article · East African Journal of Information Technology
Controller Pilot Data Link Communications over VHF Data Link Mode 2 lack encryption and sender authentication, leaving routine air traffic control instructions vulnerable to interception, spoofing, and replay attacks using inexpensive software-defined radios. A dual-tier software framework introduces cryptographic protection without requiring alterations to radios, avionics, or transmission formats. The session tier secures initial log-on exchanges using digital signatures and authenticated encryption to generate a session key. The subsequent message tier protects individual communications by encoding authentication tokens with error correction and embedding them into safe message fields using least significant bit steganography. Safe fields are identified through a taxonomy of 278 message elements to prevent critical clearances from being altered. Testing across simulated radio channels demonstrated that attack success rates decreased from 87.79 percent to 0.1242 percent with sub-millisecond cryptographic latency, though live operational validation remains necessary.
Modern aviation safety relies heavily on digital communication between pilots and air traffic controllers. Because standard data links transmit instructions without identity verification or encryption, unauthorized actors using cheap radios could forge or disrupt flight clearances. Demonstrating that robust security can be added entirely through software addresses a critical safety vulnerability without requiring expensive and slow global hardware replacements on aircraft.
This framework could enable air navigation service providers, avionics software developers, and airlines to enhance data link security against spoofing and tampering. Because it preserves existing hardware and message standards, it offers a cost-effective upgrade pathway through software integration. The technology is currently at an applied testing stage based on radio simulations, meaning operational feasibility and flight certification still require live field validation before commercial deployment.
AI-generated from the published abstract. Always read the original work before citing.
CPDLC now carries a large share of routine air traffic control instructions, but the protocol as run over VDL-2 has no encryption and no way to check who sent a message. Low- cost Software Defined Radios make eavesdropping, message forgery, replay, and handover interception practical. The study presents a framework that adds cryptographic protection to CPDLC in software only, leaving the radio, the avionics, and the on- the- wire message format untouched. The design has two parts. A session tier signs a log- on bundle with ECDSA over P-256 and encrypts it with AES-256-GCM, which gives non- repudiation and establishes a session key. A message tier then carries a 128-bit HMAC-SHA256 token across the session by encoding it with an RS(18,12) Reed–Solomon code and hiding the resulting symbols in protocol fields using LSB steganography. The central safety question—which fields can be used as carriers without risking a clearance value—is answered by a Green/Amber/Red (GART) taxonomy built from a field review of all 278 CPDLC message elements; embedding touches Green fields only, and a run- time gate blocks anything else. The study implemented the framework in Python over a GNU Radio VDL-2 model and evaluated it across three calibrated channel conditions with 10,000 Monte Carlo iterations. Under nominal conditions, the mean attack success rate falls from 87.79% to 0.1242% (bootstrap 95% CI 0.1220%–0.1264%). The difference is significant (two-proportion z = 38.24, p < 0.001) and the effect size is very large (Cohen's h = 2.2646). Authentication is reliable: false acceptance is 0.12%, verification success is 99.30% nominally (falling to 84.70% under severe interference), and false rejection stays at 0.71% nominally, at a 0.4007ms cryptographic pipeline latency. The evidence supports the claim that CPDLC can be secured within VDL-2 constraints, and identifies where operational feasibility still needs live validation.
This page summarises published work. The authoritative version sits with the publisher.
DOI: 10.37284/eajit.9.1.5559
Is something wrong with this record? Report it or request removal.
Discussion
Have you built on this work, tried to replicate it, or seen it applied in practice? Share what you know. Verified researchers and MARATTO™ domain experts can open a discussion, and any member can reply. Contributions are reviewed before they appear.
No discussion yet. Open the first thread.
New to MARATTO™? Create a free account.
