Defeating Electronic Warfare and Ghost Aircraft Attacks in ADS-B

Technical analysis and engineering reference.

1. The Vulnerability of Clear-Text Broadcast Systems

Automatic Dependent Surveillance-Broadcast (ADS-B) was engineered in the 1990s as an unencrypted, unauthenticated broadcast protocol to enhance situational awareness. Today, commercial software-defined radios (SDRs) costing less than $200 allow malicious actors to flood terminal airspace with synthetic ghost aircraft, forge emergency squawk codes (7700), or mask real airborne hazards.

2. Cryptographic Tagging Without Bandwidth Expansion

The 1090 MHz Extended Squitter message offers strictly limited payload space (112 bits total, with only 56 bits of operational message data). AirspaceSec solves this bottleneck via Phase Modulation Keying (PMK): - Overlaying a low-amplitude phase-modulated cryptographic authentication tag onto the standard pulse-position modulated carrier. - Standard avionics receivers decode classic ADS-B without degradation. - Secure receivers extract the phase-embedded message authentication code (MAC), verifying aircraft provenance.

3. Physical Layer Cross-Validation

Even if private keys are compromised, physics-based RF fingerprinting detects emitter hardware idiosyncrasies. Intentional frequency offsets, amplifier non-linearities, and transient turn-on signatures are analyzed at LEO spaceborne nodes, providing defense-in-depth.

Explore Domain Portfolio