Given the nature of satellites orbiting the Earth on a fixed trajectory, in principle, it is interesting to investigate how this invariant can be exploited for security purposes. In particular, satellite orbit information can be retrieved from public databases. Using time difference of arrival (TDOA) measurements from multiple receivers, we can check this orbit information against a corresponding TDOA-based signature of the satellite. In that sense, we propose an orbit-based authentication scheme for down-link satellite communications in this paper. To investigate the properties and fundamentals of our novel TDOA signature scheme we study two satellite systems at different altitudes: Iridium and Starlink.

Given the availability of lightweight radio and processing technology, it becomes feasible to imagine spectrum sensing systems using weather balloons. Such balloons navigate the airspace up to 40 km, and can provide a bird's eye and clear view of terrestrial, as well as aerial spectrum use. In this paper, we present SkySense, which is an extension of the Electrosense sensing framework with mobile GPS-located sensors and local data logging. In addition, we present 6 different sensing campaigns, targeting multiple terrestrial or aerial technologies such as ADS-B, AIS or LTE. For instance, for ADS-B, we can clearly conclude that the number of airplanes that are detected is the same for each balloon altitude, but the message reception rate decreases strongly with altitude because of collisions. For each sensing campaign, the dataset is described, and some example spectrum analysis results are presented. In addition, we analyse and quantify important trends visible when sensing from the sky, such as temperature and hardware variations, increased ambient interference levels, as well as hardware limitations of the lightweight system. A key challenge is the automatic gain control and dynamic range of the system, as a radio navigating over 30km, sees a very wide range of possible signal levels. All data is publicly available through the Electrosense framework, to encourage the spectrum sensing community to further analyse the data or motivate further measurement campaigns using weather balloons.

This paper proposes a passivity-based trajectory tracking control for an autonomous bicycle. The nonlinear bicylce model is considered as an under-actuated pseudo-Hamiltonian system including the nonholonomic constraints. For the synthesis of the tracking controller the method of generalized canonical transformation is applied with some modifications. A first transformation compensates the effect of the gravity and, then, creates an error system. This reduces the problem of tracking to a stabilisation problem. A second transformation stabilises the resulting time-varying error system on the trajectory. Further, an integral action is added to deal with uncertainties and disturbance. Finally, simulations are run for two types of trajectories to verify the stability and investigate the performance of the closed loop.

Up-to-date meteorological information about upper air conditions is crucial for accurate weather modeling and forecasting. Existing techniques to sense meteorological parameters in the atmosphere are costly and provide only limited temporal and spatial sensing resolutions. In this paper, we propose crowdsourcing air traffic control data as a new cost-efficient method to achieve a high temporal and spatial resolution, and large coverage. Our solution leverages Secondary Surveillance Radar Mode S and ADS-B transponder signals that are continuously transmitted by aircraft for air traffic control purposes. It builds on signals captured by the OpenSky Network, a global-scale sensor network crowdsourcing 15+ billions of transponder messages per day from aircraft up to an altitude of 13 km. Based on the decoded data, we infer meteorological conditions such as air temperature, wind speed, wind direction and atmospheric pressure. Our evaluation demonstrates that our approach is effective at estimating these parameters with high resolutions along the tracks of more than 50 percent of all aircraft monitored by the OpenSky Network. Our method delivers estimations for temperature with 0.11°C, wind speed with 0.09 m/s, wind direction with 1.00°, and air pressure with 0.10 hPa average deviation, making those measurements suitable for the assimilation in numerical weather models.

The aviation industry's increasing reliance on GPS to facilitate navigation and air traffic monitoring opens new attack vectors with the purpose of hijacking UAVs or interfering with air safety. We propose Crowd-GPS-Sec to detect and localize GPS spoofing attacks on moving airborne targets such as UAVs or commercial airliners. Unlike previous attempts to secure GPS, Crowd-GPS-Sec neither requires any updates of the GPS infrastructure nor of the airborne GPS receivers, which are both unlikely to happen in the near future. In contrast, Crowd-GPS-Sec leverages crowdsourcing to monitor the air traffic from GPS-derived position advertisements that aircraft periodically broadcast for air traffic control purposes. Spoofing attacks are detected and localized by an independent infrastructure on the ground which continuously analyzes the contents and the times of arrival of these advertisements. We evaluate our system with real-world data from a crowdsourced air traffic monitoring sensor network and by simulations. We show that Crowd-GPS-Sec is able to globally detect GPS spoofing attacks in less than two seconds and to localize the attacker up to an accuracy of 150 meters after 15 minutes of monitoring time.

Systems relying on satellite positioning techniques such as GPS can be targeted by spoofing attacks, where attackers try to inject fake positioning information. With the growing spread of flying drones and their usage of GPS for localization, these systems become interesting targets of attacks with the purpose of hijacking or to distract air safety surveillance. The most recent development in air traffic surveillance is the automatic dependent surveillance -- broadcast (ADS-B). Aircraft periodically broadcast their location, speed, or environmental measurements via ADS-B. The open research project OpenSky Network collects ADS-B reports and makes them available for research purposes. This poster presents a concept to detect and localize spoofing devices by utilizing the information provided by a large-scale air traffic surveillance system. We utilize ADS-B reports collected by the OpenSky Network and provide first results on the effectiveness of localizing spoofing sources.

More than a dozen wireless technologies are used by air traffic communication systems during different flight phases. From a conceptual perspective, all of them are insecure, as security was never part of their design. Recent contributions from academic and hacking communities have exploited this inherent vulnerability to demonstrate attacks on some of these technologies. However, not all of these contributions have resonated widely within aviation circles. At the same time, the security community lacks certain aviation domain knowledge, preventing aviation authorities from giving credence to their findings. In this survey, we aim to reconcile the view of the security community and the perspective of aviation professionals concerning the safety of air traffic communication technologies. To achieve this, we first provide a systematization of the applications of wireless technologies upon which civil aviation relies. Based on these applications, we comprehensively analyze vulnerabilities and existing attacks. We further survey the existing research on countermeasures and categorize it into approaches that are applicable in the short term and research of secure new technologies deployable in the long term. Since not all of the required aviation knowledge is codified in academic publications, we additionally examine the existing aviation standards and survey 242 international aviation experts. Besides their domain knowledge, we also analyze the awareness of members of the aviation community concerning the security of wireless systems and collect their expert opinions on the potential impact of concrete attack scenarios using these technologies.

Future transportation systems highly rely on the integrity of spatial information provided by their means of transportation such as vehicles and planes. In critical applications (e.g. collision avoidance), tampering with this data can result in life-threatening situations. It is therefore essential for the safety of these systems to securely verify this information. While there is a considerable body of work on the secure verification of locations, movement of nodes has only received little attention in the literature. This paper proposes a new method to securely verify spatial movement of a mobile sender in all dimensions, i.e., position, speed, and direction. Our scheme uses Doppler shift measurements from different locations to verify a prover's motion. We provide formal proof for the security of the scheme and demonstrate its applicability to air traffic communications. Our results indicate that it is possible to reliably verify the motion of aircraft in currently operational systems with an equal error rate of zero.

We propose a new approach for securely verifying sequences of location claims from mobile nodes. The key idea is to exploit the inherent mobility of the nodes in order to constrain the degree of freedom of an attacker when spoofing consecutive location updates along a claimed track. We show that in the absence of noise, our approach is able to securely verify any 2-D track with a minimum of three verifiers or any 3-D track with four verifiers. Our approach is lightweight in the sense that it considerably relaxes the system requirements compared to previous secure location verification schemes which are all agnostic to mobility. As opposed to previous schemes, our track verification solution is at the same time (i) passive, (ii) does not require any time synchronization among the verifiers, (iii) does not need to keep the location of the verifiers secret, (iv) nor does it require specialized hardware. This makes our solution particularly suitable for large-scale deployments. We have evaluated our solution in a realistic air traffic monitoring scenario using real-world data. Our results show that 25 position claims on a track are sufficient to detect spoofing attacks with a false positive rate of 1.4% and a false negative rate of 1.2%. For tracks with more than 40 claims, the false positive and false negative rates drop to zero.

This poster presents the idea of exploiting mobility to improve the security in location and track verification. Unlike traditional approaches which require tight time synchronization or two-way communication, mobility can be used to derive lightweight verification schemes. By ensuring independent movement of the verifiers, our scheme can provide security guarantees even if the verifiers' positions are known to the attacker. We also give an outlook on more general opportunities for mobility-aided security.