed by the academic community and theATC authorities as soon as possible, so theplanned replacement of PSR/SSR with ADS-Bwill not be an illusion.

REFERENCES[1] RTCA Inc., “Minimum Aviation System Performance

Standards for Automatic Dependent Surveillance Broad-cast (ADS-B),” DO-242A (including Change 1), Dec.2006.

[2] C. Rekkas and M. Rees, “Towards ADS-B implementa-tion in Europe,” IEEE Tyrrhenian Int’l. Wksp. DigitalCommunications — Enhanced Surveillance of Aircraftand Vehicles (TIWDC/ESAV), , Sept. 2008, pp. 1–4.

[3] M. Schäfer et al., “Bringing Up OpenSky: A Large-scaleADS-B Sensor Network for Research,” ACM/IEEE Int’l.Conf. Information Processing in Sensor Networks(IPSN), Apr. 2014.

[4] RTCA Inc., “Minimum Operational Performance Stan-dards for 1090 MHz Extended Squitter AutomaticDependent Surveillance — Broadcast (ADS-B) and Traf-fic Information Services — Broadcast (TIS-B),” DO-260B(with Corrigendum 1), Dec. 2011.

[5] D. McCallie, J. Butts, and R. Mills, “Security Analysis ofthe ADS-B Implementation in the Next Generation AirTransportation System,” Int’l. J. Critical InfrastructureProtection (IJCIP), vol. 4, no. 2, Aug. 2011, pp. 78–87.

[6] A. Smith et al., “Methods to Provide System-wide ADS-B Back-Up, Validation and Security,” IEEE/AIAA DigitalAvionics Systems Conference (DASC), Oct. 2006, pp.1–7.

[7] L. Vidal, “ADS-B Out and In — Airbus Status,” ADS-BTaskforce — KOLKATA, Apr. 2013.

[8] E. G. Piracci et al., “1090 MHz Channel CapacityImprovement in the Air Traffic Control Context,” Int’l. J.Microwave and Wireless Technologies (IJMWT), vol. 1,July 2009, p. 193.

[9] A. Costin and A. Francillon, “Ghost in the Air (Traffic):On Insecurity of ADS-B Protocol and Practical Attackson ADS-B Devices,” Black Hat, July 2012.

[10] M. Schäfer, V. Lenders, and I. Martinovic, “Experimen-tal Analysis of Attacks on Next Generation Air TrafficCommunication,” Int’l. Conf. Applied Cryptography andNetwork Security (ACNS), Springer, June 2013, pp.253–71.

[11] M. Strohmeier, V. Lenders, and I. Martinovic, “Securityof ADS-B: State of the Art and Beyond,” arXiv preprintarXiv:1307.3664, July 2013, available:http://arxiv.org/abs/1307.3664.

[12] L. Purton, H. Abbass, and S. Alam, “Identification ofADS-B System Vulnerabilities and Threats,” AustralianTransport Research Forum (ATRF), Canberra, Australia,Sep. 2010, pp. 1–16.

[13] B. Stark, B. Stevenson, and Y. Chen, “ADS-B for SmallUnmanned Aerial Systems : Case Study and RegulatoryPractices,” IEEE Int’l Conf. Unmanned Aircraft Systems(ICUAS), May 2013, pp. 152–59.

[14] “Twelfth Air Navigation Conference,” ICAO, Nov.2012, pp. 1–4.

[15] K. Wesson and T. Humphreys, “Hacking Drones,” Sci-entific American, vol. 309, no. 5, Oct. 2013, pp. 54–59.

3 For example bySagetech:http://www.sagetechcorp.com/news/ottawa-flight-test-demonstrates-sense-and-avoid-capabilities-of-uavs.cfm or FLARM:http://flarm.com.

4

http://www.ainonline.com/aviation-news/ain-air-transport-perspec-tive/2013-07-22/faa-plans-unmanned-sense-and-avoid-rule-2016.

Our findings strongly

suggest that these

issues will have to be

addressed by the

academic community

and the

ATC authorities as

soon as possible,

so the planned

replacement of

PSR/SSR with

ADS-B will not be

an illusion.

IEEE Communications Magazine • May 2014118

BIOGRAPHIESMARTIN STROHMEIER (martin.strohmeier@cs.ox.ac.uk) is aDPhil candidate and teaching assistant in the Departmentof Computer Science at the University of Oxford. His cur-rent research interests are mostly in the area of wirelessnetwork security, including next generation air traffic con-trol and wireless sensor networks. Before coming to Oxfordin 2012, he received his MSc degree from TU Kaiser-slautern, Germany and also worked as visiting researcher atLancaster University’s InfoLab21 and Deutsche LufthansaAG.

MATTHIAS SCHÄFER (schaefer@cs.uni-kl.de) is a Ph.D. candi-date in the Department of Computer Science at the Univer-sity of Kaiserslautern, Germany, where he also received hisM.Sc. degree in computer science in 2013. Between 2011and 2013, he worked for the Information Technology andCyberspace group of armasuisse, Switzerland and visitedthe Department of Computer Science of the University ofOxford, UK, as a visiting researcher.

VINCENT LENDERS (vincent.lenders@armasuisse.ch) has beenworking at armasuisse since 2008 where he is responsiblefor the Cyberspace and Information research program.Besides research, he has been deeply involved in the devel-opment of the cyber security concepts for the operationalC4ISTAR systems of the Swiss Air Force. He earned his M.Scand Ph.D. degree at ETH Zurich and was postdoctoralresearcher at Princeton University. Since 2012, VincentLenders serves as the industrial director of the ZISCresearch center at ETH Zurich.

IVAN MARTINOVIC (ivan.martinovic@cs.ox.ac.uk) is an Associ-ate Professor at the Department of Computer Science, Uni-versity of Oxford. His research interests are in the area ofsystem security and wireless communication. Before com-ing to Oxford he was a postdoctoral researcher at theSecurity Research Lab, UC Berkeley and at the Secure Com-puting and Networking Centre, UC Irvine. He obtained hisPh.D. from TU Kaiserslautern and M.Sc. from TU Darm-stadt, Germany.