idnits 2.17.1 draft-ietf-raw-ldacs-05.txt: Checking boilerplate required by RFC 5378 and the IETF Trust (see https://trustee.ietf.org/license-info): ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/1id-guidelines.txt: ---------------------------------------------------------------------------- No issues found here. Checking nits according to https://www.ietf.org/id-info/checklist : ---------------------------------------------------------------------------- No issues found here. Miscellaneous warnings: ---------------------------------------------------------------------------- == The copyright year in the IETF Trust and authors Copyright Line does not match the current year -- The document date (1 November 2020) is 1272 days in the past. Is this intentional? Checking references for intended status: Informational ---------------------------------------------------------------------------- == Outdated reference: A later version (-08) exists of draft-ietf-raw-technologies-00 == Outdated reference: A later version (-11) exists of draft-ietf-raw-use-cases-00 Summary: 0 errors (**), 0 flaws (~~), 3 warnings (==), 1 comment (--). Run idnits with the --verbose option for more detailed information about the items above. -------------------------------------------------------------------------------- 2 RAW N. Maeurer, Ed. 3 Internet-Draft T. Graeupl, Ed. 4 Intended status: Informational German Aerospace Center (DLR) 5 Expires: 5 May 2021 C. Schmitt, Ed. 6 Research Institute CODE, UniBwM 7 1 November 2020 9 L-band Digital Aeronautical Communications System (LDACS) 10 draft-ietf-raw-ldacs-05 12 Abstract 14 This document provides an overview of the architecture of the L-band 15 Digital Aeronautical Communications System (LDACS), which provides a 16 secure, scalable and spectrum efficient terrestrial data link for 17 civil aviation. LDACS is a scheduled, reliable multi-application 18 cellular broadband system with support for IPv6. LDACS SHALL provide 19 a data link for IP network-based aircraft guidance. High reliability 20 and availability for IP connectivity over LDACS are therefore 21 essential. 23 Status of This Memo 25 This Internet-Draft is submitted in full conformance with the 26 provisions of BCP 78 and BCP 79. 28 Internet-Drafts are working documents of the Internet Engineering 29 Task Force (IETF). Note that other groups may also distribute 30 working documents as Internet-Drafts. The list of current Internet- 31 Drafts is at https://datatracker.ietf.org/drafts/current/. 33 Internet-Drafts are draft documents valid for a maximum of six months 34 and may be updated, replaced, or obsoleted by other documents at any 35 time. It is inappropriate to use Internet-Drafts as reference 36 material or to cite them other than as "work in progress." 38 This Internet-Draft will expire on 5 May 2021. 40 Copyright Notice 42 Copyright (c) 2020 IETF Trust and the persons identified as the 43 document authors. All rights reserved. 45 This document is subject to BCP 78 and the IETF Trust's Legal 46 Provisions Relating to IETF Documents (https://trustee.ietf.org/ 47 license-info) in effect on the date of publication of this document. 48 Please review these documents carefully, as they describe your rights 49 and restrictions with respect to this document. Code Components 50 extracted from this document must include Simplified BSD License text 51 as described in Section 4.e of the Trust Legal Provisions and are 52 provided without warranty as described in the Simplified BSD License. 54 Table of Contents 56 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3 57 1.1. Requirements Language . . . . . . . . . . . . . . . . . . 4 58 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 59 3. Motivation and Use Cases . . . . . . . . . . . . . . . . . . 5 60 3.1. Voice Communications Today . . . . . . . . . . . . . . . 5 61 3.2. Data Communications Today . . . . . . . . . . . . . . . . 6 62 4. Provenance and Documents . . . . . . . . . . . . . . . . . . 7 63 5. Applicability . . . . . . . . . . . . . . . . . . . . . . . . 8 64 5.1. Advances Beyond the State-of-the-Art . . . . . . . . . . 8 65 5.1.1. Priorities . . . . . . . . . . . . . . . . . . . . . 8 66 5.1.2. Security . . . . . . . . . . . . . . . . . . . . . . 8 67 5.1.3. High Data Rates . . . . . . . . . . . . . . . . . . . 9 68 5.2. Application . . . . . . . . . . . . . . . . . . . . . . . 9 69 5.2.1. Air-to-Ground Multilink . . . . . . . . . . . . . . . 9 70 5.2.2. Air-to-Air Extension for LDACS . . . . . . . . . . . 9 71 5.2.3. Flight Guidance . . . . . . . . . . . . . . . . . . . 10 72 5.2.4. Business Communication of Airlines . . . . . . . . . 11 73 5.2.5. LDACS Navigation . . . . . . . . . . . . . . . . . . 11 74 6. Requirements to LDACS . . . . . . . . . . . . . . . . . . . . 11 75 7. Characteristics of LDACS . . . . . . . . . . . . . . . . . . 13 76 7.1. LDACS Sub-Network . . . . . . . . . . . . . . . . . . . . 13 77 7.2. Topology . . . . . . . . . . . . . . . . . . . . . . . . 14 78 7.3. LDACS Physical Layer . . . . . . . . . . . . . . . . . . 14 79 7.4. LDACS Data Link Layer . . . . . . . . . . . . . . . . . . 15 80 7.5. LDACS Mobility . . . . . . . . . . . . . . . . . . . . . 15 81 8. Reliability and Availability . . . . . . . . . . . . . . . . 15 82 8.1. Layer 2 . . . . . . . . . . . . . . . . . . . . . . . . . 15 83 8.2. Beyond Layer 2 . . . . . . . . . . . . . . . . . . . . . 18 84 9. Protocol Stack . . . . . . . . . . . . . . . . . . . . . . . 18 85 9.1. MAC Entity Services . . . . . . . . . . . . . . . . . . . 19 86 9.2. DLS Entity Services . . . . . . . . . . . . . . . . . . . 21 87 9.3. VI Services . . . . . . . . . . . . . . . . . . . . . . . 22 88 9.4. LME Services . . . . . . . . . . . . . . . . . . . . . . 22 89 9.5. SNP Services . . . . . . . . . . . . . . . . . . . . . . 22 90 10. Security Considerations . . . . . . . . . . . . . . . . . . . 22 91 10.1. Reasons for Wireless Digital Aeronautical 92 Communications . . . . . . . . . . . . . . . . . . . . . 22 93 10.2. Requirements for LDACS . . . . . . . . . . . . . . . . . 23 94 10.3. Security Objectives for LDACS . . . . . . . . . . . . . 24 95 10.4. Security Functions for LDACS . . . . . . . . . . . . . . 24 96 10.5. Security Architectural Details for LDACS . . . . . . . . 24 97 10.5.1. Entities in LDACS Security Model . . . . . . . . . . 25 98 10.5.2. Matter of LDACS Entity Identification . . . . . . . 25 99 10.5.3. Matter of LDACS Entity Authentication and Key 100 Negotiation . . . . . . . . . . . . . . . . . . . . . 25 101 10.5.4. Matter of LDACS Message-in-transit Confidentiality, 102 Integrity and Authenticity . . . . . . . . . . . . . 26 103 10.6. Security Architecture for LDACS . . . . . . . . . . . . 26 104 11. Privacy Considerations . . . . . . . . . . . . . . . . . . . 27 105 12. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 27 106 13. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 27 107 14. Normative References . . . . . . . . . . . . . . . . . . . . 27 108 15. Informative References . . . . . . . . . . . . . . . . . . . 27 109 Appendix A. Selected Information from DO-350A . . . . . . . . . 30 110 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 32 112 1. Introduction 114 One of the main pillars of the modern Air Traffic Management (ATM) 115 system is the existence of a communication infrastructure that 116 enables efficient aircraft control and safe separation in all phases 117 of flight. Current systems are technically mature but suffering from 118 the VHF band's increasing saturation in high-density areas and the 119 limitations posed by analogue radio communications. Therefore, 120 aviation globally and the European Union (EU) in particular, strives 121 for a sustainable modernization of the aeronautical communication 122 infrastructure. 124 In the long-term, ATM communication SHALL transition from analogue 125 VHF voice and VDLM2 communication to more spectrum efficient digital 126 data communication. The European ATM Master Plan foresees this 127 transition to be realized for terrestrial communications by the 128 development (and potential implementation) of the L-band Digital 129 Aeronautical Communications System (LDACS). LDACS SHALL enable IPv6 130 based air- ground communication related to the aviation safety and 131 regularity of flight. The particular challenge is that no additional 132 spectrum can be made available for terrestrial aeronautical 133 communication. It was thus necessary to develop co-existence 134 mechanism/procedures to enable the interference free operation of 135 LDACS in parallel with other aeronautical services/systems in the 136 same frequency band. 138 Since LDACS SHALL be used for aircraft guidance, high reliability and 139 availability for IP connectivity over LDACS are essential. 141 1.1. Requirements Language 143 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", 144 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this 145 document are to be interpreted as described in RFC 2119 [RFC2119]. 147 2. Terminology 149 The following terms are used in the context of RAW in this document: 151 A2A Air-to-Air 152 AeroMACS Aeronautical Mobile Airport Communication System 153 A2G Air-to-Ground 154 ACARS Aircraft Communications Addressing and Reporting System 155 ADS-C Automatic Dependent Surveillance - Contract 156 AM(R)S Aeronautical Mobile (Route) Service 157 ANSP Air Traffic Network Service Provider 158 AOC Aeronautical Operational Control 159 AS Aircraft Station 160 ATC Air-Traffic Control 161 ATM Air-Traffic Management 162 ATN Aeronautical Telecommunication Network 163 ATS Air Traffic Service 164 CCCH Common Control Channel 165 COTS IP Commercial Off-The-Shelf 166 CM Context Management 167 CNS Communication Navigation Surveillance 168 CPDLC Controller Pilot Data Link Communication 169 DCCH Dedicated Control Channel 170 DCH Data Channel 171 DLL Data Link Layer 172 DLS Data Link Service 173 DME Distance Measuring Equipment 174 DSB-AM Double Side-Band Amplitude Modulation 175 FCI Future Communication Infrastructure 176 FL Forward Link 177 GNSS Global Navigation Satellite System 178 GS Ground-Station 179 GSC Ground-Station Controller 180 G2A Ground-to-Air 181 HF High Frequency 182 ICAO International Civil Aviation Organization 183 IP Internet Protocol 184 kbit/s kilobit per second 185 LDACS L-band Digital Aeronautical Communications System 186 LLC Logical Link Control 187 LME LDACS Management Entity 188 MAC Medium Access Layer 189 MF Multi Frame 190 OFDM Orthogonal Frequency-Division Multiplexing 191 OFDMA Orthogonal Frequency-Division Multiplexing Access 192 OSI Open Systems Interconnection 193 PHY Physical Layer 194 RL Reverse Link 195 SF Super-Frame 196 SNP Sub-Network Protocol 197 TDMA Time-Division Multiplexing-Access 198 VDLM1 VHF Data Link mode 1 199 VDLM2 VHF Data Link mode 2 200 VHF Very High Frequency 201 VI Voice Interface 203 3. Motivation and Use Cases 205 Aircraft are currently connected to Air-Traffic Control (ATC) and 206 Aeronautical Operational Control (AOC) via voice and data 207 communications systems through all phases of a flight. Within the 208 airport terminal, connectivity is focused on high bandwidth 209 communications, while during en-route high reliability, robustness, 210 and range is the main focus. Voice communications MAY use the same 211 or different equipment as data communications systems. In the 212 following the main differences between voice and data communications 213 capabilities are summarized. The assumed use cases for LDACS 214 completes the list of use cases stated in [RAW-USE-CASES] and the 215 list of reliable and available wireless technologies presented in 216 [RAW-TECHNOS]. 218 3.1. Voice Communications Today 220 Voice links are used for Air-to-Ground (A2G) and Air-to-Air (A2A) 221 communications. The communication equipment is either ground-based 222 working in the High Frequency (HF) or Very High Frequency (VHF) 223 frequency band or satellite-based. All VHF and HF voice 224 communications is operated via open broadcast channels without 225 authentication, encryption or other protective measures. The use of 226 well-proven communication procedures via broadcast channels helps to 227 enhance the safety of communications by taking into account that 228 other users MAY encounter communication problems and MAY be 229 supported, if REQUIRED. The main voice communications media is still 230 the analogue VHF Double Side-Band Amplitude Modulation (DSB-AM) 231 communications technique, supplemented by HF Single Side-Band 232 Amplitude Modulation and satellite communications for remote and 233 oceanic areas. DSB-AM has been in use since 1948, works reliably and 234 safely, and uses low-cost communication equipment. These are the 235 main reasons why VHF DSB-AM communications is still in use, and it is 236 likely that this technology will remain in service for many more 237 years. This however results in current operational limitations and 238 impediments in deploying new Air-Traffic Management (ATM) 239 applications, such as flight-centric operation with Point-to-Point 240 communications. 242 3.2. Data Communications Today 244 Like for voice, data communications into the cockpit is currently 245 provided by ground-based equipment operating either on HF or VHF 246 radio bands or by legacy satellite systems. All these communication 247 systems are using narrowband radio channels with a data throughput 248 capacity in order of kilobits per second. While the aircraft is on 249 ground some additional communications systems are available, like the 250 Aeronautical Mobile Airport Communication System (AeroMACS) or public 251 cellular networks, operating in the Airport (APT) domain and able to 252 deliver broadband communication capability. 254 The data communication networks used for the transmission of data 255 relating to the safety and regularity of the flight MUST be strictly 256 isolated from those providing entertainment services to passengers. 257 This leads to a situation that the flight crews are supported by 258 narrowband services during flight while passengers have access to 259 inflight broadband services. The current HF and VHF data links 260 cannot provide broadband services now or in the future, due to the 261 lack of available spectrum. This technical shortcoming is becoming a 262 limitation to enhanced ATM operations, such as Trajectory-Based 263 Operations and 4D trajectory negotiations. 265 Satellite-based communications are currently under investigation and 266 enhanced capabilities are under development which will be able to 267 provide inflight broadband services and communications supporting the 268 safety and regularity of flight. In parallel, the ground-based 269 broadband data link technology LDACS is being standardized by ICAO 270 and has recently shown its maturity during flight tests [SCH20191]. 271 The LDACS technology is scalable, secure and spectrum efficient and 272 provides significant advantages to the users and service providers. 273 It is expected that both - satellite systems and LDACS - will be 274 deployed to support the future aeronautical communication needs as 275 envisaged by the ICAO Global Air Navigation Plan. 277 4. Provenance and Documents 279 The development of LDACS has already made substantial progress in the 280 Single European Sky ATM Research framework, short SESAR, and is 281 currently being continued in the follow-up program SESAR2020 282 [RIH2018]. A key objective of the this activities is to develop, 283 implement and validate a modern aeronautical data link able to evolve 284 with aviation needs over long-term. To this end, an LDACS 285 specification has been produced [GRA2019] and is continuously 286 updated; transmitter demonstrators were developed to test the 287 spectrum compatibility of LDACS with legacy systems operating in the 288 L-band [SAJ2014]; and the overall system performance was analyzed by 289 computer simulations, indicating that LDACS can fulfil the identified 290 requirements [GRA2011]. 292 LDACS standardization within the framework of the ICAO started in 293 December 2016. The ICAO standardization group has produced an 294 initial Standards and Recommended Practices document [ICA2018]. It 295 defines the general characteristics of LDACS. The ICAO 296 standardization group plans to produce an ICAO technical manual - the 297 ICAO equivalent to a technical standard - within the next years. 298 Generally, the group is open to input from all sources and develops 299 LDACS in the open. 301 Up to now LDACS standardization has been focused on the development 302 of the physical layer and the data link layer, only recently have 303 higher layers come into the focus of the LDACS development 304 activities. There is currently no "IPv6 over LDACS" specification 305 publicly available; however, SESAR2020 has started the testing of 306 IPv6-based LDACS testbeds. 308 The IPv6 architecture for the aeronautical telecommunication network 309 is called the Future Communications Infrastructure (FCI). FCI SHALL 310 support quality of service, diversity, and mobility under the 311 umbrella of the "multi-link concept". This work is conducted by ICAO 312 Communication Panel working group WG-I. 314 In addition to standardization activities several industrial LDACS 315 prototypes have been built. One set of LDACS prototypes has been 316 evaluated in flight trials confirming the theoretical results 317 predicting the system performance [GRA2018] [SCH20191]. 319 5. Applicability 321 LDACS is a multi-application cellular broadband system capable of 322 simultaneously providing various kinds of Air Traffic Services 323 (including ATS-B3) and AOC communications services from deployed 324 Ground-Stations (GS). The LDACS A2G sub-system physical layer and 325 data link layer are optimized for data link communications, but the 326 system also supports digital air-ground voice communications. 328 LDACS supports communication in all airspaces (airport, terminal 329 maneuvering area, and en-route), and on the airport surface. The 330 physical LDACS cell coverage is effectively de-coupled from the 331 operational coverage REQUIRED for a particular service. This is new 332 in aeronautical communications. Services requiring wide-area 333 coverage can be installed at several adjacent LDACS cells. The 334 handover between the involved LDACS cells is seamless, automatic, and 335 transparent to the user. Therefore, the LDACS A2G communications 336 concept enables the aeronautical communication infrastructure to 337 support future dynamic airspace management concepts. 339 5.1. Advances Beyond the State-of-the-Art 341 LDACS offers several capabilities that are not provided in 342 contemporarily deployed aeronautical communication systems. 344 5.1.1. Priorities 346 LDACS is able to manage services priorities, an important feature not 347 available in some of the current data link deployments. Thus, LDACS 348 guarantees bandwidth, low latency, and high continuity of service for 349 safety critical ATS applications while simultaneously accommodating 350 less safety-critical AOC services. 352 5.1.2. Security 354 LDACS is a secure data link with built-in security mechanisms. It 355 enables secure data communications for ATS and AOC services, 356 including secured private communications for aircraft operators and 357 ANSPs (Air Traffic Network Service Providers). This includes 358 concepts for key and trust management, mutual authenticated key 359 exchange protocols, key derivation measures, user and control 360 message-in-transit confidentiality and authenticity protection, 361 secure logging and availability and robustness measures [MAE20181], 362 [MAE20191], [MAE20192]. 364 5.1.3. High Data Rates 366 The user data rate of LDACS is 315 kbit/s to 1428 kbit/s on the 367 forward link (FL) for the connection Ground-to-Air (G2A), and 294 368 kbit/s to 1390 kbit/s on the reverse link (RF) for the connection 369 A2G, depending on coding and modulation. This is 50 times the amount 370 terrestrial digital aeronautical communications systems such as VDLM2 371 provide [SCH20191]. 373 5.2. Application 375 LDACS SHALL be used by several aeronautical applications ranging from 376 enhanced communication protocol stacks (multi-homed mobile IPv6 377 networks in the aircraft and potentially ad-hoc networks between 378 aircraft) to classical communication applications (sending GBAS 379 correction data) and integration with other service domains (using 380 the communication signal for navigation). 382 5.2.1. Air-to-Ground Multilink 384 It is expected that LDACS together with upgraded satellite-based 385 communications systems will be deployed within the FCI and constitute 386 one of the main components of the multilink concept within the FCI. 388 Both technologies, LDACS and satellite systems, have their specific 389 benefits and technical capabilities which complement each other. 390 Especially, satellite systems are well-suited for large coverage 391 areas with less dense air traffic, e.g. oceanic regions. LDACS is 392 well-suited for dense air traffic areas, e.g. continental areas or 393 hot-spots around airports and terminal airspace. In addition, both 394 technologies offer comparable data link capacity and, thus, are well- 395 suited for redundancy, mutual back-up, or load balancing. 397 Technically the FCI multilink concept SHALL be realized by multi- 398 homed mobile IPv6 networks in the aircraft. The related protocol 399 stack is currently under development by ICAO and the Single European 400 Sky ATM Research framework. 402 5.2.2. Air-to-Air Extension for LDACS 404 A potential extension of the multi-link concept is its extension to 405 ad-hoc networks between aircraft. 407 Direct A2A communication between aircrafts in terms of ad-hoc data 408 networks is currently considered a research topic since there is no 409 immediate operational need for it, although several possible use 410 cases are discussed (digital voice, wake vortex warnings, and 411 trajectory negotiation) [BEL2019]. It SHOULD also be noted that 412 currently deployed analog VHF voice radios support direct voice 413 communication between aircraft, making a similar use case for digital 414 voice plausible. 416 LDACS direct A2A is currently not part of standardization. 418 5.2.3. Flight Guidance 420 The FCI (and therefore LDACS) SHALL be used to host flight guidance. 421 This is realized using three applications: 423 1. Context Management (CM): The CM application SHALL manage the 424 automatic logical connection to the ATC center currently 425 responsible to guide the aircraft. Currently this is done by the 426 air crew manually changing VHF voice frequencies according to the 427 progress of the flight. The CM application automatically sets up 428 equivalent sessions. 429 2. Controller Pilot Data Link Communication (CPDLC): The CPDLC 430 application provides the air crew with the ability to exchange 431 data messages similar to text messages with the currently 432 responsible ATC center. The CPDLC application SHALL take over 433 most of the communication currently performed over VHF voice and 434 enable new services that do not lend themselves to voice 435 communication (e.g., trajectory negotiation). 436 3. Automatic Dependent Surveillance - Contract (ADS-C): ADS-C 437 reports the position of the aircraft to the currently active ATC 438 center. Reporting is bound to "contracts", i.e. pre-defined 439 events related to the progress of the flight (i.e. the 440 trajectory). ADS-C and CPDLC are the primary applications used to 441 implement in-flight trajectory management. 443 CM, CPDLC, and ADS-C are available on legacy datalinks, but not 444 widely deployed and with limited functionality. 446 Further ATC applications MAY be ported to use the FCI or LDACS as 447 well. A notable application is GBAS for secure, automated landings: 448 The Global Navigation Satellite System (GNSS) based Ground Based 449 Augmentation System (GBAS) is used to improve the accuracy of GNSS to 450 allow GNSS based instrument landings. This is realized by sending 451 GNSS correction data (e.g., compensating ionospheric errors in the 452 GNSS signal) to the aircraft's GNSS receiver via a separate data 453 link. Currently the VDB data link is used. VDB is a narrow-band 454 single-purpose datalink without advanced security only used to 455 transmit GBAS correction data. This makes VDB a natural candidate 456 for replacement by LDACS. 458 5.2.4. Business Communication of Airlines 460 In addition to air traffic services AOC services SHALL be transmitted 461 over LDACS. AOC is a generic term referring to the business 462 communication of airlines. Regulatory this is considered related to 463 the safety and regularity of flight and MAY therefore be transmitted 464 over LDACS. 466 AOC communication is considered the main business case for LDACS 467 communication service providers since modern aircraft generate 468 significant amounts of data (e.g., engine maintenance data). 470 5.2.5. LDACS Navigation 472 Beyond communication radio signals can always also be used for 473 navigation. LDACS takes this into account. 475 For future aeronautical navigation, ICAO recommends the further 476 development of GNSS based technologies as primary means for 477 navigation. However, the drawback of GNSS is its inherent single 478 point of failure - the satellite. Due to the large separation 479 between navigational satellites and aircraft, the received power of 480 GNSS signals on the ground is very low. As a result, GNSS 481 disruptions might occasionally occur due to unintentional 482 interference, or intentional jamming. Yet the navigation services 483 MUST be available with sufficient performance for all phases of 484 flight. Therefore, during GNSS outages, or blockages, an alternative 485 solution is needed. This is commonly referred to as Alternative 486 Positioning, Navigation, and Timing (APNT). 488 One of such APNT solution consists of integrating the navigation 489 functionality into LDACS. The ground infrastructure for APNT is 490 deployed through the implementation of LDACS's GSs and the navigation 491 capability comes "for free". 493 LDACS navigation has already been demonstrated in practice in a 494 flight measurement campaign [SCH20191]. 496 6. Requirements to LDACS 498 The requirements to LDACS are mostly defined by its application area: 499 Communication related to safety and regularity of flight. 501 A particularity of the current aeronautical communication landscape 502 is that it is heavily regulated. Aeronautical data links (for 503 applications related to safety and regularity of flight) MAY only use 504 spectrum licensed to aviation and data links endorsed by ICAO. 505 Nation states can change this locally, however, due to the global 506 scale of the air transportation system adherence to these practices 507 is to be expected. 509 Aeronautical data links for the Aeronautical Telecommunication 510 Network (ATN) are therefore expected to remain in service for 511 decades. The VDLM2 data link currently used for digital terrestrial 512 internetworking was developed in the 1990es (the use of the Open 513 Systems Interconnection (OSI) stack indicates that as well). VDLM2 514 is expected to be used at least for several decades. In this respect 515 aeronautical communication (for applications related to safety and 516 regularity of flight) is more comparable to industrial applications 517 than to the open Internet. 519 Internetwork technology is already installed in current aircraft. 520 Current ATS applications use either the Aircraft Communications 521 Addressing and Reporting System (ACARS) or the OSI stack. The 522 objective of the development effort LDACS as part of the FCI is to 523 replace legacy OSI stack and proprietary ACARS internetwork 524 technologies with industry standard IP technology. It is anticipated 525 that the use of Commercial Off-The-Shelf (COTS) IP technology mostly 526 applies to the ground network. The avionics networks on the aircraft 527 will likely be heavily modified or proprietary. 529 AOC applications currently mostly use the same stack (although some 530 applications, like the graphical weather service MAY use the 531 commercial passenger network). This creates capacity problems 532 (resulting in excessive amounts of timeouts) since the underlying 533 terrestrial data links (VDLM1/2) do not provide sufficient bandwidth. 534 The use of non-aviation specific data links is considered a security 535 problem. Ideally the aeronautical IP internetwork and the Internet 536 SHOULD be completely separated. 538 The objective of LDACS is to provide a next generation terrestrial 539 data link designed to support IP and provide much higher bandwidth to 540 avoid the currently experienced operational problems. 542 The requirement for LDACS is therefore to provide a terrestrial high- 543 throughput data link for IP internetworking in the aircraft. 545 In order to fulfil the above requirement LDACS needs to be 546 interoperable with IP (and IP-based services like Voice-over-IP) at 547 the gateway connecting the LDACS network to other aeronautical ground 548 networks (the totality of them being the ATN). On the avionics side 549 in the aircraft aviation specific solutions are to be expected. 551 In addition to the functional requirements LDACS and its IP stack 552 need to fulfil the requirements defined in RTCA DO-350A/EUROCAE ED- 553 228A [DO350A]. This document defines continuity, availability, and 554 integrity requirements at different scopes for each air traffic 555 management application (CPDLC, CM, and ADS-C). The scope most 556 relevant to IP over LDACS is the CSP (Communication Service Provider) 557 scope. 559 Continuity, availability, and integrity requirements are defined in 560 [DO350A] volume 1 Table 5-14, and Table 6-13. Appendix A presents 561 the REQUIRED information. 563 In a similar vein, requirements to fault management are defined in 564 the same tables. 566 7. Characteristics of LDACS 568 LDACS will become one of several wireless access networks connecting 569 aircraft to the ATN implemented by the FCI and possibly ACARS/FANS 570 networks [FAN2019]. 572 The current LDACS design is focused on the specification of layer 2. 574 Achieving stringent the continuity, availability, and integrity 575 requirements defined in [DO350A] will require the specification of 576 layer 3 and above mechanisms (e.g. reliable crossover at the IP 577 layer). Fault management mechanisms are similarly undefined. Input 578 from the working group will be appreciated here. 580 7.1. LDACS Sub-Network 582 An LDACS sub-network contains an Access Router (AR), a Ground-Station 583 Controller (GSC), and several GS, each of them providing one LDACS 584 radio cell. 586 User plane interconnection to the ATN is facilitated by the AR 587 peering with an A2G Router connected to the ATN. It is up to 588 implementer's choice to keep AR and A2G Router functions separated, 589 or to merge them. 591 The internal control plane of an LDACS sub-network is managed by the 592 GSC. An LDACS sub-network is illustrated in Figure 1. 594 wireless user 595 link plane 596 A--------------G----------------AR---A2G-----ATN 597 S..............S | Router 598 . control . | 599 . plane . | 600 . . | 601 GSC..............| 602 . | 603 . | 604 GS---------------+ 606 Figure 1: LDACS sub-network with two GSs and one AS 608 7.2. Topology 610 LDACS operating in A2G mode is a cellular point-to-multipoint system. 611 The A2G mode assumes a star-topology in each cell where Aircraft 612 Stations (AS) belonging to aircraft within a certain volume of space 613 (the LDACS cell) is connected to the controlling GS. The LDACS GS is 614 a centralized instance that controls LDACS A2G communications within 615 its cell. The LDACS GS can simultaneously support multiple bi- 616 directional communications to the ASs under its control. LDACS's GSs 617 themselves are connected to a GSC controlling the LDACS sub-network. 619 Prior to utilizing the system an AS has to register with the 620 controlling GS to establish dedicated logical channels for user and 621 control data. Control channels have statically allocated resources, 622 while user channels have dynamically assigned resources according to 623 the current demand. Logical channels exist only between the GS and 624 the AS. 626 The LDACS wireless link protocol stack defines two layers, the 627 physical layer and the data link layer. 629 7.3. LDACS Physical Layer 631 The physical layer provides the means to transfer data over the radio 632 channel. The LDACS GS supports bi-directional links to multiple 633 aircraft under its control. The FL direction at the G2A connection 634 and the RL direction at the A2G connection are separated by Frequency 635 Division Duplex. FL and RL use a 500 kHz channel each. The GS 636 transmits a continuous stream of Orthogonal Frequency-Division 637 Multiplexing (OFDM) symbols on the FL. In the RL different aircraft 638 are separated in time and frequency using a combination of Orthogonal 639 Frequency-Division Multiple-Access (OFDMA) and Time-Division 640 Multiple-Access (TDMA). Aircraft thus transmit discontinuously on 641 the RL with radio bursts sent in precisely defined transmission 642 opportunities allocated by the GS. 644 7.4. LDACS Data Link Layer 646 The data-link layer provides the necessary protocols to facilitate 647 concurrent and reliable data transfer for multiple users. The LDACS 648 data link layer is organized in two sub-layers: The medium access 649 sub-layer and the Logical Link Control (LLC) sub-layer. The medium 650 access sub-layer manages the organization of transmission 651 opportunities in slots of time and frequency. The LLC sub-layer 652 provides acknowledged point-to-point logical channels between the 653 aircraft and the GS using an automatic repeat request protocol. 654 LDACS supports also unacknowledged point-to-point channels and G2A 655 broadcast. 657 7.5. LDACS Mobility 659 LDACS supports layer 2 handovers to different LDACS channels. 660 Handovers MAY be initiated by the aircraft (break-before-make) or by 661 the GS (make-before-break). Make-before-break handovers are only 662 supported for GSs connected to the same GSC. 664 External handovers between non-connected LDACS sub-networks or 665 different aeronautical data links SHALL be handled by the FCI multi- 666 link concept. 668 8. Reliability and Availability 670 8.1. Layer 2 672 LDACS has been designed with applications related to the safety and 673 regularity of flight in mind. It has therefore been designed as a 674 deterministic wireless data link (as far as this is possible). 676 Based on channel measurements of the L-band channel [SCHN2016] and 677 respecting the specific nature of the area of application, LDACS was 678 designed from the PHY layer up with robustness in mind. 680 In order to maximize the capacity per channel and to optimally use 681 the available spectrum, LDACS was designed as an OFDM-based Frequency 682 Division Duplex system, supporting simultaneous transmissions in FL 683 at the G2A connection and RF at the A2G connection. The legacy 684 systems already deployed in the L-band limit the bandwidth of both 685 channels to approximately 500 kHz. 687 The LDACS physical layer design includes propagation guard times 688 sufficient for the operation at a maximum distance of 200 nautical 689 miles from the GS. In actual deployment, LDACS can be configured for 690 any range up to this maximum range. 692 The LDACS FL physical layer is a continuous OFDM transmission. LDACS 693 RL transmission is based on OFDMA-TDMA bursts, with silence between 694 such bursts. The RL resources (i.e. bursts) are assigned to 695 different ASs on demand by the GS. 697 The LDACS physical layer supports adaptive coding and modulation for 698 user data. Control data is always encoded with the most robust 699 coding and modulation (QPSK coding rate 1/2). 701 LDACS medium access on top of the physical layer uses a static frame 702 structure to support deterministic timer management. As shown in 703 Figure 3 and Figure 4, LDACS framing structure is based on Super- 704 Frames (SF) of 240ms duration corresponding to 2000 OFDM symbols. FL 705 and RL boundaries are aligned in time (from the GS perspective) 706 allowing for deterministic sending windows for KEEP ALIVE messages 707 and control and data channels in general. 709 LDACS medium access is always under the control of the GS of a radio 710 cell. Any medium access for the transmission of user data has to be 711 requested with a resource request message stating the requested 712 amount of resources and class of service. The GS performs resource 713 scheduling on the basis of these requests and grants resources with 714 resource allocation messages. Resource request and allocation 715 messages are exchanged over dedicated contention-free control 716 channels. 718 The purpose of Quality-of-Service in LDACS medium access is to 719 provide prioritized medium access at the bottleneck (the wireless 720 link). The signaling of higher layer Quality-of-Service requirements 721 to LDACS is yet to be defined. A DiffServ-based solution with a 722 small number of priorities is to be expected. 724 LDACS has two mechanisms to request resources from the scheduler in 725 the GS. 727 Resources can either be requested "on demand" with a given priority. 728 On the FL, this is done locally in the GS, on the RL a dedicated 729 contention-free control channel is used called Dedicated Control 730 Channel (DCCH), which is roughly 83 bit every 60 ms. A resource 731 allocation is always announced in the control channel of the FL, 732 short Common Control Channel (CCCH) having variable size. Due to the 733 spacing of the RL control channels every 60 ms, a medium access delay 734 in the same order of magnitude is to be expected. 736 Resources can also be requested "permanently". The permanent 737 resource request mechanism supports requesting recurring resources in 738 given time intervals. A permanent resource request has to be 739 canceled by the user (or by the GS, which is always in control). 741 User data transmissions over LDACS are therefore always scheduled by 742 the GS, while control data uses statically (i.e. at cell entry) 743 allocated recurring resources (DCCH and CCCH). The current 744 specification specifies no scheduling algorithm. Scheduling of RL 745 resources is done in physical Protocol Data Units of 112 bit (or 746 larger if more aggressive coding and modulation is used). Scheduling 747 on the FL is done Byte-wise since the FL is transmitted continuously 748 by the GS. 750 In addition to having full control over resource scheduling, the GS 751 can send forced Handover commands for off-loading or RF channel 752 management, e.g. when the signal quality declines and a more suitable 753 GS is in the AS reach. With robust resource management of the 754 capacities of the radio channel, reliability and robustness measures 755 are therefore also anchored in the LDACS management entity. 757 In addition, to radio resource management, the LDACS control channels 758 are also used to send keep-alive messages, when they are not 759 otherwise used. Since the framing of the control channels is 760 deterministic, missing keep-alive messages can thus be immediately 761 detected. This information is made available to the multi-link 762 protocols for fault management. 764 The protocol used to communicate faults is not defined in the LDACS 765 specification. It is assumed that vendors would use industry 766 standard protocols like the Simple Network Management Protocol or the 767 Network Configuration Protocol where security permits. 769 The LDACS data link layer protocol running on top of the medium 770 access sub-layer uses ARQ to provide reliable data transmission on 771 layer 2. 773 It employs selective repeat ARQ with transparent fragmentation and 774 reassembly to the resource allocation size to achieve low latency and 775 a low overhead without losing reliability. It ensures correct order 776 of packet delivery without duplicates. In case of transmission 777 errors it identifies lost fragments with deterministic timers synced 778 to the medium access frame structure and initiates retransmission. 779 Additionally, the priority mechanism of LDACS ensures the timely 780 delivery of messages with high importance. 782 8.2. Beyond Layer 2 784 LDACS availability can be increased by appropriately deploying LDACS 785 infrastructure: This means proliferating the number of terrestrial 786 base stations. However, the scarcity of aeronautical spectrum for 787 data link communication (in the case of LDACS: tens of MHz in the 788 L-band) and the long range (in the case of LDACS: up to 400 km) make 789 this quite hard. The deployment of a larger number of small cells is 790 certainly possible, suffers, however, also from the scarcity of 791 spectrum. An additional constraint to take into account, is that 792 Distance Measuring Equipment (DME) is the primary user of the 793 aeronautical L-band. That is, any LDACS deployment has to take DME 794 frequency planning into account, too. 796 The aeronautical community has therefore decided not to rely on a 797 single communication system or frequency band. It is envisioned to 798 have multiple independent data link technologies in the aircraft 799 (e.g., terrestrial and SatCom) in addition to legacy VHF voice. 801 However, as of now no reliability and availability mechanisms that 802 could utilize the multi-link have been specified on Layer 3 and 803 above. 805 Below Layer 2 aeronautics usually relies on hardware redundancy. To 806 protect availability of the LDACS link, an aircraft equipped with 807 LDACS will have access to two L-band antennae with triple redundant 808 radio systems as REQUIRED for any safety relevant system by ICAO. 810 9. Protocol Stack 812 The protocol stack of LDACS is implemented in the AS, GS, and GSC: It 813 consists of the Physical Layer (PHY) with five major functional 814 blocks above it. Four are placed in the Data Link Layer (DLL) of the 815 AS and GS: (1) Medium Access Layer (MAC), (2) Voice Interface (VI), 816 (3) Data Link Service (DLS), and (4) LDACS Management Entity (LME). 817 The last entity resides within the Sub-Network Layer: Sub-Network 818 Protocol (SNP). The LDACS network is externally connected to voice 819 units, radio control units, and the ATN Network Layer. 821 Figure 2 shows the protocol stack of LDACS as implemented in the AS 822 and GS. 824 IPv6 Network Layer 825 | 826 | 827 +------------------+ +----+ 828 | SNP |--| | Sub-Network 829 | | | | Layer 830 +------------------+ | | 831 | | LME| 832 +------------------+ | | 833 | DLS | | | Logical Link 834 | | | | Control Layer 835 +------------------+ +----+ 836 | | 837 DCH DCCH/CCCH 838 | RACH/BCCH 839 | | 840 +--------------------------+ 841 | MAC | Medium Access 842 | | Layer 843 +--------------------------+ 844 | 845 +--------------------------+ 846 | PHY | Physical Layer 847 +--------------------------+ 848 | 849 | 850 ((*)) 851 FL/RL radio channels 852 separated by 853 Frequency Division Duplex 855 Figure 2: LDACS protocol stack in AS and GS 857 9.1. MAC Entity Services 859 The MAC time framing service provides the frame structure necessary 860 to realize slot-based Time Division Multiplex access on the physical 861 link. It provides the functions for the synchronization of the MAC 862 framing structure and the PHY Layer framing. The MAC time framing 863 provides a dedicated time slot for each logical channel. 865 The MAC Sub-Layer offers access to the physical channel to its 866 service users. Channel access is provided through transparent 867 logical channels. The MAC Sub-Layer maps logical channels onto the 868 appropriate slots and manages the access to these channels. Logical 869 channels are used as interface between the MAC and LLC Sub-Layers. 871 The LDACS framing structure for FL and RL is based on Super-Frames 872 (SF) of 240 ms duration. Each SF corresponds to 2000 OFDM symbols. 873 The FL and RL SF boundaries are aligned in time (from the view of the 874 GS). 876 In the FL, an SF contains a Broadcast Frame of duration 6.72 ms (56 877 OFDM symbols) for the Broadcast Control Channel (BCCH), and four 878 Multi-Frames (MF), each of duration 58.32 ms (486 OFDM symbols). 880 In the RL, each SF starts with a Random Access (RA) slot of length 881 6.72 ms with two opportunities for sending RL random access frames 882 for the Random Access Channel (RACH), followed by four MFs. These 883 MFs have the same fixed duration of 58.32 ms as in the FL, but a 884 different internal structure 886 Figure 3 and Figure 4 illustrate the LDACS frame structure. 888 ^ 889 | +------+------------+------------+------------+------------+ 890 | FL | BCCH | MF | MF | MF | MF | 891 F +------+------------+------------+------------+------------+ 892 r <---------------- Super-Frame (SF) - 240ms ----------------> 893 e 894 q +------+------------+------------+------------+------------+ 895 u RL | RACH | MF | MF | MF | MF | 896 e +------+------------+------------+------------+------------+ 897 n <---------------- Super-Frame (SF) - 240ms ----------------> 898 c 899 y 900 | 901 ----------------------------- Time ------------------------------> 902 | 904 Figure 3: SF structure for LDACS 906 ^ 907 | +-------------+------+-------------+ 908 | FL | DCH | CCCH | DCH | 909 F +-------------+------+-------------+ 910 r <---- Multi-Frame (MF) - 58.32ms --> 911 e 912 q +------+---------------------------+ 913 u RL | DCCH | DCH | 914 e +------+---------------------------+ 915 n <---- Multi-Frame (MF) - 58.32ms --> 916 c 917 y 918 | 919 -------------------- Time ------------------> 920 | 922 Figure 4: MF structure for LDACS 924 9.2. DLS Entity Services 926 The DLS provides acknowledged and unacknowledged (including broadcast 927 and packet mode voice) bi-directional exchange of user data. If user 928 data is transmitted using the acknowledged DLS, the sending DLS 929 entity will wait for an acknowledgement from the receiver. If no 930 acknowledgement is received within a specified time frame, the sender 931 MAY automatically try to retransmit its data. However, after a 932 certain number of failed retries, the sender will suspend further 933 retransmission attempts and inform its client of the failure. 935 The DLS uses the logical channels provided by the MAC: 937 1. A GS announces its existence and access parameters in the 938 Broadcast Channel (BC). 939 2. The RA channel enables AS to request access to an LDACS cell. 940 3. In the FL the CCCH is used by the GS to grant access to data 941 channel resources. 942 4. The reverse direction is covered by the RL, where ASs need to 943 request resources before sending. This happens via the DCCH. 944 5. User data itself is communicated in the Data Channel (DCH) on the 945 FL and RL. 947 9.3. VI Services 949 The VI provides support for virtual voice circuits. Voice circuits 950 MAY either be set-up permanently by the GS (e.g., to emulate voice 951 party line) or MAY be created on demand. The creation and selection 952 of voice circuits is performed in the LME. The VI provides only the 953 transmission services. 955 9.4. LME Services 957 The mobility management service in the LME provides support for 958 registration and de-registration (cell entry and cell exit), scanning 959 RF channels of neighboring cells and handover between cells. In 960 addition, it manages the addressing of aircraft/ ASs within cells. 961 It is controlled by the network management service in the GSC. 963 The resource management service provides link maintenance (power, 964 frequency and time adjustments), support for adaptive coding and 965 modulation, and resource allocation. 967 9.5. SNP Services 969 The DLS provides functions REQUIRED for the transfer of user plane 970 data and control plane data over the LDACS sub-network. 972 The security service provides functions for secure communication over 973 the LDACS sub-network. Note that the SNP security service applies 974 cryptographic measures as configured by the GSC. 976 10. Security Considerations 978 10.1. Reasons for Wireless Digital Aeronautical Communications 980 Aviation will require secure exchanges of data and voice messages for 981 managing the air-traffic flow safely through the airspaces all over 982 the world. Historically Communication Navigation Surveillance (CNS) 983 wireless communications technology emerged from military and a threat 984 landscape where inferior technological and financial capabilities of 985 adversaries were assumed [STR2016]. The main communication method 986 for ATC today is still an open analogue voice broadcast within the 987 aeronautical VHF band. Currently, the information security is purely 988 procedural based by using well-trained personnel and proven 989 communications procedures. This communication method has been in 990 service since 1948. However since the emergence of civil 991 aeronautical CNS application and today, the world has changed. First 992 of all civil applications have significant lower spectrum available 993 than military applications. This means several military defense 994 mechanisms such as frequency hopping or pilot symbol scrambling and 995 thus a defense-in-depth approach starting at the physical layer is 996 impossible for civil systems. With the rise of cheap Software 997 Defined Radios, the previously existing financial barrier is almost 998 gone and open source projects such as GNU radio [GNU2012] allow the 999 new type of unsophisticated listeners and possible attackers. 1000 Furthermore most CNS technology developed in ICAO relies on open 1001 standards, thus syntax and semantics of wireless digital aeronautical 1002 communications can be common knowledge for attackers. Finally with 1003 increased digitization and automation of civil aviation the human as 1004 control instance is being taken gradually out of the loop. 1005 Autonomous transport drones or single piloted aircraft demonstrate 1006 this trend. However without profound cybersecurity measures such as 1007 authenticity and integrity checks of messages in-transit on the 1008 wireless link or mutual entity authentication, this lack of a control 1009 instance can prove disastrous. Thus future digital communications 1010 waveforms will need additional embedded security features to fulfill 1011 modern information security requirements like authentication and 1012 integrity. However, these security features require sufficient 1013 bandwidth which is beyond the capabilities of a VHF narrowband 1014 communications system. For voice and data communications, sufficient 1015 data throughput capability is needed to support the security 1016 functions while not degrading performance. LDACS is a data link 1017 technology with sufficient bandwidth to incorporate security without 1018 losing too much user throughput. 1020 As digitalization progresses even further with LDACS and automated 1021 procedures such as 4D-Trajectories allowing semi-automated en-route 1022 flying of aircraft, LDACS requires stronger cybersecurity measures. 1024 10.2. Requirements for LDACS 1026 Overall there are several business goals for cybersecurity to protect 1027 in FCI in civil aviation: 1029 1. Safety: The system MUST sufficiently mitigate attacks, which 1030 contribute to safety hazards. 1031 2. Flight regularity: The system MUST sufficiently mitigate attacks, 1032 which contribute to delays, diversions, or cancellations of 1033 flights. 1034 3. Protection of business interests: The system MUST sufficiently 1035 mitigate attacks which result in financial loss, reputation 1036 damage, disclosure of sensitive proprietary information, or 1037 disclosure of personal information. 1039 To further analyze assets and derive threats and thus protection 1040 scenarios several Threat-and Risk Analysis were performed for LDACS 1041 [MAE20181] , [MAE20191]. These results allowed deriving security 1042 scope and objectives from the requirements and the conducted Threat- 1043 and Risk Analysis. 1045 10.3. Security Objectives for LDACS 1047 Security considerations for LDACS are defined by the official 1048 Standards And Recommended Practices document by ICAO [ICA2018]: 1050 1. LDACS SHALL provide a capability to protect the availability and 1051 continuity of the system. 1052 2. LDACS SHALL provide a capability including cryptographic 1053 mechanisms to protect the integrity of messages in transit. 1054 3. LDACS SHALL provide a capability to ensure the authenticity of 1055 messages in transit. 1056 4. LDACS SHOULD provide a capability for nonrepudiation of origin 1057 for messages in transit. 1058 5. LDACS SHOULD provide a capability to protect the confidentiality 1059 of messages in transit. 1060 6. LDACS SHALL provide an authentication capability. 1061 7. LDACS SHALL provide a capability to authorize the permitted 1062 actions of users of the system and to deny actions that are not 1063 explicitly authorized. 1064 8. If LDACS provides interfaces to multiple domains, LDACS SHALL 1065 provide capability to prevent the propagation of intrusions within 1066 LDACS domains and towards external domains. 1068 10.4. Security Functions for LDACS 1070 These objectives were used to derive several security functions for 1071 LDACS REQUIRED to be integrated in the LDACS cybersecurity 1072 architecture: (1) Identification, (2) Authentication, (3) 1073 Authorization, (4) Confidentiality, (5) System Integrity, (6) Data 1074 Integrity, (7) Robustness, (8) Reliability, (9) Availability, and 1075 (10) Key and Trust Management. Several works investigated possible 1076 measures to implement these security functions [BIL2017], [MAE20181], 1077 [MAE20191]. Having identified security requirements, objectives and 1078 functions it MUST be ensured that they are applicable. 1080 10.5. Security Architectural Details for LDACS 1082 The requirements lead to a LDACS security model including different 1083 entities for identification, authentication and authorization 1084 purposes ensuring integrity, authenticity and confidentiality of data 1085 in-transit especially. 1087 10.5.1. Entities in LDACS Security Model 1089 A simplified LDACS architectural modelrequires the following 1090 entities: Network operators such as the Societe Internationale de 1091 Telecommunications Aeronautiques (SITA) [SIT2020] and ARINC [ARI2020] 1092 are providing access to the (1) Ground IPS network via an (2) A2G 1093 LDACS Router. This router is attached to a closed off LDACS Access 1094 Network (3) which connects via further (4) Access Routers to the 1095 different (5) LDACS Cell Ranges, each controlled by a (6) GSC and 1096 spanning a local LDACS Access Network connecting to the (7) GSs that 1097 serve one LDACS cell. Via the (8) A2G wireless LDACS data link (9) 1098 AS the aircraft is connected to the ground network and via the (10) 1099 aircrafts's VI and (11) aircraft's network interface, aircraft's data 1100 can be sent via the AS back to the GS and the forwarded back via GSC, 1101 LDACS local access network, access routers, LDACS access network, A2G 1102 LDACS router to the ground IPS network. 1104 10.5.2. Matter of LDACS Entity Identification 1106 LDACS needs specific identities for (1) the AS, (2) the GS, (3) the 1107 GSC and (4) the Network Operator. The aircraft itself can be 1108 identified using the ICAO unique address of an aircraft, the call 1109 sign of that aircraft or the recently founded Privacy ICAO Address 1110 (PIA) program [FAA2020]. It is conceivable that the LDACS AS will 1111 use a combination of aircraft identification, radio component 1112 identification such as MAC addresses and even operator features 1113 identification to create a unique AS LDACS identification tag. 1114 Similar to a 4G's eNodeB Serving Network (SN) Identification tag, a 1115 GS could be identified using a similar field. And again similar to 1116 4G's Mobility Management Entities (MME), a GSC could be identified 1117 using similar identification fields within the LDACS network. The 1118 identification of the network operator is again similar to 4G (e.g., 1119 E-Plus, AT&T, and TELUS), in the way that the aeronautical network 1120 operators are listed (e.g., ARINC [ARI2020] and SITA [SIT2020]). 1122 10.5.3. Matter of LDACS Entity Authentication and Key Negotiation 1124 In order to anchor Trust within the system all LDACS entities 1125 connected to the ground IPS network SHALL be rooted in an LDACS 1126 specific chain-of-trust and PKI solution, quite similar to AeroMACS 1127 approach [CRO2016]. These X.509 certificates [RFC5280] residing at 1128 the entities and incorporated in the LDACS PKI proof the ownership of 1129 their respective public key, include information about the identity 1130 of the owner and the digital signature of the entity that has 1131 verified the certificate's content. First all ground infrastructures 1132 MUST mutually authenticate to each other, negotiate and derive keys 1133 and, thus, secure all ground connections. How this process is 1134 handled in detail is still an ongoing discussion. However, 1135 established methods to secure user plane by IPSec [RFC4301] and IKEv2 1136 [RFC7296] or the application layer via TLS 1.3 [RFC8446] are 1137 conceivable. The LDACS PKI with their chain-of-trust approach, 1138 digital certificates and public entity keys lay the groundwork for 1139 this step. In a second step the AS with the LDACS radio approaches 1140 an LDACS cell and performs a cell entry with the corresponding GS. 1141 Similar to the LTE cell attachment process [TS33.401], where 1142 authentication happens after basic communication has been enabled 1143 between AS and GS (step 5a in the UE attachment process [TS33.401]), 1144 the next step is mutual authentication and key exchange. Hence, in 1145 step three using the identity based Station-to-Station (STS) protocol 1146 with Diffie-Hellman Key Exchange [MAE2020], AS and GS establish 1147 mutual trust by authenticating each other, exchanging key material 1148 and finally both ending up with derived key material. A key 1149 confirmation is mandatory before the communication channel between 1150 the AS and the GS can be opened for user-data communications. 1152 10.5.4. Matter of LDACS Message-in-transit Confidentiality, Integrity 1153 and Authenticity 1155 The subsequent key material from the previous step can then be used 1156 to protect LDACS Layer 2 communications via applying encryption and 1157 integrity protection measures on the SNP layer of the LDACS protocol 1158 stack. As LDACS transports AOC and ATS data, the integrity of that 1159 data is most important, while confidentiality only needs to be 1160 applied to AOC data to protect business interests [ICA2018]. This 1161 possibility of providing low layered confidentiality and integrity 1162 protection ensures a secure delivery of user data over the air gap. 1163 Furthermore it ensures integrity protection of LDACS control data. 1165 10.6. Security Architecture for LDACS 1167 A draft of the cybersecurity architecture of LDACS can be found in 1168 [ICA2018] and [MAE20182] and respective updates in [MAE20191], 1169 [MAE20192], and [MAE2020]. It proposes the use of an own LDACS PKI, 1170 identity management based on aircraft identities and network operator 1171 identities (e.g., SITA and ARINC), public key certificates 1172 incorporated in the PKI based chain-of-trust and stored in the 1173 entities allowing for mutual authentication and key exchange 1174 procedures, key derivation mechanisms for perfect forward secrecy and 1175 user/control plane message-in-transit integrity and confidentiality 1176 protection. This secures data traveling over the airgap between AS 1177 and GS and also between GS and ANSP regardless of the secure or 1178 unsecure nature of application data. Of course application data 1179 itself MUST be additionally secured to achieve end-to-end security 1180 (secure dialogue service), however the LDACS datalinks aims to 1181 provide an additional layer of protection just for this network 1182 segment. 1184 11. Privacy Considerations 1186 LDACS provides a Quality-of-Service, and the generic considerations 1187 for such mechanisms apply. 1189 12. IANA Considerations 1191 This memo includes no request to IANA. 1193 13. Acknowledgements 1195 Thanks to all contributors to the development of LDACS and ICAO PT-T. 1197 Thanks to Klaus-Peter Hauf, Bart Van Den Einden, and Pierluigi 1198 Fantappie for further input to this draft. 1200 Thanks to SBA Research Vienna for fruitful discussions on 1201 aeronautical communications concerning security incentives for 1202 industry and potential economic spillovers. 1204 14. Normative References 1206 [RFC4301] Kent, S. and K. Seo, "Security Architecture for the 1207 Internet Protocol", RFC 4301, DOI 10.17487/RFC4301, 1208 December 2005, . 1210 [RFC5280] Cooper, D., Santesson, S., Farrell, S., Boeyen, S., 1211 Housley, R., and W. Polk, "Internet X.509 Public Key 1212 Infrastructure Certificate and Certificate Revocation List 1213 (CRL) Profile", RFC 5280, DOI 10.17487/RFC5280, May 2008, 1214 . 1216 [RFC7296] Kaufman, C., Hoffman, P., Nir, Y., Eronen, P., and T. 1217 Kivinen, "Internet Key Exchange Protocol Version 2 1218 (IKEv2)", STD 79, RFC 7296, DOI 10.17487/RFC7296, October 1219 2014, . 1221 [RFC8446] Rescorla, E., "The Transport Layer Security (TLS) Protocol 1222 Version 1.3", RFC 8446, DOI 10.17487/RFC8446, August 2018, 1223 . 1225 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate 1226 Requirement Levels", BCP 14, RFC 2119, 1227 DOI 10.17487/RFC2119, March 1997, 1228 . 1230 15. Informative References 1232 [SCHN2016] Schneckenburger, N., Jost, T., Shutin, D., Walter, M., 1233 Thiasiriphet, T., Schnell, M., and U.C. Fiebig, 1234 "Measurement of the L-band Air-to-Ground Channel for 1235 Positioning Applications", IEEE Transactions on Aerospace 1236 and Electronic Systems, 52(5), pp.2281-229 , 2016. 1238 [MAE20191] Maeurer, N., Graeupl, T., and C. Schmitt, "Evaluation of 1239 the LDACS Cybersecurity Implementation", IEEE 38th Digital 1240 Avionics Systems Conference (DACS), pp. 1-10, San Diego, 1241 CA, USA , 2019. 1243 [MAE20192] Maeurer, N. and C. Schmitt, "Towards Successful 1244 Realization of the LDACS Cybersecurity Architecture: An 1245 Updated Datalink Security Threat- and Risk Analysis", IEEE 1246 Integrated Communications, Navigation and Surveillance 1247 Conference (ICNS), pp. 1-13, Herndon, VA, USA , 2019. 1249 [GRA2019] Graeupl, T., Rihacek, C., and B. Haindl, "LDACS A/G 1250 Specification", SESAR2020 PJ14-02-01 D3.3.030 , 2019. 1252 [FAN2019] Pierattelli, S., Fantappie, P., Tamalet, S., van den 1253 Einden, B., Rihacek, C., and T. Graeupl, "LDACS Deployment 1254 Options and Recommendations", SESAR2020 PJ14-02-01 1255 D3.4.020 , 2019. 1257 [MAE20182] Maeurer, N. and A. Bilzhause, "A Cybersecurity 1258 Architecture for the L-band Digital Aeronautical 1259 Communications System (LDACS)", IEEE 37th Digital Avionics 1260 Systems Conference (DASC), pp. 1-10, London, UK , 2017. 1262 [GRA2011] Graeupl, T. and M. Ehammer, "L-DACS1 Data Link Layer 1263 Evolution of ATN/IPS", 30th IEEE/AIAA Digital Avionics 1264 Systems Conference (DASC), pp. 1-28, Seattle, WA, USA , 1265 2011. 1267 [GRA2018] Graeupl, T., Schneckenburger, N., Jost, T., Schnell, M., 1268 Filip, A., Bellido-Manganell, M.A., Mielke, D.M., Maeurer, 1269 N., Kumar, R., Osechas, O., and G. Battista, "L-band 1270 Digital Aeronautical Communications System (LDACS) flight 1271 trials in the national German project MICONAV", Integrated 1272 Communications, Navigation, Surveillance Conference 1273 (ICNS), pp. 1-7, Herndon, VA, USA , 2018. 1275 [SCH20191] Schnell, M., "DLR Tests Digital Communications 1276 Technologies Combined with Additional Navigation Functions 1277 for the First Time", 2019. 1279 [ICA2018] International Civil Aviation Organization (ICAO), "L-Band 1280 Digital Aeronautical Communication System (LDACS)", 1281 International Standards and Recommended Practices Annex 10 1282 - Aeronautical Telecommunications, Vol. III - 1283 Communication Systems , 2018. 1285 [SAJ2014] Haindl, B., Meser, J., Sajatovic, M., Mueller, S., 1286 Arthaber, H., Faseth, T., and M. Zaisberger, "LDACS1 1287 Conformance and Compatibility Assessment", IEEE/AIAA 33rd 1288 Digital Avionics Systems Conference (DASC), pp. 1-11, 1289 Colorado Springs, CO, USA , 2014. 1291 [RIH2018] Rihacek, C., Haindl, B., Fantappie, P., Pierattelli, S., 1292 Graeupl, T., Schnell, M., and N. Fistas, "L-band Digital 1293 Aeronautical Communications System (LDACS) Activities in 1294 SESAR2020", Integrated Communications Navigation and 1295 Surveillance Conference (ICNS), pp. 1-8, Herndon, VA, 1296 USA , 2018. 1298 [BEL2019] Bellido-Manganell, M. A. and M. Schnell, "Towards Modern 1299 Air-to-Air Communications: the LDACS A2A Mode", IEEE/AIAA 1300 38th Digital Avionics Systems Conference (DASC), pp. 1-10, 1301 San Diego, CA, USA , 2019. 1303 [TS33.401] Zhang, D., "3GPP System Architecture Evolution (SAE); 1304 Security architecture", T33.401, 3GPP , 2012. 1306 [CRO2016] Crowe, B., "Proposed AeroMACS PKI Specification is a Model 1307 for Global and National Aeronautical PKI Deployments", 1308 WiMAX Forum at 16th Integrated Communications, Navigation 1309 and Surveillance Conference (ICNS), pp. 1-19, New York, 1310 NY, USA , 2016. 1312 [MAE2020] Maeurer, N., Graeupl, T., and C. Schmitt, "Comparing 1313 Different Diffie-Hellman Key Exchange Flavors for LDACS", 1314 IEEE/AIAA 39th Digital Avionics Systems Conference (DASC), 1315 pp. 1-10, San Antonio, TX, USA , 2020. 1317 [STR2016] Strohmeier, M., Schaefer, M., Pinheiro, R., Lenders, V., 1318 and I. Martinovic, "On Perception and Reality in Wireless 1319 Air Traffic Communication Security", IEEE Transactions on 1320 Intelligent Transportation Systems, 18(6), pp. 1338-1357, 1321 New York, NY, USA , 2016. 1323 [BIL2017] Bilzhause, A., Belgacem, B., Mostafa, M., and T. Graeupl, 1324 "Datalink Security in the L-band Digital Aeronautical 1325 Communications System (LDACS) for Air Traffic Management", 1326 IEEE Aerospace and Electronic Systems Magazine, 32(11), 1327 pp. 22-33, New York, NY, USA , 2017. 1329 [MAE20181] Maeurer, N. and A. Bilzhause, "Paving the Way for an IT 1330 Security Architecture for LDACS: A Datalink Security 1331 Threat and Risk Analysis", IEEE Integrated Communications, 1332 Navigation, Surveillance Conference (ICNS), pp. 1-11, New 1333 York, NY, USA , 2018. 1335 [FAA2020] FAA, "Federal Aviation Administration. ADS-B Privacy.", 1336 August 2020, 1337 . 1339 [GNU2012] GNU Radio project, "GNU radio", August 2012, 1340 . 1342 [SIT2020] SITA, "Societe Internationale de Telecommunications 1343 Aeronautiques", August 2020, . 1345 [ARI2020] ARINC, "Aeronautical Radio Incorporated", August 2020, 1346 . 1348 [DO350A] RTCA SC-214, "Safety and Performance Standard for Baseline 1349 2 ATS Data Communications (Baseline 2 SPR Standard)", May 1350 2016, . 1353 [RAW-TECHNOS] 1354 Thubert, P., Cavalcanti, D., Vilajosana, X., Schmitt, C., 1355 and J. Farkas, "Reliable and Available Wireless 1356 Technologies", Work in Progress, Internet-Draft, draft- 1357 ietf-raw-technologies-00, 20 October 2020, 1358 . 1361 [RAW-USE-CASES] 1362 Papadopoulos, G., Thubert, P., Theoleyre, F., and C. 1363 Bernardos, "RAW use cases", Work in Progress, Internet- 1364 Draft, draft-ietf-raw-use-cases-00, 23 October 2020, 1365 . 1367 Appendix A. Selected Information from DO-350A 1369 This appendix includes the continuity, availability, and integrity 1370 requirements interesting for LDACS defined in [DO350A]. 1372 The following terms are used here: 1374 CPDLC Controller Pilot Data Link Communication 1375 DT Delivery Time (nominal) value for RSP 1376 ET Expiration Time value for RCP 1377 FH Flight Hour 1378 MA Monitoring and Alerting criteria 1379 OT Overdue Delivery Time value for RSP 1380 RCP Required Communication Performance 1381 RSP Required Surveillance Performance 1382 TT Transaction Time (nominal) value for RCP 1384 +========================+=============+=============+ 1385 | | ECP 130 | ECP 130 | 1386 +========================+=============+=============+ 1387 | Parameter | ET | TT95% | 1388 +------------------------+-------------+-------------+ 1389 | Transaction Time (sec) | 130 | 67 | 1390 +------------------------+-------------+-------------+ 1391 | Continuity | 0.999 | 0.95 | 1392 +------------------------+-------------+-------------+ 1393 | Availability | 0.989 | 0.989 | 1394 +------------------------+-------------+-------------+ 1395 | Integrity | 1E-5 per FH | 1E-5 per FH | 1396 +------------------------+-------------+-------------+ 1398 Table 1: CPDLC Requirements for ECP 1400 +==============+==========+==============+=========+=========+ 1401 | | RCP 240 | RCP 240 | RCP 400 | RCP 400 | 1402 +==============+==========+==============+=========+=========+ 1403 | Parameter | ET | TT95% | ET | TT95% | 1404 +--------------+----------+--------------+---------+---------+ 1405 | Transaction | 240 | 210 | 400 | 350 | 1406 | Time (sec) | | | | | 1407 +--------------+----------+--------------+---------+---------+ 1408 | Continuity | 0.999 | 0.95 | 0.999 | 0.95 | 1409 +--------------+----------+--------------+---------+---------+ 1410 | Availability | 0.989 | 0.989 | 0.989 | 0.989 | 1411 | | (safety) | (efficiency) | | | 1412 +--------------+----------+--------------+---------+---------+ 1413 | Integrity | 1E-5 per | 1E-5 per FH | 1E-5 | 1E-5 | 1414 | | FH | | per FH | per FH | 1415 +--------------+----------+--------------+---------+---------+ 1417 Table 2: CPDLC Requirements for RCP 1419 RCP Monitoring and Alerting Criteria in case of CPDLC: 1421 - MA-1: The system SHALL be capable of detecting failures and 1422 configuration changes that would cause the communication service 1423 no longer meet the RCP specification for the intended use. 1424 - MA-2: When the communication service can no longer meet the RCP 1425 specification for the intended function, the flight crew and/or 1426 the controller SHALL take appropriate action. 1428 +==============+=====+=====+==========+==============+======+=======+ 1429 | | RSP | RSP | RSP 180 | RSP 180 | RSP |RSP 400| 1430 | | 160 | 160 | | | 400 | | 1431 +==============+=====+=====+==========+==============+======+=======+ 1432 | Parameter | OT |DT95%| OT | DT95% | OT | DT95% | 1433 +--------------+-----+-----+----------+--------------+------+-------+ 1434 | Transaction | 160 | 90 | 180 | 90 | 400 | 300 | 1435 | Time (sec) | | | | | | | 1436 +--------------+-----+-----+----------+--------------+------+-------+ 1437 | Continuity |0.999| 0.95| 0.999 | 0.95 |0.999 | 0.95 | 1438 +--------------+-----+-----+----------+--------------+------+-------+ 1439 | Availability |0.989|0.989| 0.989 | 0.989 |0.989 | 0.989 | 1440 | | | | (safety) | (efficiency) | | | 1441 +--------------+-----+-----+----------+--------------+------+-------+ 1442 | Integrity | 1E-5| 1E-5| 1E-5 per | 1E-5 per FH | 1E-5 | 1E-5 | 1443 | | per | per | FH | |per FH| per FH| 1444 | | FH | FH | | | | | 1445 +--------------+-----+-----+----------+--------------+------+-------+ 1447 Table 3: ADS-C Requirements 1449 RCP Monitoring and Alerting Criteria: 1451 - MA-1: The system SHALL be capable of detecting failures and 1452 configuration changes that would cause the ADS-C service no longer 1453 meet the RSP specification for the intended function. 1454 - MA-2: When the ADS-C service can no longer meet the RSP 1455 specification for the intended function, the flight crew and/or 1456 the controller SHALL take appropriate action. 1458 Authors' Addresses 1459 Nils Maeurer (editor) 1460 German Aerospace Center (DLR) 1461 Muenchner Strasse 20 1462 82234 Wessling 1463 Germany 1465 Email: Nils.Maeurer@dlr.de 1467 Thomas Graeupl (editor) 1468 German Aerospace Center (DLR) 1469 Muenchner Strasse 20 1470 82234 Wessling 1471 Germany 1473 Email: Thomas.Graeupl@dlr.de 1475 Corinna Schmitt (editor) 1476 Research Institute CODE, UniBwM 1477 Werner-Heisenberg-Weg 28 1478 85577 Neubiberg 1479 Germany 1481 Email: corinna.schmitt@unibw.de