L-band Digital Aeronautical Communications System (LDACS)

3.1. Voice Communications Today

Voice links are used for Air-to-Ground (A2G) and Air-to-Air (A2A) communications. The communication equipment is either ground-based working in the High Frequency (HF) or Very High Frequency (VHF) frequency band or satellite-based. All VHF and HF voice communications is operated via open broadcast channels without authentication, encryption or other protective measures. The use of well-proven communication procedures via broadcast channels helps to enhance the safety of communications by taking into account that other users MAY encounter communication problems and MAY be supported, if REQUIRED. The main voice communications media is still the analogue VHF Double Side-Band Amplitude Modulation (DSB-AM) communications technique, supplemented by HF Single Side-Band Amplitude Modulation and satellite communications for remote and oceanic areas. DSB-AM has been in use since 1948, works reliably and safely, and uses low-cost communication equipment. These are the main reasons why VHF DSB-AM communications is still in use, and it is likely that this technology will remain in service for many more years. This however results in current operational limitations and impediments in deploying new Air-Traffic Management (ATM) applications, such as flight-centric operation with Point-to-Point communications.¶

3.2. Data Communications Today

Like for voice, data communications into the cockpit is currently provided by ground-based equipment operating either on HF or VHF radio bands or by legacy satellite systems. All these communication systems are using narrowband radio channels with a data throughput capacity in order of kilobits per second. While the aircraft is on ground some additional communications systems are available, like the Aeronautical Mobile Airport Communication System (AeroMACS) or public cellular networks, operating in the Airport (APT) domain and able to deliver broadband communication capability.¶

The data communication networks used for the transmission of data relating to the safety and regularity of the flight MUST be strictly isolated from those providing entertainment services to passengers. This leads to a situation that the flight crews are supported by narrowband services during flight while passengers have access to inflight broadband services. The current HF and VHF data links cannot provide broadband services now or in the future, due to the lack of available spectrum. This technical shortcoming is becoming a limitation to enhanced ATM operations, such as Trajectory-Based Operations and 4D trajectory negotiations.¶

Satellite-based communications are currently under investigation and enhanced capabilities are under development which will be able to provide inflight broadband services and communications supporting the safety and regularity of flight. In parallel, the ground-based broadband data link technology LDACS is being standardized by ICAO and has recently shown its maturity during flight tests [SCH20191]. The LDACS technology is scalable, secure and spectrum efficient and provides significant advantages to the users and service providers. It is expected that both - satellite systems and LDACS - will be deployed to support the future aeronautical communication needs as envisaged by the ICAO Global Air Navigation Plan.¶

5.1. Advances Beyond the State-of-the-Art

LDACS offers several capabilities that are not provided in contemporarily deployed aeronautical communication systems.¶

5.2. Application

LDACS SHALL be used by several aeronautical applications ranging from enhanced communication protocol stacks (multi-homed mobile IPv6 networks in the aircraft and potentially ad-hoc networks between aircraft) to classical communication applications (sending GBAS correction data) and integration with other service domains (using the communication signal for navigation).¶

7.1. LDACS Sub-Network

An LDACS sub-network contains an Access Router (AR), a Ground-Station Controller (GSC), and several GS, each of them providing one LDACS radio cell.¶

User plane interconnection to the ATN is facilitated by the AR peering with an A2G Router connected to the ATN. It is up to implementer's choice to keep AR and A2G Router functions separated, or to merge them.¶

The internal control plane of an LDACS sub-network is managed by the GSC. An LDACS sub-network is illustrated in Figure 1.¶

wireless      user
link          plane
  A--------------G----------------AR---A2G-----ATN
  S..............S                |   Router
                 . control      . |
                 . plane        . |
                 .              . |
                 GSC..............|
                 .                |
                 .                |
                 GS---------------+

7.2. Topology

LDACS operating in A2G mode is a cellular point-to-multipoint system. The A2G mode assumes a star-topology in each cell where Aircraft Stations (AS) belonging to aircraft within a certain volume of space (the LDACS cell) is connected to the controlling GS. The LDACS GS is a centralized instance that controls LDACS A2G communications within its cell. The LDACS GS can simultaneously support multiple bi-directional communications to the ASs under its control. LDACS's GSs themselves are connected to a GSC controlling the LDACS sub-network.¶

Prior to utilizing the system an AS has to register with the controlling GS to establish dedicated logical channels for user and control data. Control channels have statically allocated resources, while user channels have dynamically assigned resources according to the current demand. Logical channels exist only between the GS and the AS.¶

The LDACS wireless link protocol stack defines two layers, the physical layer and the data link layer.¶

7.3. LDACS Physical Layer

The physical layer provides the means to transfer data over the radio channel. The LDACS GS supports bi-directional links to multiple aircraft under its control. The FL direction at the G2A connection and the RL direction at the A2G connection are separated by Frequency Division Duplex. FL and RL use a 500 kHz channel each. The GS transmits a continuous stream of Orthogonal Frequency-Division Multiplexing (OFDM) symbols on the FL. In the RL different aircraft are separated in time and frequency using a combination of Orthogonal Frequency-Division Multiple-Access (OFDMA) and Time-Division Multiple-Access (TDMA). Aircraft thus transmit discontinuously on the RL with radio bursts sent in precisely defined transmission opportunities allocated by the GS.¶

7.4. LDACS Data Link Layer

The data-link layer provides the necessary protocols to facilitate concurrent and reliable data transfer for multiple users. The LDACS data link layer is organized in two sub-layers: The medium access sub-layer and the Logical Link Control (LLC) sub-layer. The medium access sub-layer manages the organization of transmission opportunities in slots of time and frequency. The LLC sub-layer provides acknowledged point-to-point logical channels between the aircraft and the GS using an automatic repeat request protocol. LDACS supports also unacknowledged point-to-point channels and G2A broadcast.¶

7.5. LDACS Mobility

LDACS supports layer 2 handovers to different LDACS channels. Handovers MAY be initiated by the aircraft (break-before-make) or by the GS (make-before-break). Make-before-break handovers are only supported for GSs connected to the same GSC.¶

External handovers between non-connected LDACS sub-networks or different aeronautical data links SHALL be handled by the FCI multi-link concept.¶

8.1. Layer 2

LDACS has been designed with applications related to the safety and regularity of flight in mind. It has therefore been designed as a deterministic wireless data link (as far as this is possible).¶

Based on channel measurements of the L-band channel [SCHN2016] and respecting the specific nature of the area of application, LDACS was designed from the PHY layer up with robustness in mind.¶

In order to maximize the capacity per channel and to optimally use the available spectrum, LDACS was designed as an OFDM-based Frequency Division Duplex system, supporting simultaneous transmissions in FL at the G2A connection and RF at the A2G connection. The legacy systems already deployed in the L-band limit the bandwidth of both channels to approximately 500 kHz.¶

The LDACS physical layer design includes propagation guard times sufficient for the operation at a maximum distance of 200 nautical miles from the GS. In actual deployment, LDACS can be configured for any range up to this maximum range.¶

The LDACS FL physical layer is a continuous OFDM transmission. LDACS RL transmission is based on OFDMA-TDMA bursts, with silence between such bursts. The RL resources (i.e. bursts) are assigned to different ASs on demand by the GS.¶

The LDACS physical layer supports adaptive coding and modulation for user data. Control data is always encoded with the most robust coding and modulation (QPSK coding rate 1/2).¶

LDACS medium access on top of the physical layer uses a static frame structure to support deterministic timer management. As shown in Figure 3 and Figure 4, LDACS framing structure is based on Super-Frames (SF) of 240ms duration corresponding to 2000 OFDM symbols. FL and RL boundaries are aligned in time (from the GS perspective) allowing for deterministic sending windows for KEEP ALIVE messages and control and data channels in general.¶

LDACS medium access is always under the control of the GS of a radio cell. Any medium access for the transmission of user data has to be requested with a resource request message stating the requested amount of resources and class of service. The GS performs resource scheduling on the basis of these requests and grants resources with resource allocation messages. Resource request and allocation messages are exchanged over dedicated contention-free control channels.¶

The purpose of Quality-of-Service in LDACS medium access is to provide prioritized medium access at the bottleneck (the wireless link). The signaling of higher layer Quality-of-Service requirements to LDACS is yet to be defined. A DiffServ-based solution with a small number of priorities is to be expected.¶

LDACS has two mechanisms to request resources from the scheduler in the GS.¶

Resources can either be requested "on demand" with a given priority. On the FL, this is done locally in the GS, on the RL a dedicated contention-free control channel is used called Dedicated Control Channel (DCCH), which is roughly 83 bit every 60 ms. A resource allocation is always announced in the control channel of the FL, short Common Control Channel (CCCH) having variable size. Due to the spacing of the RL control channels every 60 ms, a medium access delay in the same order of magnitude is to be expected.¶

Resources can also be requested "permanently". The permanent resource request mechanism supports requesting recurring resources in given time intervals. A permanent resource request has to be canceled by the user (or by the GS, which is always in control).¶

User data transmissions over LDACS are therefore always scheduled by the GS, while control data uses statically (i.e. at cell entry) allocated recurring resources (DCCH and CCCH). The current specification specifies no scheduling algorithm. Scheduling of RL resources is done in physical Protocol Data Units of 112 bit (or larger if more aggressive coding and modulation is used). Scheduling on the FL is done Byte-wise since the FL is transmitted continuously by the GS.¶

In addition to having full control over resource scheduling, the GS can send forced Handover commands for off-loading or RF channel management, e.g. when the signal quality declines and a more suitable GS is in the AS reach. With robust resource management of the capacities of the radio channel, reliability and robustness measures are therefore also anchored in the LDACS management entity.¶

In addition, to radio resource management, the LDACS control channels are also used to send keep-alive messages, when they are not otherwise used. Since the framing of the control channels is deterministic, missing keep-alive messages can thus be immediately detected. This information is made available to the multi-link protocols for fault management.¶

The protocol used to communicate faults is not defined in the LDACS specification. It is assumed that vendors would use industry standard protocols like the Simple Network Management Protocol or the Network Configuration Protocol where security permits.¶

The LDACS data link layer protocol running on top of the medium access sub-layer uses ARQ to provide reliable data transmission on layer 2.¶

It employs selective repeat ARQ with transparent fragmentation and reassembly to the resource allocation size to achieve low latency and a low overhead without losing reliability. It ensures correct order of packet delivery without duplicates. In case of transmission errors it identifies lost fragments with deterministic timers synced to the medium access frame structure and initiates retransmission. Additionally, the priority mechanism of LDACS ensures the timely delivery of messages with high importance.¶

8.2. Beyond Layer 2

LDACS availability can be increased by appropriately deploying LDACS infrastructure: This means proliferating the number of terrestrial base stations. However, the scarcity of aeronautical spectrum for data link communication (in the case of LDACS: tens of MHz in the L-band) and the long range (in the case of LDACS: up to 400 km) make this quite hard. The deployment of a larger number of small cells is certainly possible, suffers, however, also from the scarcity of spectrum. An additional constraint to take into account, is that Distance Measuring Equipment (DME) is the primary user of the aeronautical L-band. That is, any LDACS deployment has to take DME frequency planning into account, too.¶

The aeronautical community has therefore decided not to rely on a single communication system or frequency band. It is envisioned to have multiple independent data link technologies in the aircraft (e.g., terrestrial and SatCom) in addition to legacy VHF voice.¶

However, as of now no reliability and availability mechanisms that could utilize the multi-link have been specified on Layer 3 and above.¶

Below Layer 2 aeronautics usually relies on hardware redundancy. To protect availability of the LDACS link, an aircraft equipped with LDACS will have access to two L-band antennae with triple redundant radio systems as REQUIRED for any safety relevant system by ICAO.¶

9.1. MAC Entity Services

The MAC time framing service provides the frame structure necessary to realize slot-based Time Division Multiplex access on the physical link. It provides the functions for the synchronization of the MAC framing structure and the PHY Layer framing. The MAC time framing provides a dedicated time slot for each logical channel.¶

The MAC Sub-Layer offers access to the physical channel to its service users. Channel access is provided through transparent logical channels. The MAC Sub-Layer maps logical channels onto the appropriate slots and manages the access to these channels. Logical channels are used as interface between the MAC and LLC Sub-Layers.¶

The LDACS framing structure for FL and RL is based on Super-Frames (SF) of 240 ms duration. Each SF corresponds to 2000 OFDM symbols. The FL and RL SF boundaries are aligned in time (from the view of the GS).¶

In the FL, an SF contains a Broadcast Frame of duration 6.72 ms (56 OFDM symbols) for the Broadcast Control Channel (BCCH), and four Multi-Frames (MF), each of duration 58.32 ms (486 OFDM symbols).¶

In the RL, each SF starts with a Random Access (RA) slot of length 6.72 ms with two opportunities for sending RL random access frames for the Random Access Channel (RACH), followed by four MFs. These MFs have the same fixed duration of 58.32 ms as in the FL, but a different internal structure¶

Figure 3 and Figure 4 illustrate the LDACS frame structure.¶

^
|     +------+------------+------------+------------+------------+
|  FL | BCCH |     MF     |     MF     |     MF     |     MF     |
F     +------+------------+------------+------------+------------+
r     <---------------- Super-Frame (SF) - 240ms ---------------->
e
q     +------+------------+------------+------------+------------+
u  RL | RACH |     MF     |     MF     |     MF     |     MF     |
e     +------+------------+------------+------------+------------+
n     <---------------- Super-Frame (SF) - 240ms ---------------->
c
y
|
----------------------------- Time ------------------------------>
|

^
|     +-------------+------+-------------+
|  FL |     DCH     | CCCH |     DCH     |
F     +-------------+------+-------------+
r     <---- Multi-Frame (MF) - 58.32ms -->
e
q     +------+---------------------------+
u  RL | DCCH |             DCH           |
e     +------+---------------------------+
n     <---- Multi-Frame (MF) - 58.32ms -->
c
y
|
-------------------- Time ------------------>
|

9.2. DLS Entity Services

The DLS provides acknowledged and unacknowledged (including broadcast and packet mode voice) bi-directional exchange of user data. If user data is transmitted using the acknowledged DLS, the sending DLS entity will wait for an acknowledgement from the receiver. If no acknowledgement is received within a specified time frame, the sender MAY automatically try to retransmit its data. However, after a certain number of failed retries, the sender will suspend further retransmission attempts and inform its client of the failure.¶

The DLS uses the logical channels provided by the MAC:¶

1.

A GS announces its existence and access parameters in the Broadcast Channel (BC).¶

2.

The RA channel enables AS to request access to an LDACS cell.¶

3.

In the FL the CCCH is used by the GS to grant access to data channel resources.¶

4.

The reverse direction is covered by the RL, where ASs need to request resources before sending. This happens via the DCCH.¶

5.

User data itself is communicated in the Data Channel (DCH) on the FL and RL.¶

9.3. VI Services

The VI provides support for virtual voice circuits. Voice circuits MAY either be set-up permanently by the GS (e.g., to emulate voice party line) or MAY be created on demand. The creation and selection of voice circuits is performed in the LME. The VI provides only the transmission services.¶

9.4. LME Services

The mobility management service in the LME provides support for registration and de-registration (cell entry and cell exit), scanning RF channels of neighboring cells and handover between cells. In addition, it manages the addressing of aircraft/ ASs within cells. It is controlled by the network management service in the GSC.¶

The resource management service provides link maintenance (power, frequency and time adjustments), support for adaptive coding and modulation, and resource allocation.¶

9.5. SNP Services

The DLS provides functions REQUIRED for the transfer of user plane data and control plane data over the LDACS sub-network.¶

The security service provides functions for secure communication over the LDACS sub-network. Note that the SNP security service applies cryptographic measures as configured by the GSC.¶

10.1. Reasons for Wireless Digital Aeronautical Communications

Aviation will require secure exchanges of data and voice messages for managing the air-traffic flow safely through the airspaces all over the world. Historically Communication Navigation Surveillance (CNS) wireless communications technology emerged from military and a threat landscape where inferior technological and financial capabilities of adversaries were assumed [STR2016]. The main communication method for ATC today is still an open analogue voice broadcast within the aeronautical VHF band. Currently, the information security is purely procedural based by using well-trained personnel and proven communications procedures. This communication method has been in service since 1948. However since the emergence of civil aeronautical CNS application and today, the world has changed. First of all civil applications have significant lower spectrum available than military applications. This means several military defense mechanisms such as frequency hopping or pilot symbol scrambling and thus a defense-in-depth approach starting at the physical layer is impossible for civil systems. With the rise of cheap Software Defined Radios, the previously existing financial barrier is almost gone and open source projects such as GNU radio [GNU2012] allow the new type of unsophisticated listeners and possible attackers. Furthermore most CNS technology developed in ICAO relies on open standards, thus syntax and semantics of wireless digital aeronautical communications can be common knowledge for attackers. Finally with increased digitization and automation of civil aviation the human as control instance is being taken gradually out of the loop. Autonomous transport drones or single piloted aircraft demonstrate this trend. However without profound cybersecurity measures such as authenticity and integrity checks of messages in-transit on the wireless link or mutual entity authentication, this lack of a control instance can prove disastrous. Thus future digital communications waveforms will need additional embedded security features to fulfill modern information security requirements like authentication and integrity. However, these security features require sufficient bandwidth which is beyond the capabilities of a VHF narrowband communications system. For voice and data communications, sufficient data throughput capability is needed to support the security functions while not degrading performance. LDACS is a data link technology with sufficient bandwidth to incorporate security without losing too much user throughput.¶

As digitalization progresses even further with LDACS and automated procedures such as 4D-Trajectories allowing semi-automated en-route flying of aircraft, LDACS requires stronger cybersecurity measures.¶

10.2. Requirements for LDACS

Overall there are several business goals for cybersecurity to protect in FCI in civil aviation:¶

1.

Safety: The system MUST sufficiently mitigate attacks, which contribute to safety hazards.¶

2.

Flight regularity: The system MUST sufficiently mitigate attacks, which contribute to delays, diversions, or cancellations of flights.¶

3.

Protection of business interests: The system MUST sufficiently mitigate attacks which result in financial loss, reputation damage, disclosure of sensitive proprietary information, or disclosure of personal information.¶

To further analyze assets and derive threats and thus protection scenarios several Threat-and Risk Analysis were performed for LDACS [MAE20181] , [MAE20191]. These results allowed deriving security scope and objectives from the requirements and the conducted Threat-and Risk Analysis.¶

10.3. Security Objectives for LDACS

Security considerations for LDACS are defined by the official Standards And Recommended Practices document by ICAO [ICA2018]:¶

1.

LDACS SHALL provide a capability to protect the availability and continuity of the system.¶

2.

LDACS SHALL provide a capability including cryptographic mechanisms to protect the integrity of messages in transit.¶

3.

LDACS SHALL provide a capability to ensure the authenticity of messages in transit.¶

4.

LDACS SHOULD provide a capability for nonrepudiation of origin for messages in transit.¶

5.

LDACS SHOULD provide a capability to protect the confidentiality of messages in transit.¶

6.

LDACS SHALL provide an authentication capability.¶

7.

LDACS SHALL provide a capability to authorize the permitted actions of users of the system and to deny actions that are not explicitly authorized.¶

8.

If LDACS provides interfaces to multiple domains, LDACS SHALL provide capability to prevent the propagation of intrusions within LDACS domains and towards external domains.¶

10.4. Security Functions for LDACS

These objectives were used to derive several security functions for LDACS REQUIRED to be integrated in the LDACS cybersecurity architecture: (1) Identification, (2) Authentication, (3) Authorization, (4) Confidentiality, (5) System Integrity, (6) Data Integrity, (7) Robustness, (8) Reliability, (9) Availability, and (10) Key and Trust Management. Several works investigated possible measures to implement these security functions [BIL2017], [MAE20181], [MAE20191]. Having identified security requirements, objectives and functions it MUST be ensured that they are applicable.¶

10.5. Resulting Security Architectural Details

The requirements lead to a LDACS security model including different entities for identification, authentication and authorization purposes ensuring integrity, authenticity and confidentiality of data in-transit especially.¶

10.6. Security Modules for LDACS

A draft of the cybersecurity architecture of LDACS can be found in [ICA2018] and [MAE20182] and respective updates in [MAE20191], [MAE20192], and [MAE2020]. It proposes the use of an own LDACS PKI, identity management based on aircraft identities and network operator identities (e.g., SITA and ARINC), public key certificates incorporated in the PKI based chain-of-trust and stored in the entities allowing for mutual authentication and key exchange procedures, key derivation mechanisms for perfect forward secrecy and user/control plane message-in-transit integrity and confidentiality protection. This secures data traveling over the airgap between AS and GS and also between GS and ANSP regardless of the secure or unsecure nature of application data. Of course application data itself MUST be additionally secured to achieve end-to-end security (secure dialogue service), however the LDACS datalinks aims to provide an additional layer of protection just for this network segment.¶