A Secure Framework For Controller Pilot Data Link Communications in Aviation Network

A Secure Framework For Controller Pilot Data Link Communications in Aviation Network Suleman Khan, Yinan Wang, Gurjot Singh Gaba, Andrei Gurtov IDA - Department of Computer and Information Science Link¨ oping University Link¨ oping, Sweden {suleman.khan, yinwa337@student, gurjot.singh, andrei.gurtov}@liu.se Pardeep Kumar Warwick Manufacturing Group Warwick University Warwick, UK pardeep.kumar[email protected] Abstract—Controller Pilot Data Link Communications (CPDLC) enhances air traffic communication by replacing traditional voice transmissions with digital messages over Very High Frequency (VHF) radio systems. This transition improves communication resilience by providing clear, text-based instructions that reduce misunderstandings and increase bandwidth efficiency by enabling more data to be transmitted simultaneously. It benefits congested airspace by reducing radio frequency congestion and minimizing communication errors. However, due to the plain-text nature of its messages, CPDLC faces significant security challenges, making it vulnerable to cyber-attacks such as eavesdropping, modification, injection, and man-in-the-middle (MITM) attacks. This vulnerability allows motivated attackers to intercept CPDLC messages using inexpensive devices like SoftwareDefined Radio (SDR), HACKRF-one, and an antenna. Such breaches can lead to fatal safety incidents, severely impacting passengers and the aviation industry. To address this, we proposed a robust security framework for securing CPDLC communication by implementing critical measures, including mutual authentication, secure key establishment, and handover. The proposed framework has been tested on hardware to verify its effectiveness in practical scenarios, ensuring it aligns with existing CPDLC standards and integrates seamlessly into current systems without impacting operational efficiency. Our findings indicate that the proposed security framework enhances CPDLC’s defenses against potential cyber threats while maintaining system performance, making it feasible to protect global air traffic communications. Index Terms—Aviation, CPDLC, Handover, Security, VHF I. INTRODUCTION The aviation industry is seeing a significant recovery after COVID-19, and predictions suggest that by 2024, the number of flights will not only exceed those in 2019 but could double by 2030 [1]. This growth puts immense pressure on traditional air traffic control (ATC) communication systems, crucial for safe and efficient air traffic management (ATM). In 2021, ATCs managed over 19 million flights worldwide [2], relying heavily on voice communication channels. ATCs traditionally use voice radio communications in the VHF band to coordinate flights and respond to emergencies. However, this system faces significant challenges, including delays in signal transmission due to its half-duplex nature, interference from overlapping channels, and bottlenecks at ATC centers. These issues can lead to slower response times and operational inefficiencies and may contribute to aviation incidents [3]. For example, Boeing noted that in congested airspace, pilots often experience 20 to 45-minute delays in using voice channels for position reporting [4] disrupting ATM. Furthermore, radio frequency channel disruptions can make aircraft operate at less efficient altitudes and speeds, potentially increasing the risk of aviation accidents [5]. Therefore, to address the limitations of traditional voice communication systems in aviation, the industry is actively modernizing ATM systems through initiatives such as the United States’ Next Generation National Airspace System (NextGen) [6] and Europe’s Single European Sky ATM Research (SESAR) program [7]. These initiatives are designed to enhance global airspace’s operational capabilities, efficiency, safety, and resilience by integrating advanced technologies. A key technology in this modernization is the CPDLC, which significantly reduces reliance on voice communications by enabling the exchange of text-based messages between pilots and ATCs. This system allows ATC to efficiently communicate flight plan updates, altitude and speed changes, and radio frequency assignments to pilots. Pilots can then respond to these messages, request new clearances, or report their statuses. CPDLC is particularly crucial in airspaces where datalink capabilities are mandatory, supporting strategic and non-emergency communications. In Europe, CPDLC operates through the Aeronautical Telecommunications Network (ATN) using VHF Data Link Mode 2 (VDLm2), facilitating a data transmission rate of 31.5 kilobits per second [8]. Meanwhile, in the USA and Australia, it is implemented via the satellite-based Future Air Navigation System (FANS-1/A). These implementations have collectively saved over 2.28 million minutes of radio communication time [9], minimizing the need for voice communications and enabling tighter aircraft separation, enhancing airspace capacity and safety. The ongoing efforts to align the standards of ATN and FANS-1/A worldwide highlight the critical importance of CPDLC in modernizing global airspace management and advancing aviation technology. While CPDLC offers significant benefits for aviation communication, it also introduces severe cyber security vulnera- bilities due to the plaintext nature of messages sent over unsecured channels. With equipment such as SDR dongle, a VHF airband antenna, and an amplifier, an attacker can eavesdrop, intercept, and modify CPDLC messages. Additionally, attackers can inject false messages and impersonate controllers or pilots, gaining unauthorized control. These cyber-attacks pose severe risks to the confidentiality, integrity, and availability of communication services, potentially leading to catastrophic outcomes for the entire aviation infrastructure [10]. The European Air Traffic Management-Computer Emergency Response Team (EATM-CERT) reported numerous critical cyber-attacks on airlines in 2020. One significant incident involved hackers gaining control of LOT airline’s ground control systems, resulting in operational immobility for several hours. This disruption led to the cancellation of 10 flights and significant delays for over a dozen additional flights [11]. These incidents highlight the critical cybersecurity vulnerabilities faced by airlines, which are essential for transporting diplomats, politicians, VIPs, and the general public and integral to the food supply chain. These vulnerabilities not only threaten the safety and efficiency of air travel but also compromise the anonymity and security of sensitive individuals and cargo. Consequently, the current cybersecurity limitations in CPDLC pose significant threats with far-reaching implications. Therefore, there is an urgent need for a bandwidth-efficient, cost-effective, reliable, and resilient solution to ensure robust security and privacy for ground-air communication, effectively protecting against cyber-attacks. A. Our Contributions Motivated by the need to improve CPDLC system security, we propose a comprehensive mutual authentication and secure key agreement solution complemented by a robust handover process. The main contributions of this paper are as follows: •We proposed a mutual authentication and secured key agreement solution tailored for the CPDLC system to enhance security while minimizing communication and computational costs. Our security framework employs Physical Unclonable Functions (PUF) for mutual authentication between the aircraft and ATSU and the Elliptic Curve Cryptography (ECC) protocol to facilitate the generation of a robust and secure session key.. •Our proposed security framework is also tailored for session handover when an aircraft switches between ATSUs. It ensures secure authentication of both the aircraft and the approaching ATSU, followed by generating a session key for secure communication. Additionally, our solution supports and secures session handovers when an aircraft transitions between ATSUs that do not support CPDLC, effectively addressing this unique challenge. •Finally, we evaluated our proposed security framework’s computational and communication costs using a testbed equipped with a Raspberry PI 3B+ and processing units. The evaluation focuses on practical applicability, assessing the solution in terms of computation time, efficiency, and payload compatibility. Our findings demonstrate that the proposed framework is effective and efficient for realworld deployment. B. Paper Organization The paper is structured as follows: Section 2 provides an in-depth literature review, clearly defines the problem statement, and elaborates on the research motivation. Section 3 presents the preliminaries, offering an overview of the CPDLC operational flow, the adversary model, security objectives, and essential background information on PUFs and ECC. Section 4 details the proposed methods for mutual authentication, key exchange, and secure handover. Section 5 describes the experimental setup used to validate the proposed framework and analyzes its performance. Finally, Section 6 concludes the paper by summarizing the key findings and suggesting potential avenues for future research. II. RELATED WORK The analysis of cybersecurity vulnerabilities in the CPDLC system has evolved through several significant studies. Initially, Strohmeier et al. [12] identified a range of threats to air-ground communication systems, including jamming, eavesdropping, message injection, and deletion. While comprehensive, their research did not cover a broader spectrum of security risks, nor did it address securing handovers between ATSUs. Building on this, Eskilsson et al. [10] demonstrated the CPDLC’s vulnerability to cyber-attacks by intercepting messages using a HackRF One RTL-SDR dongle, further emphasizing the need for robust security measures to protect these communications. Subsequently, Gurtov et al. [13] highlighted the cybersecurity vulnerabilities within the CPDLC framework more deeply. They identified critical security gaps and proposed a detailed threat model. To counteract these vulnerabilities, they recommended implementing ECC, the host-identity protocol (HIP), and identity-defined networking (IDN). However, while these advanced solutions show promise, their effectiveness in real-world scenarios remains untested. Additionally, their study did not address the security challenges during the handover process between ATSUs. Similarly, Smailes et al. [14] identified vulnerabilities in the CPDLC system to MITM attacks, especially during session handovers. They suggested a solution using Public Key Infrastructure (PKI) to enhance security without modifying existing CPDLC protocols. However, these recommendations have yet to be tested, creating uncertainty about their effectiveness and the potential impact on communication efficiency. Building upon the groundwork laid by the aforementioned studies, Griner et al. [15] have proposed an approach to enhance CPDLC’s security using cryptographic methods. They suggest using a two-step authentication process based on ECC, which is theoretically sound. However, this approach faces practical challenges related to computational efficiency and communication delays. To counteract cyber attacks in CPDLC systems, Khan et al. [16] proposed a secure solution for airto-ground communication using ECC and digital certificates. While effective, their solution incurs a slightly higher cost compared to our proposed framework. The existing security measures proposed for CPDLC have been designed with a narrow focus on potential threats and do not provide security for all types of handover. As a result, the existing proposed solutions have several critical shortcomings. These include (1) incompatibility with the structure of CPDLC messages and next data authority notification, (2) unpredictable performance due to the lack of implementation, and (3) high computational and time delays. A. Problem statement and research motivation The CPDLC system facilitates the wireless transmission of unencrypted data link messages between aircraft and ATSUs. However, it is vulnerable to cyber threats due to its unsecured wireless medium and lack of robust security measures. Attackers can exploit this vulnerability using equipment such as SDR dongles, VHF airband antennas, and amplifiers to intercept and manipulate communications. As a result, attackers can impersonate legitimate ground stations or aircraft, sending false messages that could cause aircraft to deviate from planned routes or relay incorrect information to ATC. The risks are especially high during the handover phase when control transitions between different ATSUs. During this critical period, attackers can perform jamming attacks to disrupt communication services, affecting both aircraft and ground stations. This disruption sets the stage for subsequent attacks, such as MITM operations, where adversaries can intercept and alter communications, compromising message integrity, confidentiality, and authentication. Additionally, these vulnerabilities allow attackers to conduct masquerading attacks, wherein they gain unauthorized access to classified information and take control of sensitive systems. They can also eavesdrop on data traffic without the consent of the communicating parties, severely breaching the confidentiality of communications. The combined impact of these threats highlights the urgent need for enhanced security solutions within the CPDLC system to protect against these diverse and potentially catastrophic cyber risks. For instance, a cyber incident involved a hacker group allegedly compromising ground-control computers of the state-owned Polish airline LOT, which prevented the issuance of flight plans and affected 1,400 passengers [17]. To avoid similar cyber abuses in the future, ATN must possess a high level of security and privacy. Researchers need to theoretically and experimentally address the following questions to ensure the development of a reliable and secure ground-air communication framework for the CPDLC: 1) How can aircraft and ATSUs ensure they are communicating with legitimate ATSUs or aircraft under adversarial conditions? 2) How can trust between an approaching ATSU and an aircraft be established during the handover phase? III. PRELIMINARIES AND BACKGROUND This section explores the operational flow of the CPDLC system, outlines the adversary model, discusses security objectives for CPDLC, and discusses essential preliminary concepts for PUF and ECC. A. Operational Flow of CPLDC Like other stream-oriented communication systems, entities in CPDLC must establish a connection before data transfer. However, CPDLC includes a unique handover phase after data exchange, where the aircraft disconnects from ATSU1 and initiates communication with ATSU2. Fig. 1 depicts this process, focusing on the ground-to-ground (G-G) handover. G-G handovers occur in situations where notification to the next authority is not required. This issue often arises when an aircraft transitions between ATSUs that do not both support CPDLC. To address this, the ICAO GOLD document [18] provides guidelines to ensure that the aircraft logs onto the new unit upon entering CPDLC-capable airspace. Following these guidelines ensures continuous data link communication, reducing the risk of miscommunication and enhancing flight safety, even without prior notification between ATSUs. Logon Request Logon Response Connection Request Connection Confirmation Exchange of CPDLC messages Logon Forwarding Connection Request Connection Confirmation Termination Confirmation Next Data Authority [ATSU2] Authentication Phase Handover Phase Terminate Session ATSU1ATSU2 Aircraft Termination Request Exchange of CPDLC messages Figure 1. Message exchange before and after CPDLC handover. Connection Establishment: CPDLC begins its process with the aircraft sending a Logon Request that includes information on supported data link applications, the aircraft’s identifier, and any additional details required for flight plan correlation. The ATSU1then responds with a Logon Confirmation as a Logon Response, affirming the successful correlation of the aircraft’s details with its flight plan. The ATSU1issues a CPDLC Connection Request to formally establish the data link communication channel. The aircraft completes the process by sending back a Connection Confirm message, signaling the successful establishment of the CPDLC connection for direct data communications between the aircraft and the ATSU1. Data Transfer: During this phase, CPDLC facilitates the exchange of commands, information, and responses between the aircraft and ATSU. The ATSU primarily issues command to the aircraft, which typically acknowledges responses like “Wilco” (will comply) or “Unable” to indicate compliance or inability to comply. This stage allows for a two-way communication flow, which is essential for the system’s operational efficiency. Connection Handover: This critical phase ensures the seamless transition of communication from one ground station to another. In a G-G handover, ATSU1informs the aircraft about the upcoming authority ATSU2and transfers the aircraft’s logon information to ATSU2. Following this, ATSU2 initiates a new connection request to the aircraft, which, upon confirmation, establishes a new link for data transfer between ATSU2and the aircraft. Connection Termination: The final phase occurs after a successful handover, where ATSU1issues a connection termination request to the aircraft. Upon receiving this request, the aircraft disconnects from ATSU1and continues communication with ATSU2until the next handover phase. B. Adversary Model We have adopted the Dolev-Yao adversarial model for analyzing security threats in the CPDLC system. This model demonstrates that attackers can intercept, read, modify, and manipulate wireless data transmissions between aircraft and ATSU. Consider a scenario of CPDLC handover, as depicted in Fig. 2, where the next authority is not notified. In this situation, a cyber attacker, identified as ATSUX, targets the communication process. The attack begins with ATSUXintercepting communications between an aircraft and ATSU1 and ATSU2. By analyzing these intercepted messages, ATSUX acquires ATSU1’s credentials. Using these credentials, ATSUX effectively impersonates ATSU1, sending falsified messages to the aircraft. Next, ATSUXintercepts a connection request from ATSU2intended for the aircraft. Spoofing the aircraft, ATSUX approves this request back to ATSU2, making ATSU2believe it is communicating with the legitimate aircraft. ATSUXthen spoofs ATSU2to initiate the connection process with the actual aircraft. The aircraft is deceived into thinking it is establishing a connection with the legitimate ATSU2. These impersonations are so seamless that neither the aircraft nor ATSU2detects the ongoing MITM attack. This specific handover scenario, where the next authority remains uninformed, highlights a critical vulnerability. Such vulnerabilities can compromise the safety and reliability of air traffic communications, potentially endangering lives and disrupting operations. C. Security Goals To ensure the CPDLC system is both secure and reliable, it must fulfill the following several critical security objectives and requirements: Mutual Authentication and Key Agreement: This security objective is essential to ensure that both the aircraft and ATSU authenticate each other’s identities and establish a secure Logon Request Logon Response Connection Request Connection Confirmation Exchange of CPDLC messages Logon Forwarding × Next Data Authority [ATSU2] Next Data Authority [ATSUX]× Connection Request Connection Confirmation Connection Request Connection Confirmation CPDLC Connection (INACTIVE) Termination Confirm Termination Request Exchange of CPDLC messages ATSU1ATSU2ATSUX Aircraft Authentication Phase Handover Phase Terminate Session Figure 2. Cyber security threats in the CPDLC system [14]. communication channel by agreeing on a session key before sending and receiving messages. This is a critical measure to prevent masqueraders from sending fake or malicious messages, which could endanger the aircraft and ATSU. It also ensures that messages come from legitimate sources, i.e., ATSU or aircraft. Typically, authentication involves using digital signatures or MAC, while key agreement utilizes protocols such as Diffie-Hellman to enable secure communication. Integrity: In CPDLC, it is crucial to maintain the integrity of messages to ensure that they have not been tampered with during transmission. This is particularly important for messages containing critical information such as flight plans, altitude assignments, and route modifications, as any unauthorized interference could lead to critical errors, including incorrect landing procedures that could risk operational safety. To ensure that messages are genuine, unaltered, and trustworthy, it is essential to apply secure hash algorithms and MACs. These measures play a significant role in verifying the authenticity of message contents, making them reliable and accessible from any unauthorized changes. Confidentiality: Ensuring confidentiality in the messages exchanged between aircraft and ATSU is critical to prevent unauthorized entities from accessing sensitive information. Attackers can eavesdrop on messages and obtain details such as lateral deviations, level assignments, speed assignments, and vectoring, which could lead to potential security risks. To protect the information and achieve confidentiality, the system must use encryption and session keys. By addressing mutual authentication and key agreement, integrity, and confidentiality, the CPDLC system can provide a secure and efficient means of communication critical to aviation operations’ safety and reliability. D. Background on PUF and ECC for Security Frameworks In this subsection, we discuss the preliminary requirements for our proposed solution. We extensively used two crucial components: PUFs and the ECC protocol. 1) Physical Unclonable Function:A PUF is essential in cryptography for ensuring secure communications [19]. Our system uses PUFs for their unique ability to transform given challenges (C) into corresponding responses (R), represented as R = PUF(C). Each PUF within the circuit has a unique challenge-response pair based on the system’s physical structure. This uniqueness makes PUF outputs unpredictable and difficult to duplicate, providing strong authenticity to the system. The complexity of creating PUFs and their resistance to cloning or manipulation make them ideal for securing communications in the CPDLC system. Any modifications to the system directly affect the PUF outputs, making them nearly impossible to replicate. This significantly enhances security against malicious activities [20]. 2) Elliptic Curve Cryptography:For the public key-based operations, we rely on the ECC [21], offering more lightweight solutions than the classical RSA. ECC is based on the algebraic structure of elliptic curves (ECs) over finite fields. We denote the curve in the finite field Fpwith pa large prime by Ep(a,b), defined by the equation y2=x3+ax +bwith aand btwo constants in Fpand ∆=4a3+ 27b2= 0. The base point generator of Ep(a,b)of prime order qis denoted by P. The EC multiplication R=rP = (Rx, Ry)with r∈Fq and Rx, Ry∈Fpresults in a point of the EC. The security of ECC is based on two computationally hard problems. •The Elliptic Curve Discrete Logarithm Problem, this problem states that given two EC points Rand Qof Ep(a,b)), it is computationally hard for any polynomialtime bounded algorithm to determine a parameter x∈ F∗ q, such that Q=xR. •The Elliptic Curve Diffie-Hellman Problem, given two EC points R=xP, Q =yP with two unknown parameters x, y ∈F∗ q, it is computationally hard for any polynomial-time bounded algorithm to determine the EC point xyP . IV. PROPOSED METHODOLOGY In this section, we present a comprehensive design of the proposed security framework, which is divided into four main subsections: assumptions, registration phase, mutual authentication, and session handover. To facilitate a clear understanding of how the framework operates, we have provided detailed definitions of the symbols and terms used in Table I, which serves as a reference for the terminology used throughout the following subsections. A. Assumptions In CPDLC, it is assumed that ATSUs communicate with one another via secure channels [22] [23] established using a shared secret key (SKAT SU ). This key is a crucial element known only to the respective group of ATNs or ATSUs. The SKAT SU is the foundation for secure exchanges, allowing ATSUs to securely share essential setup information, including cryptographic parameters and authenticity-related data. The SKAT SU is established through a Multi-Party Key Exchange (MPKE) approach within the ATN infrastructure [23]. This method ensures that ATSUs can securely agree on a SKAT SU , protecting against eavesdropping and other security threats by ensuring that all information shared among ATSUs remains secure. B. Registration phase The CPDLC system’s initialization phase involves a comprehensive offline registration process before the equipment becomes operational. This step is carried out in a secure, physically isolated facility with controlled access, effectively preventing electronic eavesdropping threats and TEMPEST interference. The registration data is manually entered into the system using secure, offline computers not connected to any network. Physical documents and media are used to transfer data between devices when necessary. The authenticity and integrity of all components and data are verified through unique serial numbers, barcodes, or QR codes, with multiple personnel involved to ensure accuracy and security. All registration data is stored in secure, tamper-evident physical storage to prevent unauthorized access. Detailed logs of the registration process are maintained, and regular audits are conducted to verify the integrity of the registration data and equipment. Only rigorously screened and verified personnel are allowed to participate in this process, ensuring a high level of security that effectively protects against cyber-attacks. These strict security measures ensure the integrity and security of the entire setup. The complete registration process is illustrated in Fig. 3 and explained as follows: Aircraft ATSU1 Generate challenge: CAS Prepare: M1 = IDATSU1 || CAS Compute: RAS = PAS(CAS) Compute: θ = H(RAS) Generate: τAS = H(ICAOAS || RAS)T24 Prepare: M2 = ICAOAS || τAS || RAS Pre-stored : ICAOAS Store: IDATSU1, θ, τAS Pre-Stored: IDATSU1 Store ICAOAS, τAS, RAS, CAS M1 M2 Secure Channel Figure 3. Aircraft Registration With ATSU. Table I NOTATION AND DESCRIPTION Notation Description Notation Description International Civil Aviation Organization Address ICAOATemporary (pseudo) identity of AS τAS Public and private element of AS and ATSUs (Y, X, R), (y, x, r) Message, where ith is the message number Mi Operator: Equality, Not Equal ≡?,=Concatenation, Scalar Multiplication ||,· Truncated to first 24 bits T24 H, Bit-wise XOR H, ⊕ Message Authentication Code Hθ,Hβ,HSK ,HSK′If true then continue else abort T−C/E −A Authentication Successful, Connection Termination AS,CT Nonces N1,N2,N3,N4 Challenge, Response, Embedded PUF CAS ,RAS ,PAS Fetch From Memory FetchM MAKE Mutual Authentication & Key Exchange 1) Step 1: The ATSU1begins the process by creating a unique challenge, denoted as CAS, and prepares a message M1containing ATSU1identity IDAT SU1and CAS. This message M1is then sent to the aircraft (AS). 2) Step 2: Upon receiving message M1, the AS uses its onboard PUF hardware PAS to generate the unique response RAS =PAS(CAS). It then hashes this response to produce the digest θ=H(RAS). The AS then creates its temporary identity τAS by hashing the concatenation of its ICAO code ICAOAS and RAS and truncates this hash to the first 24 bits. Following this, it sends a new message M2which includes ICAOAS,τAS, and RAS, to ATSU1. Lastly, AS also stores IDAT SU1,θ, and τAS for future communications. 3) Step 3: Upon receiving the message M2, the AT SU1 securely stores ICAOAS,τAS,RAS, and CAS, thereby completing the secure registration process. C. Mutual Authentication: In this subsection, we discuss the mutual authentication process of the proposed framework. To achieve mutual authentication, four messages are exchanged, shown in Fig. 4. •Step 1: The process begins with the AS retrieving τAS from its memory. The AS then selects a secret random value yand computes its public element Yby multiplying ywith a base point Pon an elliptic curve. Following this, the AS generates a nonce N1and uses it, along with τAS,IDAT SU1, and Yto compute a MAC, labeled MAC1. This MAC is designed to authenticate the AS to the ATSU1. Finally, the AS incorporates τAS,IDAT SU1, Y,N1, and MAC1into a logon request message M1 which is then sent to ATSU1. •Step 2: Upon receiving the logon request message M1, ATSU1first checks the freshness of nonce N1to protect against replay attacks. If N1is old, the connection is terminated to ensure security. Once N1is confirmed fresh, ATSU1searches for τAS and retrieves the corresponding challenge CAS and response RAS from its memory. Using RAS,AT SU1computes the digest β, crucial for the AS authentication. This digest is used to compute MAC′ 1, computed using received τAS,IDAT SU1,Yand N1which is then compared with the received MAC1. A match between MAC′ 1≡?MAC1confirms that the message originated from a legitimate AS and ensures it has not been altered during transmission, thus ensuring the authenticity and integrity of the message. To authenticate itself back to the AS, ATSU1generates a new nonce, N2, selects a random value x, and computes its public component, X=xP. It then computes MAC2=Hβ(N2||X) and sends logon response message M2, containing N2, X, and MAC2back to the AS for further processing. •Step 3: Upon receiving message M2, the AS checks nonce N2to ensure message freshness and prevent replay attacks. If N2is outdated, the connection is terminated. If validated as fresh, AS proceeds to compute a MAC, designated MAC′ 2, using the digest θ, which incorporates N2and X. A match between the computed MAC′ 2 and the received MAC2(MAC′ 2≡?MAC2) confirms ATSU1authenticity and ensures the integrity of the received message M2. Upon successful verification, AS stores Xand prepares for the next phase by awaiting the Connection Request message from ATSU1. •Step 4: Simultaneously, after sending a logon response ATSU1creates a new nonce, N3, and uses its random secret xalong with the received Yto compute the session key, SK =Hβ(xY ||N3). Using this SK,AT SU1 computes a new MAC, φ=HSK (N3||P ayload), by including N3and the CPDLC payload data. The payload includes aircraft identification, requested service, flight information (position, altitude, heading, flight plan), message type and priority, and the requested ATC data authority. This MAC is essential for ensuring the integrity and source of the message and that both ATSU1and the AS use the same session key. After these checks, ATSU1 sends the connection request message M3to the AS. •Step 5: Upon receiving message M3, the AS first checks nonce N3for freshness. If the message is old, the connection is terminated. If the nonce is valid, AS computes its session key, SK′=Hθ(yX||N3), using its secret value y,ATSU1public component X, and nonce N3. Subsequently, the AS then computes a new MAC, φ′=HSK′(N3||P ayload). If φ′matches the received φ, it confirms the successful establishment of the session key. To ensure to ATSU1that it correctly generated the Aircraft ATSU1 Fetch τAS Select a random number: y Compute: Y = yP Generate nonce: N1 Compute: MAC1 = Hθ(τAS || IDATSU1 || Y || N1) M1 = τAS || IDATSU1 || Y || N1 || MAC1 Verify: N3 (T-C / E-A) Compute: SK' = Hθ(yX || N3) Compute: φ' = HSK'(N3 || Payload) Verify: φ' ≡? φ (T-C / E-A) & (Key Verified) Generate nonce: N4 Compute: MAC4= HSK'(N4 || Payload) M4 = N4 || MAC4 Store: SK' Connection Request: M3 Logon Request: M1 Connection Confirmation: M4 Verify: N1 (T-C / E-A) Locate: τAS select: CAS, RAS Compute: β = H(RAS) Compute: MAC1' = Hβ(τAS || IDATSU1 || Y || N1) Verify: MAC1' ≡? MAC1 (A-S / C-T) Generate: N2 Select a random number: x Compute: X = xP Compute: MAC2 = Hβ(N2 || X) M2 = N2 || X || MAC2 Generate nonce: N3 Compute session key: SK = Hβ(xY || N3) Compute: φ = HSK(N3 || Payload) M3 = N3 || φ Store: SK Verify: N4 Compute: MAC4' = HSK(N4 || Payload) Verify: MAC4' ≡? MAC4 (T-C / E-A) & (Key Verified) Verify: N2 (T-C / E-A) Compute: MAC2' = Hθ(N2 || X) Verify: MAC2' ≡? MAC2 (A-S / C-T) Store: X Session Key is Established Successfully Step 1 Step 3 Step 5 Step 2 Step 4 Step 6 Public Channel Logon Response: M2 Figure 4. Proposed CPDLC security framework with Mutual authentication and Key exchange processes. session key, AS generates a new nonce N4and computes another MAC, MAC4=HSK′(N4||Payload). The payload consists of the acceptance or rejection of the request, the reason for rejection, the assigned controller’s identifier, communication instructions, and the next data link address. Subsequently, it then prepares and sends a new message, M4, containing N4and MAC4, back to ATSU1for further verification. •Step 6: Upon receiving message M4,AT SU1checks nonce N4for freshness to prevent replays. If fresh, ATSU1computes a MAC, MAC′ 4, using HSK with received N4and payload. A match confirms the integrity of the message and secures the establishment of the session key, completing the mutual authentication and key agreement between ATSU1and the AS. D. Session Handover Phase In this subsection, we discuss the ground base handover for the AS where the current ATSU1will send a Logon Forwarding message to the approaching ATSU2. The proposed security framework for handover is depicted in Fig. 5. •Step 1: The handover process begins with AT SU1 generating a nonce N1and a MAC, MACAT SU = Hβ(SKAT SU ), using a digest applied to the pre-shared session key SKAT SU for secure communication between ATSU1and AT SU2. Next, ATSU1prepares the message M1, which includes N1and an encrypted segment containing MACAT SU and IDAT SU2. This segment is encrypted using the session key SK. The purpose of M1 is to inform the AS of the upcoming transition to ATSU2. Simultaneously, ATSU1prepares a Logon Forwarding message M2for ATSU2. This message includes β, ICAOAS ,τAS,IDAT SU1, and Y, all encrypted with SKAT SU . This M2message is then sent to ATSU2. •Step 2: Upon receiving message M1, the AS first verifies the freshness of the message to ensure it hasn’t been replayed; a replay would result in terminating the connection. If the message is confirmed as fresh, the AS decrypts it using the SK, extracting message components for future communications. These include the identity of the upcoming ATSU2and a secret component, MACAT SU . This information is critical for setting up a secure and authenticated communication with AT SU2for subsequent interactions. •Step 3: Upon receiving M2,AT SU2verifies nonce N2 to ensure the message is fresh and not a replay. Following this security check, ATSU2decrypts M2to retrieve crucial elements such as β,ICAOAS ,τAS,IDAT SU1, and Y, which are vital for subsequent steps in securing communication with the AS. To establish a session key Aircraft ATSU1 Generate: N1 Generate: MACATSU = Hβ( SKATSU) M1 = N1 || E(SK, MACATSU || IDATSU2) Generate: N2 M2 = N2 || E(SKATSU, β || ICAOAS ||τAS || IDATSU1 || Y) Verify: N3 (T-C/E-A) Compute: SK2' = Hθ(yR || N3) Compute: η' = HSK2'( N3 || MACATSU || IDATSU2 || R) Verify: η' ≡? η (A-S / C-T) & (Key Verified) Generate: N4 Compute: MAC5 = HSK2'(N4 || τAS || MACATSU) M4 = N4 || MAC5 Store: SK2' ATSU2 Verify: N1 (T-C/E-A) M1 = D(SK, MACATSU || IDATSU2) Store: IDATSU2, MACATSU Verify: N2 (T-C/E-A) Decrypt: M2 = D(SKATSU, β || ICAOAS || τAS || IDATSU1 || Y) Generate: N3 Select random number: r Compute: R = rP Compute: SK2 = Hβ(rY || N3) Compute: MACATSU' = Hβ(SKATSU) Compute: η = HSK2(N3 || MACATSU' || IDATSU2 || R) M3 = N3 || IDATSU2 || R || η Store: ICAOAS, τAS, MACATSU' Verify: N4 (T-C/E-A) Compute: MAC5' = HSK2(N4 || τAS || MACATSU') Verify: MAC5' ≡? MAC5 (A-S / C-T) & (Key Verified) Store: SK2 Termination Request Termination Confirmation Connection Confirmation: M4 Public Channel Step 1 Step 2Step 3 Step 5 Step 4     Session Key is Established Successfully NDA: M1 Logon Forwarding: M2 Connection Request: M3 Figure 5. Proposed CPDLC security framework for session handover. with AS, ATSU2generates a new nonce, N3, and a secret random value, r. It then computes the public element R=rP and derives the session key SK2= Hβ(rY ||N3), which is intended to secure future communications. In order to affirm its authenticity and verify that both AS and AT SU2are synchronized with the correct session key, AT SU2computes a MAC, MAC′ AT SU = Hβ(SKAT SU ). This MAC serves as a secret element to prove the integrity and authenticity of ATSU2at the AS side. Moreover, AT SU2computes another MAC using SK2,η=HSK2(N3||MAC′ AT SU ||IDAT SU2||R). This computation integrates N3,MAC′ AT SU ,IDAT SU2, and R, ensuring the message’s integrity, authenticity, and nonrepudiation. Finally, ATSU2prepares the message M3, which includes N3,IDAT SU2,R, and ηin the M3which is then sent to AS, for verification. •Step 4: Upon receiving message M3, the AS validates the nonce N3, a crucial step for ensuring the message’s timeliness and protecting against replay attacks. If the message is detected as old, the connection will be terminated to maintain security. If the message is confirmed as fresh, the AS proceeds to derive a session key, SK′ 2=Hθ(yR||N3). Using this newly computed session key, the AS calculates a MAC, η′= HSK′ 2(N3||MACAT SU ||IDAT SU2||R). This computed MAC η′is then compared with the received MAC η to verify that the message originates from the legitimate ATSU2, has not been altered, and both AS and ATSU2possess the same session key. To further assure ATSU2of the successful session key computation, the AS generates a new nonce, N4, and computes another MAC, MAC5=HSK′ 2(N4||τAS||MACAT SU ), using the session key SK′ 2. This MAC5signals to AT SU2 that the AS has correctly derived the session key, thereby aligning both entities on the same encryption parameters. Finally, the AS prepares and sends message M4, which includes N4and the computed MAC5, to AT SU2, thereby completing this phase of communication. •Step 5: Upon receiving the connection response, AT SU2 verifies the freshness by checking nonce N4and computes MAC′ 5=HSK′ 2(N4||τAS||MACAT SU ). A match with the received MAC5confirms the message’s authenticity and validates possession of the correct SK2, completing the handover process and establishing a secure session key between AT SU2and the AS. Following this, AS receives a termination request from ATSU1 and closes the connection with AT SU1by sending a termination confirmation request. V. PERFORMANCE AND COMPARATIVE ANALYSIS This section provides a comprehensive overview of the performance results and findings. The proposed security framework is assessed using various metrics, such as computational efficiency, storage utilization, communication costs, and security features. Table II demonstrates that the proposed security framework successfully integrates key security properties, including confidentiality, message integrity, freshness, anonymity, and mutual authentication. These features enhance the framework’s resilience against various attacks, such as replay, injection, impersonation, modification and MITM. A comparison with existing schemes [14], [16] reveals that our framework offers significant improvements, particularly in providing comprehensive protection against all major attacks and ensuring identity concealment. However, while [11] also comprehensively covers all major security aspects, it incurs higher communication and computation costs compared with our proposed security framework. Table II SECURITY FEATURE COMPARISON OF PROPOSED SECURITY FRAMEWORK VS. CONVENTIONAL PROTOCOLS Security Features [11] [14] [16] Proposed Framework Authentication ✓ ✓ ✓ ✓ Integrity ✓ ✓ ✓ ✓ Confidentiality ✓×✓ ✓ Anonymity ✓× × ✓ Forward secrecy ✓ ✓ ✓ ✓ Injection ✓ ✓ ✓ ✓ Replay Attack ✓ ✓ ✓ ✓ MITM ✓ ✓ ✓ ✓ Masquerading attacks ✓ ✓ ✓ ✓ Eavesdropping ✓×✓ ✓ ✓: Secure against attack / Preserve a security attribute, ×: Vulnerable/non-accomplishment of the security attribute Experimental setup: The cryptographic primitives for our proposed framework were implemented using version 1.60 of the Bouncy Castle (BC) library on two different systems: a Raspberry PI 3B+ (R-PI) with a 64-bit quad-core 1.4GHz processor and 1GB of RAM and a Core-i7 computer (PC) with a 2.2GHz processor and 16GB of RAM. To ensure the accuracy and reliability of our performance measurements, we utilized the Java Microbenchmark Harness (JMH) toolkit, version 1.21, to assess the time required for cryptographic operations on both the R-PI+ and the PC. Computational cost: The average processing times for critical cryptographic operations on different hardware platforms are depicted in Table III. On the Raspberry PI 3B+, Elliptic Curve (EC) Addition (A) takes 156.8 µs, EC Multiplication (M) requires 32,800 µs, SHA-256 hashing (H) is completed in 13.52 µs, and AES encryption/decryption (AES) occurs in 53.86 µs. Conversely, on a PC, EC Addition (A) is executed in 4.86 µs, EC Multiplication (M) in 1148.2 µs, SHA-256 hashing (H) in 1.02 µs, and AES encryption/decryption (AES) in 2.90 µs. These results affirm the efficiency of the proposed protocol on both hardware’s. Table III EXECUTION TIME (IN µS)OF PROPOSED FRAMEWORK ON HARDWARE’S Device R-PI PC Library BC BC A156.8±0.7 4.866 ±0.005 M32800 ±20 1148.2±0.8 H13.52 ±0.04 1.023 ±0.002 E/D53.86 ±0.17 2.90 ±0.03 Table IV comprehensively compares the computational costs between our proposed framework and conventional protocols for registration, mutual authentication, and key agreement. Our findings highlight several significant advantages of our framework. During the registration phase, our solution requires only H2T+PUF1T, making it more efficient compared to the lack of detailed cost breakdowns in traditional protocols [11], [16]. In the mutual authentication phase, our framework incurs a total cost of H1T+R6T+SM4T+MAC10T, which is more streamlined than conventional methods. Notably, in the handover phase, our framework demonstrates superior efficiency with a total cost of R5T+SM3T+MAC8T+D2T+E2T, compared to [11]’s H6T+M11T+A5T+D1T+E1Tand [16]’s H10T+M16T+A3T+E3T+D3T. These results underscore the effectiveness of our framework, showcasing its competitive computational efficiency across crucial operational phases. Storage Cost: Our security framework utilizes 256 bits for hashing to ensure data integrity. We allocate 32 bits for nonce’s to maintain session uniqueness and security. Additionally, we use 128-bit MAC tags to authenticate and verify the integrity of our communications, while each communication entity is identified using a 24-bit identifier. Data overhead: We assign the aforementioned storage cost to every message in the proposed security framework. Authentication data overhead: The authentication phase of the proposed security framework involves four key steps in the message exchange between ATSU1and the aircraft. Initially, the aircraft sends a Logon message M1to ATSU1containing its 24-bit temporary ID (τAS), 24-bit ATSU1ID (IDAT SU1), 256-bit public element Y, 32-bit nonce N1, and 128-bit MAC tag MAC1, resulting in a total of 464 bits. Following this, ATSU1sends a Logon Response M2, which includes a 32bit nonce N2, its 256-bit public element X, and a 128-bit MAC tag MAC2, totaling 416 bits. The subsequent message M3serves as a connection request and contains the 32-bit nonce N3and 128-bit MAC tags ψtotaling 160 bits. The final message M4sent by the aircraft to ATSU1includes a 32-bit nonce N4and a 128-bit MAC tag MAC4, making up 160 bits. This sequence of messages secures each phase of communication between the aircraft and ATSU1and is depicted in Fig. 6. M1 M2 M3 M4 Messages 0 100 200 300 400 Bits 464 416 160 160 Aircraft M1 & M4 ATSU M2 & M3 Figure 6. Data overhead comparison of proposed framework during authentication and key exchange.