Adaptable Hardware Fingerprinting for Radio Data Links and Avionics Buses in Adversarial Settings

Abstract

Despite their substantially different purposes, a common issue both for many legacy data links and many onboard data buses used in aviation is a lack of authentication and thus a vulnerability to spoofing and message manipulation attacks. This problem has been discussed at length for some prominent technologies of both sorts (e.g., ADS-B, ARINC 429) but is common in many more cases (e.g., ACARS, CPDLC, MIL-STD-1553, RS-485). For ground data links, attacks can take place over-the-air, while for onboard buses an attacker requires some physical access to an aircraft. Yet, in both cases an attacker's goal is to obtain control of a transceiver on the communication channel. As such, hardware fingerprinting methods are useful in both contexts. Prior work has applied such methods to specific protocols. We now propose a transferable fingerprinting scheme that has applicability in both contexts, describe our experiences in applying it for each and evaluate its performance in benign and malicious conditions. As replacing legacy communication links with newer, more secure protocols is practically challenging, the improvements to practical deployment offered by our system represent a meaningful benefit for real deployment efforts.