System and method for verifying aircraft position information

A method of verifying aircraft position information based on ADS-B messages includes receiving an ADS-B message indicating an identifier of an aircraft and indicating a position of the aircraft. The method includes accessing a tamper-resistant distributed public ledger of authenticated flight plan data to determine whether flight plan data associated with the identifier is stored in the tamper-resistant distributed public ledger. The method includes, conditioned upon a determination that the flight plan data is stored in the tamper-resistant distributed public ledger, comparing the position to a flight path indicated by the flight plan data. The method includes selecting a characteristic of an icon corresponding to the aircraft based on a determination whether the position corresponds to the flight path. The method further includes displaying, on a display device and based on the characteristic, the icon at a location corresponding to the position.

FIELD OF THE DISCLOSURE

The present disclosure is generally related to verifying aircraft position information.

BACKGROUND

Automatic Dependent Surveillance-Broadcast (ADS-B) is a technology that enables an aircraft to measure its own position by use of electronic equipment on-board the aircraft and to transmit position information using a digital data link. For example, the aircraft can use a global positioning system (GPS) receiver to determine the position information, and then the aircraft can transmit the position information in an ADS-B message to other aircraft, to air traffic control towers or other ground stations, or to other recipients. The Federal Aviation Administration (FAA) has mandated that aircraft be equipped to transmit ADS-B messages by 2020. Thus, aircraft manufacturers are increasingly including ADS-B capability on aircrafts. To maintain transparency to recipients, the ADS-B messages are unencrypted. Because the ADS-B messages are unencrypted, there is concern that a malicious actor could generate inaccurate or inauthentic ADS-B messages.

SUMMARY

In a particular implementation, a method of verifying aircraft position information based on automatic dependent surveillance broadcast (ADS-B) messages includes receiving an ADS-B message indicating an identifier of an aircraft and indicating a position of the aircraft. The method includes accessing a tamper-resistant distributed public ledger of authenticated flight plan data to determine whether flight plan data associated with the identifier is stored in the tamper-resistant distributed public ledger. The method includes, conditioned upon a determination that the flight plan data is stored in the tamper-resistant distributed public ledger, comparing the position to a flight path indicated by the flight plan data. The method includes selecting a characteristic of an icon corresponding to the aircraft based on a determination whether the position corresponds to the flight path. The method further includes displaying, on a display device and based on the characteristic, the icon at a location corresponding to the position.

In another particular implementation, an apparatus for verifying aircraft position information based on ADS-B messages includes a receiver configured to receive an ADS-B message indicating an identifier of an aircraft and indicating a position of the aircraft. The apparatus includes a processor coupled to the receiver and configured to access a tamper-resistant distributed public ledger of authenticated flight plan data to determine whether flight plan data associated with the identifier is stored in the tamper-resistant distributed public ledger. The processor is configured to, conditioned upon a determination that the flight plan data is stored in the tamper-resistant distributed public ledger, compare the position to a flight path indicated by the flight plan data. The processor is further configured to select a characteristic of an icon corresponding to the aircraft based on a determination whether the position corresponds to the flight path. The apparatus further includes a display device coupled to the processor and configured to display the icon based on the characteristic and at a location corresponding to the position.

In another particular implementation, a computer-readable storage device stores instructions that, when executed by a processor, cause the processor to perform operations including receiving an ADS-B message indicating an identifier of an aircraft and indicating a position of the aircraft. The operations include accessing a tamper-resistant distributed public ledger of authenticated flight plan data to determine whether flight plan data associated with the identifier is stored in the tamper-resistant distributed public ledger. The operations include, conditioned upon a determination that the flight plan data is stored in the tamper-resistant distributed public ledger, comparing the position to a flight path indicated by the flight plan data. The operations include selecting a characteristic of an icon corresponding to the aircraft based on a determination whether the position corresponds to the flight path. The operations further include initiating display, on a display device and based on the characteristic, of the icon at a location corresponding to the position.

DETAILED DESCRIPTION

Particular implementations are described with reference to the drawings. In the description, common features are designated by common reference numbers throughout the drawings. As used herein, various terminology is used for the purpose of describing particular implementations only and is not intended to be limiting. For example, the singular forms “a,” “an,” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. Further, the terms “comprise,” “comprises,” and “comprising” may be used interchangeably with “include,” “includes,” or “including.” Additionally, it will be understood that the term “wherein” may be used interchangeably with “where.” As used herein, “exemplary” may indicate an example, an implementation, and/or an aspect, and should not be construed as limiting or as indicating a preference or a preferred implementation. As used herein, an ordinal term (e.g., “first,” “second,” “third,” etc.) used to modify an element, such as a structure, a component, an operation, etc., does not by itself indicate any priority or order of the element with respect to another element, but rather merely distinguishes the element from another element having a same name (but for use of the ordinal term). As used herein, the term “set” refers to a grouping of one or more elements, and the term “plurality” refers to multiple elements.

In the present disclosure, terms such as “determining”, “calculating”, “generating”, “adjusting”, “modifying”, etc. may be used to describe how one or more operations are performed. It should be noted that such terms are not to be construed as limiting and other techniques may be utilized to perform similar operations. Additionally, as referred to herein, “generating”, “calculating”, “using”, “selecting”, “accessing”, and “determining” may be used interchangeably. For example, “generating”, “calculating”, or “determining” a parameter (or a signal) may refer to actively generating, calculating, or determining the parameter (or the signal) or may refer to using, selecting, or accessing the parameter (or signal) that is already generated, such as by another component or device. Additionally, “adjusting” and “modifying” may be used interchangeably. For example, “adjusting” or “modifying” a parameter may refer to changing the parameter from a first value to a second value (a “modified value” or an “adjusted value”). As used herein, “coupled” may include “communicatively coupled,” “electrically coupled,” or “physically coupled,” and may also (or alternatively) include any combinations thereof. Two devices (or components) may be coupled (e.g., communicatively coupled, electrically coupled, or physically coupled) directly or indirectly via one or more other devices, components, wires, buses, networks (e.g., a wired network, a wireless network, or a combination thereof), etc. Two devices (or components) that are electrically coupled may be included in the same device or in different devices and may be connected via electronics, one or more connectors, or inductive coupling, as illustrative, non-limiting examples. In some implementations, two devices (or components) that are communicatively coupled, such as in electrical communication, may send and receive electrical signals (digital signals or analog signals) directly or indirectly, such as via one or more wires, buses, networks, etc. As used herein, “directly coupled” may include two devices that are coupled (e.g., communicatively coupled, electrically coupled, or physically coupled) without intervening components.

The present disclosure describes systems and methods to verify aircraft position information based on ADS-B messages. The position information included in ADS-B messages is verified through accessing of a tamper-resistant distributed public ledger (e.g., a blockchain) that is used to store flight plan data for flights in a related geographical area. To illustrate, a first aircraft (or an air traffic control (ATC) station) receives an ADS-B message indicating an identifier of a second aircraft and a position of the second aircraft. Additionally, a ground-based flight management system maintains a tamper-resistant distributed public ledger (e.g., a blockchain) of flight plan data by adding entries each time a flight plan (or a group of flight plans) is received. The first aircraft (or ATC station) accesses the tamper-resistant distributed public ledger to determine whether flight plan data for the identifier of the second aircraft is stored therein. If the flight plan data exists (e.g., is stored in the tamper-resistant distributed public ledger), the first aircraft (or the ATC station) compares the position of the second aircraft indicated by the ADS-B message to a flight path indicated by the flight plan data.

If the position matches (within a threshold) a position along the flight path, the first aircraft (or the ATC station) displays an icon corresponding to the second aircraft on a display screen. The icon has a first characteristic, such as a first color, border, shading, size, shape, or a combination thereof, to indicate that the position of the second aircraft has been confirmed. If the position does not match a position along the flight path (or if flight plan data corresponding to the identifier of the second aircraft is not stored in the tamper-resistant distributed public ledger), the aircraft (or the ATC station) displays the icon with a second characteristic to indicate that the position of the second aircraft has not been confirmed. The aircraft (or the ATC station) can then take additional steps to confirm whether or not the position of the second aircraft is accurate, such as by querying the flight management system (which may have more up-to-date information indicating that the second aircraft is in an unexpected position or may be able to attempt contact with the second aircraft, if it exists and is not the result of a malicious actor, to confirm the position). Thus, the techniques of the present disclosure enable verification of position information indicated by ADS-B messages using a tamper-resistant distributed public ledger, which improves security of the ADS-B technology.

FIG.1illustrates an example of a particular implementation of a system100that verifies position information based on ADS-B messages. The system100includes a first aircraft102, a second aircraft104, a flight management system108, and a tamper-resistant distributed public ledger110(e.g., a blockchain). As further described herein, operations of the first aircraft102and the second aircraft104are performed by components of the respective aircraft, such as a processor, a receiver, a transmitter, etc.

The flight management system108is included or integrated in a ground-based station, such as a station operated by a government agency, a station operated by one or more airlines, an ATC station, or any other type of ground-based station. In some implementations, the flight management system108includes or corresponds to a desktop computer, a laptop computer, a tablet computer, a server, a mainframe, a mobile device (e.g., a mobile telephone), or any other type of computing device.

The flight management system108is configured to generate and maintain the tamper-resistant distributed public ledger110. For example, the flight management system108is configured to receive flight plans from one or more airlines, either from ground-based systems or from the aircraft themselves. The flight management system108is configured to authenticate the flight plans. For example, each airline may be issued a private key, and flight plan data received from the airline can be digitally signed using the private key. The flight management system108verifies the digital signature using a public key associated with the airline. In this manner, correct verification of the digital signature of the flight plan data serves as authentication of the flight plan data (e.g., via the use of public and private keys). In other implementations, other techniques for authenticating the flight plan data are used.

After authenticating the received flight plan data, the flight management system108is configured to generate one or more entries in the tamper-resistant distributed public ledger110conditioned upon authentication of the received flight plan data. To illustrate, the flight management system108generates an entry in the tamper-resistant distributed public ledger110that includes the received flight plan data. Each entry in the tamper-resistant distributed public ledger110includes flight plan data for one or more aircraft during a particular time period. In a particular implementation, the entries in the tamper-resistant distributed public ledger110correspond to a particular geographic region. For example, different tamper-resistant distributed public ledgers can be maintained for storing flight plan data for different geographic regions.

To illustrate, the tamper-resistant distributed public ledger110is shared in a distributed manner between the flight management system108, aircraft, ATC stations, airline systems, government systems, and other systems (e.g., across a plurality of devices). In a particular implementation, each of the systems stores an instance of the tamper-resistant distributed public ledger110in a local memory of the respective system. In other implementations, the flight management system108stores the tamper-resistant distributed public ledger and each portion is replicated across multiple systems in a manner that maintains security of the tamper-resistant distributed public ledger110as a public (i.e., available to other devices) and incorruptible (or tamper-resistant/evident) ledger.

The tamper-resistant distributed public ledger110stores flight plan data for a plurality of flight plans of a plurality of aircraft during a particular time period and for a particular geographic region. In a particular implementation, each entry in the tamper-resistant distributed public ledger110specifies an identifier, a corresponding point of arrival, a corresponding point of departure, a corresponding flight path, a corresponding altitude, or a combination thereof. Additionally, each entry in the tamper-resistant distributed public ledger110includes a hash value corresponding to a previous entry in the tamper-resistant distributed public ledger110. For example, each entry includes information that identifies the entry (e.g., an entry/block ID) and enables another device or system to confirm the integrity of the tamper-resistant distributed public ledger110. For example, the entry ID can include or correspond to the result of a hash function (e.g., a Secure Hashing Algorithm 256 (SHA-256) hash function, a RACE Integrity Primitives Evaluation Message Digest (RIPEMD) hash function, a Message Digest Algorithm 5 (MD5) hash function, or a BLAKE2 hash function, as non-limiting examples) based on the flight plan data in the entry and based on an entry ID from the prior entry (e.g., block) of the tamper-resistant distributed public ledger110(e.g., the blockchain). For example, inFIG.1, a first entry including the first flight plan data112includes a hash value based on the first flight plan data112. A second entry including the second flight plan data114includes a hash value based on the second flight plan data114and the hash value from the first entry. Similarly, a third entry includes a hash value based on the third flight plan data116and the hash value from the second entry. This chained arrangement of hash values enables each entry (e.g., block) to be validated with respect to the entire tamper-resistant distributed public ledger110(e.g., blockchain); thus, tampering with or modifying values in any entry of the tamper-resistant distributed public ledger110is evident by calculating and verifying the hash value of the final entry in the tamper-resistant distributed public ledger110. Accordingly, the tamper-resistant distributed public ledger110acts as a public ledger of flight plan data.

In some implementations, each entry includes flight plan data for a single aircraft. In other implementations, the flight management system108bundles flight plans for multiple aircraft together in a single entry before adding the entry to the tamper-resistant distributed public ledger110, for example in accordance with an entry adding (e.g., a block adding) scheme. For example, the flight management system108is configured to determine when an entry (e.g., block) adding trigger satisfies an entry adding condition. The entry adding trigger can include or correspond to a number of received flight plans, a time interval since the last entry was added to the tamper-resistant distributed public ledger110, another criterion, or a combination thereof. When the entry adding condition is satisfied (e.g., a threshold number of flight plans have been received or a threshold amount of time has elapsed), a new entry is generated and added to the tamper-resistant distributed public ledger110. In a particular implementation, the flight management system108includes a flight plan data buffer to store received flight plan data until the entry adding trigger satisfies the entry adding condition.

In a particular implementation, the flight management system108maintains the tamper-resistant distributed public ledger in accordance with an entry conflict resolution scheme. To illustrate, in implementations where multiple systems are capable of adding entries to the tamper-resistant distributed public ledger110, entry conflicts can arise. An entry (e.g., block) conflict refers to a circumstance in which a first system forms and sends a first entry, and simultaneously or near simultaneously, a second system forms and sends a second entry that is different than the first entry. In this circumstance, some systems receive the first entry while other systems receive the second entry before the first entry. In this circumstance, both the first entry and the second entry are provisionally added to the tamper-resistant distributed public ledger110, causing the tamper-resistant distributed public ledger110to branch. The branching is resolved when the next entry is added to the end of one of the branches such that one branch is longer than the other (or others). In this circumstance, the longest branch is designated as the main branch. When the longest branch is selected, any flight plan data that is in an entry corresponding to a shorter branch and that is not accounted for in the longer branch is returned to the flight management system108(e.g., to the flight plan data buffer) for inclusion in a subsequent entry.

Entries in the tamper-resistant distributed public ledger110are not encrypted. Thus, the tamper-resistant distributed public ledger is available to the public, such as to aircraft (e.g., the first aircraft102and the second aircraft104), ATC stations, airlines, and government agency systems. Additionally, although the flight management system108is described as maintaining (e.g., adding entries to) the tamper-resistant distributed public ledger110, in other implementations, other systems can share in maintaining the tamper-resistant distributed public ledger110provided the other systems are configured to authenticate received flight plan data and to perform in accordance with the rules (e.g., the entry adding scheme, the conflict resolution scheme, etc.) of the tamper-resistant distributed public ledger110.

In the example ofFIG.1, the flight management system108receives flight plan data for the first aircraft102, the second aircraft104, and a third aircraft. Based on the flight plan data associated with the first aircraft102, the flight management system108generates an entry in the tamper-resistant distributed public ledger110including first flight plan data112. Based on the flight plan data associated with the second aircraft104, the flight management system108generates an entry in the tamper-resistant distributed public ledger110including second flight plan data114. Based on the flight plan data associated with the third aircraft, the flight management system108generates an entry in the tamper-resistant distributed public ledger110including third flight plan data116. In other implementations, the flight management system108generates a single entry that includes the first flight plan data112, the second flight plan data114, and the third flight plan data116.

The flight management system108maintains the tamper-resistant distributed public ledger to enable aircraft, ATC stations, or other entities to verify position data in received ADS-B messages. In the example ofFIG.1, during flight, the first aircraft102receives an ADS-B message120from the second aircraft104. The ADS-B message120indicates an identifier122of the second aircraft and a position124(e.g., a latitude and a longitude) of the second aircraft. Although not illustrated, ADS-B messages can include other information, such as altitude, bearing, and speed, as non-limiting examples. In a particular implementation, ADS-B messages are not encrypted when received (or transmitted) to enable public access to the position data indicated within.

To illustrate, in a particular implementation, the second aircraft104includes a positioning system, such as a GPS receiver, that is configured to determine a position of the second aircraft104. The second aircraft104is configured to determine its position and to indicate its position by periodically transmitting ADS-B messages, such as the ADS-B message120, using a transmitter. Additionally, although the first aircraft102is described as receiving ADS-B messages, the first aircraft102, in some implementations, is also includes a GPS receiver or other positioning system and the first aircraft102is configured to determine its position and to indicate the position by transmitting ADS-B messages.

After receiving the ADS-B message120from the second aircraft104, the first aircraft102accesses the tamper-resistant distributed public ledger110to determine whether flight plan data associated with the identifier122is stored in the tamper-resistant distributed public ledger110. For example, the first aircraft102determines whether any of the flight plan data stored in the tamper-resistant distributed public ledger110includes the identifier122. If flight plan data stored in the tamper-resistant distributed public ledger110matches the identifier122, the first aircraft102compares the position124to a flight path indicated by matching flight plan data. For example, conditioned on a determination that the second flight plan data114specifies the identifier122, the first aircraft102compares the position124to the flight path indicated by the second flight plan data114.

The position124corresponds to the flight path if the position124is within a threshold distance of an expected position along the flight path. For example, the flight path may indicate a plurality of positions, and the first aircraft102compares the position124(indicated by the ADS-B message120) to each position indicated by the flight path to determine whether the position124is within a threshold distance of at least one position indicated by the flight path.

Based on the comparison, the first aircraft102selects a characteristic of an icon to represent to the second aircraft104in an information display. The characteristic includes a color, a border, a shading, a size, a shape, or a combination thereof, of the icon. To illustrate, if the position124corresponds to a position along the flight path indicated by the second flight plan data114, the first aircraft102selects a first color (e.g., a first characteristic) for the icon corresponding to the second aircraft104. Icons with the first characteristic indicate that the position information of the corresponding aircraft has been verified. The first aircraft then displays, on a display device and based on the characteristic, the icon at a location corresponding to the position. For example, the display device is configured to display icons of aircraft in an airspace of the first aircraft102. Icons that are displayed with the first characteristic (e.g., the first color) indicate aircraft for which position information has been verified. Icons that are displayed with a second characteristic (e.g., a second color) indicate aircraft for which position information has not been verified, for which additional actions can be taken, as further described herein.

To illustrate, in the example ofFIG.1, the first aircraft102also receives an ADS-B message130from another source106. In this example, the other source106is a malicious actor, such as a hacker, and is not from an aircraft that is properly transmitting ADS-B messages. The ADS-B message130includes an identifier132of a third aircraft and a position134of the third aircraft. However, in this example, the ADS-B message130is malicious message, and the third aircraft is not actually located at the position134.

Instead of simply processing the ADS-B message130and displaying an icon corresponding to the third aircraft, which would provide the pilot with an incorrect representation of the airspace, the first aircraft102accesses the tamper-resistant distributed public ledger110for verification of the ADS-B message130. To illustrate, the first aircraft102determines whether any flight plan data stored in the tamper-resistant distributed public ledger110matches the identifier132. Because there is a flight plan corresponding to the third aircraft, the first aircraft102is able to match the identifier132to the third flight plan data116.

Next, the first aircraft102compares the position134to a flight path indicated by the third flight plan data116. Because the position134is selected by a malicious actor, the position134is not related to a flight path of the third aircraft. Based on a determination that the position134does not correspond to any position indicated by the flight path of the third flight plan data116, the first aircraft102selects a characteristic (e.g., a second color) for an icon that corresponds to the third aircraft and initiates display of the icon based on the selected characteristic. For example, the display device of the first aircraft102displays a second icon having a second color, the second icon corresponding to the third aircraft. Additionally, if the identifier132does not match an identifier indicated by flight plan data stored at the tamper-resistant distributed public ledger110, the first aircraft selects the second color for an icon corresponding to the third aircraft (e.g., because the position134cannot be verified by flight plan data). Because the icon has the second color, a pilot looking at the display device is able to understand that the position of the third aircraft failed verification, and the pilot can have a better understanding of the airspace around the first aircraft102.

In situations where the position information indicated in an ADS-B message fails verification, the first aircraft102can perform additional actions to attempt to verify the position. To illustrate, the first aircraft102transmits a first message140to the flight management system108. The first message140is transmit conditioned upon a determination that the position134fails to correspond to a flight path indicated by the third flight plan data116(or a determination that no flight plan data stored at the tamper-resistant distributed public ledger110matches the identifier132). In a particular implementation, the first message140includes the identifier132and the position134.

The flight management system108is configured to receive the first message140and to attempt to verify the position134. For example, the flight management system108can have access to an updated flight plan for the third aircraft that has not yet been added to the tamper-resistant distributed public ledger110. Additionally, or alternatively, the flight management system108can receive information that the aircraft is off course. The information can be received from an airline or an ATC station. Thus, the flight management system108can store or have access to information indicating the position of the third aircraft. If the flight management system108does not have access to such information, the flight management system108can also attempt to communicate with the third aircraft to confirm its position directly from the third aircraft. After verifying (or failing to verify) the position of the third aircraft, the flight management system108generates and sends a second message142to the first aircraft102. The second message142confirms whether or not the position134is verified.

The first aircraft102updates display of the icon corresponding to the third aircraft based on the second message142. For example, if the second message142indicates that the position134is verified, the first aircraft102modifies the characteristic of the icon (e.g., changes the icon from the second color to the first color) to indicate that the position of the third aircraft is verified. As another example, if the second message142indicates that the third aircraft does not exist or that the position134failed verification (e.g., that the ADS-B message130is not a legitimate ADS-B message), the first aircraft102removes the icon corresponding to the third aircraft from the display device or changes to a third characteristic for display. Thus, if an ADS-B message fails verification by the first aircraft102and the flight management system108, the message is interpreted as malicious and inaccurate, and no icon is displayed at the display device. In other implementations, the icon remains with the second characteristic.

Verifying whether position data included in an ADS-B message is correct using the tamper-resistant distributed public ledger110provides a method for identifying ADS-B messages provided by malicious actors. Because the tamper-resistant distributed public ledger110is maintained by the flight management system108and because each entry contains a hash value that indicates a previous entry, the flight plan data stored in the tamper-resistant distributed public ledger110can be trusted to be authenticated and accurate. Thus, aircraft, ATC stations, or other recipients of ADS-B messages can verify the position data contained therein and ignore malicious ADS-B messages, which improves security of ADS-B technology without requiring encrypting or other techniques that would reduce the transparency of the ADS-B technology.

FIG.2illustrates an example of a position verification system200. In a particular implementation, the position verification system200is included or integrated in an aircraft, such as the first aircraft102ofFIG.1. In another particular implementation, the position verification system200is included or integrated in or coupled to an ATC station or other ground-based station that receives ADS-B messages. In some implementations, the position verification system200includes or corresponds to a desktop computer, a laptop computer, a tablet computer, a server, a mainframe, a mobile device (e.g., a mobile telephone), a component of a vehicle, or any other type of computing device.

The position verification system200includes a processor202, a receiver204, a transmitter206, a memory210, and a display device220. In other implementations, the position verification system200includes additional components, such as input/output interfaces, etc. Alternatively, one or more components can be external to the position verification system200. For example, in some implementations, the display device220is external to the position verification system200.

The processor202is configured to execute instructions212stored at the memory210to perform the operations described herein. For example, the processor202verifies position data indicated by ADS-B messages, as further described herein.

The transmitter206is configured to enable the position verification system200to send data to one or more other devices via direct connection or via one or more networks, and the receiver204is configured to enable the position verification system200to receive data from one or more other devices via direct connection or via one or more networks. The one or more networks may include Institute of Electrical and Electronics Engineers (IEEE) 802 wireless networks, Bluetooth networks, telephone networks, satellite networks, optical or radio frequency networks, or other wired or wireless networks. Although illustrated as distinct components, in other implementations, the transmitter206and the receiver204are replaced with a transceiver that enables sending and receipt of data from one or more other devices.

In a particular implementation, the receiver204is configured to receive ADS-B messages from aircraft (or other sources). For example, the receiver204receives the ADS-B message120and the ADS-B message130, as described with reference toFIG.1. The ADS-B messages are processed by the processor202, as further described herein.

The memory210includes volatile memory devices (e.g., random access memory (RAM) devices), nonvolatile memory devices (e.g., read-only memory (ROM) devices, programmable read-only memory, and flash memory), or both. The memory210is configured to store the instructions212that are executed by the processor202to perform the operations described herein. In some implementations, the memory210is also configured to at least a portion of a tamper-resistant distributed public ledger, such as the tamper-resistant distributed public ledger110ofFIG.1.

The display device220includes a display screen that is configured to display icons corresponding to aircraft. In a particular implementation, the display device220includes a display screen, a liquid crystal display (LCD) screen, a touchscreen, or any other type of display device. In a particular implementation in which the position verification system200is included in an aircraft, the display device220can include a primary flight display (PFD) or a traffic collision avoidance system (TCAS) display. In another particular implementation in which the position verification system200is included in an ATC station, the display device220can include a radar screen.

During operation, the receiver204receives ADS-B messages. For example, the receiver204receives the ADS-B message120(e.g., from the second aircraft104of FIG.1) and the ADS-B message130(e.g., from the other source106ofFIG.1). The ADS-B message120indicates the identifier122of the second aircraft104and the position124of the second aircraft104. The ADS-B message130indicates the identifier132of the third aircraft and the position134of the third aircraft. However, as described with reference toFIG.1, the ADS-B message130is generated by a malicious actor, and the third aircraft is not actually located at the position134.

The processor202accesses the tamper-resistant distributed public ledger110ofFIG.1to determine whether flight plan data associated with identifiers indicated by the ADS-B messages are stored in the tamper-resistant distributed public ledger110. For example, the processor202compares an identifier indicated by the ADS-B messages to identifiers specified by entries in the tamper-resistant distributed public ledger110. For example, the receiver204receives the first flight plan data112, the second flight plan data114, and the third flight plan data116from the tamper-resistant distributed public ledger110. In some implementations, the first flight plan data112, the second flight plan data114, the third flight plan data116, or a combination thereof, is stored at the memory210as the portion of the tamper-resistant distributed public ledger214.

If the identifier matches an identifier included in an entry, the processor202compares the position indicated by the ADS-B message to a flight path included in the entry to determine whether the position corresponds to the flight path. If the position corresponds to the flight path, the processor202selects a first characteristic (e.g., a first color, a first shading, a first border, etc.) for an icon for display at the display device220. The icon having the first characteristic indicates that the position information of the corresponding aircraft has been verified. If the position does not correspond to the flight path (or if the identifier indicated by the ADS-B message does not match an identifier specified by any of the entries in the tamper-resistant distributed public ledger110), the processor202selects a second characteristic (e.g., a second color, a second shading, a second border, etc.) for the icon for display at the display device220. The icon having the second characteristic indicates that the position information of the corresponding aircraft has failed verification.

To illustrate, in a first example, the receiver204receives the ADS-B message120from the second aircraft104. The processor202accesses the tamper-resistant distributed public ledger110to determine whether the identifier122matches an identifier specified by flight plan data stored in the tamper-resistant distributed public ledger110. The processor202compares the identifier122to the first flight plan data112, the second flight plan data114, and the third flight plan data116to determine whether the identifier122matches an identifier specified by any of the flight plan data112-116. In this example, the identifier122matches an identifier specified by the second flight plan data114(e.g., flight plan data corresponding to the second aircraft104). Conditioned upon a determination that the identifier122matches the identifier specified by the second flight plan data114, the processor202compares the position124to a flight path specified by the second flight plan data114. In this example, the position124corresponds to the flight path. Thus, the processor202selects a first characteristic (e.g., a first color, a first shading, a first border, etc.) for displaying a first icon222the corresponds to the second aircraft104. The display device220displays the first icon222at a location on the display device that corresponds to the position124. Using the first characteristic to display the first icon222indicates to a pilot that the position information corresponding to the first icon222is verified.

In a second example, the receiver204receives the ADS-B message130from the other source106. The processor202accesses the tamper-resistant distributed public ledger110to determine whether the identifier132matches an identifier specified by flight plan data stored in the tamper-resistant distributed public ledger110. The processor202compares the identifier132to the first flight plan data112, the second flight plan data114, and the third flight plan data116to determine whether the identifier132matches an identifier specified by any of the flight plan data112-116. In this example, the identifier132matches an identifier specified by the third flight plan data116(e.g., flight plan data corresponding to the third aircraft). Conditioned upon a determination that the identifier132matches the identifier specified by the third flight plan data116, the processor202compares the position124to a flight path specified by the third flight plan data116. In this example, the position134does not correspond to the flight path. Thus, the processor202selects a second characteristic (e.g., a second color, a second shading, a second border, etc.) for displaying a second icon224that corresponds to the third aircraft. The display device220displays the second icon224at a location on the display device that corresponds to the position134. Using the second characteristic to display the second icon224indicates to a pilot that the position information corresponding to the second icon224failed verification.

In some implementations, the position verification system200can perform additional operations to attempt to verify the position134of the ADS-B message130. For example, the transmitter206is configured to, conditioned on a determination that the position134fails to correspond to the flight path of that flight plan data associated with the identifier132is not stored in the tamper-resistant distributed public ledger110, transmit the first message140to the flight management system108ofFIG.1to confirm the position of the third aircraft. The first message140includes the identifier132and the position134, as well as any other information from the ADS-B message130. As described with reference toFIG.1, the flight management system108can have more up-to-date information than the tamper-resistant distributed public ledger110or the flight management system108can attempt to directly communicate with the third aircraft. Responsive to transmitting the first message140, the receiver204receives the second message142from the flight management system108. The second message142either confirms that the position134is correct or indicates that the position134failed verification.

Based on the second message142, the processor202modifies the second icon224. For example, if the second message142indicates that the position134is correct, the processor202modifies the second icon224to have the first characteristic (e.g., the first color, the first shading, the first border, etc.) instead of the second characteristic. Alternatively, if the second message142indicates that the position134fails verification, the second icon224is removed from the display device220. In other implementations, the second icon224remains with the second characteristic or is modified to have a third characteristic.

The position verification system200thus enables display of icons corresponding to aircraft such that the icons have different characteristics (e.g., colors, shadings, borders, etc.) based on whether position information corresponding to the aircraft has been verified. A pilot or air traffic controller can quickly and easily ascertain, from the icons, which aircraft have been verified and which aircraft could be the result of malicious messages. Thus, the pilot or aircraft controller can maintain appropriate awareness of the airspace.

FIG.3illustrates generation of icons on a display device based on information retrieved from a tamper-resistant distributed public ledger and ADS-B messages. In the example ofFIG.3, the tamper-resistant distributed public ledger110includes flight plan information entries, including a first flight plan information entry302, a second flight plan information entry304, and a third flight plan information entry306. The flight plan information entries302-306correspond to the information specified by the flight plan data112-116ofFIGS.1-2.

In the example ofFIG.3, each flight plan information entry includes an identifier, a point of arrival (POA), a point of departure (POD), a flight path, a cruising altitude, an arrival time, a departure time, and a hash value. In other implementations, one or more of these elements are optional or additional information is included. Each flight plan information entry corresponds to a different aircraft. For example, the first flight plan information entry302corresponds to a first aircraft with an identifier “ID_1” (e.g., the first aircraft102ofFIG.1), the second flight plan information entry304corresponds to a second aircraft with an identifier (“ID_2”) (e.g., the second aircraft104ofFIG.1), and the third flight plan information entry306corresponds to a third aircraft with a third identifier “ID_3.”

As described with reference toFIG.2, the position verification system200receives the ADS-B message120from the second aircraft104ofFIG.1. The ADS-B message120includes the identifier122(“ID_2”) and the position124(e.g.,30.2672N,97.7431W). The position verification system200analyzes the flight plan information entries302-306to determine if any include the identifier122. Because the second flight plan information entry304includes “ID_2,” the position verification system200compares the position124to the flight path included in the second flight plan information entry304to determine whether the position124corresponds to the flight path. If the position124corresponds to (e.g., is within a threshold distance of a position included in) the flight path, the position verification system200selects a first characteristic (e.g., a first border) for use in displaying the first icon222.

Additionally, the position verification system200receives the ADS-B message130from the other source106ofFIG.1. The ADS-B message130includes the identifier132(“ID_3”) and the position134(e.g.,30.0711N,96.9813W). The position verification system200analyzes the flight plan information entries302-306to determine if any include the identifier132. Because the third flight plan information entry306includes “ID_3,” the position verification system200compares the position134to the flight path included in the third flight plan information entry306to determine whether the position134corresponds to the flight path. If the position134does not correspond to the flight path, the position verification system200selects a second characteristic (e.g., a second border) for use in display the second icon224.

The display device220displays icons corresponding to aircraft in a particular geographic region, such as a region around the position verification system200. In a particular implementation in which the position verification system200is integrated within a first aircraft, the display device220displays an icon310that corresponds to the position of the first aircraft. The display device220also displays the first icon222and the second icon224. The first icon222is displayed at a location on the display device220that corresponds to the position124, and the second icon is displayed at a location on the display device220that corresponds to the position134. As illustrated inFIG.3, the first icon222has a first border (e.g., a straight-line border) and the second icon224has a second border (e.g., a dotted-line border). In other implementations, the first icon222and the second icon224can be distinguished by other characteristics, such as different colors, different shadings, different sizes, different shapes, etc. The border of the first icon222indicates that the position of the corresponding aircraft has been verified, and the border of the second icon224indicates that the position of the corresponding aircraft has failed verification. In some implementations, responsive to a message from the flight management system108(e.g., the second message142), the second icon224can be modified, such as by changing the border if the position information is verified or removing the second icon224if the position information fails to be verified by the flight management system108.

FIG.4illustrates a method400of verifying aircraft position information based on ADS-B messages. In a particular implementation, the method400is performed by the first aircraft102ofFIG.1(or an air traffic control station) or by the position verification system200ofFIG.2(e.g., by the processor202executing the instructions212).

The method400includes receiving an ADS-B message indicating an identifier of an aircraft and indicating a position of the aircraft, at402. For example, the first aircraft102or the processor202receives the ADS-B message120indicating the identifier122and the position124. In a particular implementation, the ADS-B message is not encrypted when received.

The method400includes accessing a tamper-resistant distributed public ledger of authenticated flight plan data to determine whether flight plan data associated with the identifier is stored in the tamper-resistant distributed public ledger, at404. For example, the first aircraft102or the processor202accesses the tamper-resistant distributed public ledger110to determine whether the first flight plan data112, the second flight plan data114, or the third flight plan data116is associated with the identifier122.

The method400includes, conditioned upon a determination that the flight plan data is stored in the tamper-resistant distributed public ledger, comparing the position to a flight path indicated by the flight plan data, at406. For example, the first aircraft102or the processor202, conditioned upon a determination that the identifier122is associated with the second flight plan data114, compares the position124to a flight path indicated by the second flight plan data114.

The method400includes selecting a characteristic of an icon corresponding to the aircraft based on a determination whether the position corresponds to the flight path, at408. For example, the processor202determines a characteristic of the first icon222based on whether the position124corresponds to the flight path. In a particular implementation, the characteristic includes a color, a border, a shading, a size, a shape, another characteristic, or a combination thereof. In a particular implementation, the position corresponds to the flight path based on the position being within a threshold distance of an expected position along the flight path.

The method400further includes displaying, on a display device and based on the characteristic, the icon at a location corresponding to the position, at410. For example, the processor202initiates display of the first icon222via the display device220at a location that corresponds to the position124. The first icon220has the first characteristic selected by the processor202.

In a particular implementation, the method400includes, conditioned upon a determination that the position fails to correspond to the flight path or that the flight plan data is not stored in the tamper-resistant distributed public ledger, transmitting a message to a flight management system to confirm the position of the aircraft. For example, if the position124fails to correspond to the flight path of the corresponding flight plan data, or if there is no flight plan data stored at the tamper-resistant distributed public ledger110that matches the identifier122, the first aircraft (or the transmitter206) transmits the first message140to the flight management system108. In some implementations, the method400further includes, in response to receipt of a message confirming the position of the aircraft, modifying the characteristic of the icon. For example, in response to receipt of the second message142(and the second message142confirming the position134), the processor202modifies the second icon224to have the first characteristic (e.g., a first color, shading, border, shape, size, etc.). In some implementations, the method400further includes, in response to receipt of a message indicating that the aircraft does not exist or that the position is incorrect, removing the icon. For example, in response to receipt of the second message142(and the second message142indicating that verification of the position134failed), the processor202removes the second icon224from the display device220.

In a particular implementation, entries in the tamper-resistant distributed public ledger are not encrypted. Additionally, or alternatively, each entry in the tamper-resistant distributed public ledger includes flight plan data for one or more aircraft during a particular time period. The flight plan data for a particular aircraft specifies a corresponding point of arrival, a corresponding point of departure, a corresponding flight path, a corresponding altitude, or a combination thereof. For example, the first flight plan data112, the second flight plan data114, and the third flight plan data116include flight plan data for aircrafts during a particular time period, such as a POA, a POD, a flight path, an altitude, an arrival time, a departure time, or a combination thereof, as illustrated inFIG.3. Additionally, or alternatively, each entry in the tamper-resistant distributed public ledger110includes a hash value corresponding to a previous entry in the tamper-resistant distributed public ledger, as described with reference toFIG.1.

In a particular implementation, entries in the tamper-resistant distributed public ledger are generated by a flight management system conditioned upon an authentication of corresponding flight plan data by the flight management system. For example, the flight management system108receives flight plan data from other sources, such as airlines, ATC stations, aircraft, etc., and the flight management system108authenticates the flight plan data before adding the authenticated flight plan data to the tamper-resistant distributed public ledger110. In some implementations, the flight management system maintains the tamper-resistant distributed public ledger in accordance with an entry adding scheme, as described with reference toFIG.1.

The method400improves security of ADS-B technology. For example, by verifying whether position data included in an ADS-B message is correct using a tamper-resistant distributed public ledger provides a method for determining if malicious actors provide inaccurate ADS-B messages. Thus, aircraft, ATC stations, or other recipients of ADS-B messages can verify the position data contained therein and ignore malicious ADS-B messages, which improves security of ADS-B technology without requiring encrypting or other techniques that would reduce the transparency of the ADS-B technology.

In some implementations, the method400ofFIG.4is embodied as instructions stored on a computer-readable storage device. In a particular implementation, a computer-readable storage device stores instructions that, when executed by a processor, cause the processor to perform operations including receiving an ADS-B message indicating an identifier of an aircraft and indicating a position of the aircraft. The operations include accessing a tamper-resistant distributed public ledger of authenticated flight plan data to determine whether flight plan data associated with the identifier is stored in the tamper-resistant distributed public ledger. The operations include, conditioned upon a determination that the flight plan data is stored in the tamper-resistant distributed public ledger, comparing the position to a flight path indicated by the flight plan data. The operations include selecting a characteristic of an icon corresponding to the aircraft based on a determination whether the position corresponds to the flight path. The operations further include initiating display, on a display device and based on the characteristic, of the icon at a location corresponding to the position.

Referring toFIGS.5and6, examples of the disclosure are described in the context of an aircraft manufacturing and service method500as illustrated by the flow chart ofFIG.5and an aircraft600as illustrated by the block diagram ofFIG.6.

Referring toFIG.5, a flowchart of an illustrative example of a method associated with a position verification system is shown and designated500. During pre-production, the exemplary method500includes, at502, specification and design of an aircraft, such as the aircraft600described with reference toFIG.6. During the specification and design of the aircraft, the method500includes specifying a processor, a memory, a receiver, a transmitter, a display device, or a combination thereof. In a particular implementation, the processor, the memory, the receiver, the transmitter, and the display device include or correspond to the processor202, the memory210, the receiver204, the transmitter206, and the display device220, respectively, ofFIG.2. At504, the method500includes material procurement. For example, the method500may include procuring materials (such as the processor, the memory, the receiver, the transmitter, the display device, or a combination thereof) for the position verification system.

During production, the method500includes, at506, component and subassembly manufacturing and, at508, system integration of the aircraft. In a particular implementation, the method500includes component and subassembly manufacturing (e.g., producing the processor, the memory, the receiver, the transmitter, the display device, or a combination thereof) of the position verification system and system integration (e.g., coupling the receiver to the processor) of the position verification system. At510, the method500includes certification and delivery of the aircraft and, at512, placing the aircraft in service. In some implementations, certification and delivery includes certifying the position verification system. Placing the aircraft in service can also include placing the position verification system in service. While in service by a customer, the aircraft may be scheduled for routine maintenance and service (which can also include modification, reconfiguration, refurbishment, and so on). At514, the method500includes performing maintenance and service on the aircraft. In a particular implementation, the method500includes performing maintenance and service on the position verification system. For example, maintenance and service of the position verification system includes replacing one or more of the processor, the memory, the receiver, the transmitter, the display device, or a combination thereof.

Each of the processes of the method500are performed or carried out by a system integrator, a third party, and/or an operator (e.g., a customer). For the purposes of this description, a system integrator includes without limitation any number of aircraft manufacturers and major-system subcontractors; a third party includes without limitation any number of venders, subcontractors, and suppliers; and an operator is an airline, leasing company, military entity, service organization, and so on.

Referring toFIG.6, a block diagram of an illustrative implementation of an aircraft that includes components of a position verification system is shown and designated600. In at least one implementation, the aircraft600is produced by at least a portion of the method500ofFIG.5. As shown inFIG.6, the aircraft600includes an airframe618with a plurality of systems620and an interior622. Examples of the plurality of systems620include one or more of a propulsion system624, an electrical system626, an environmental system628, and a hydraulic system630.

The aircraft600also includes a position verification system634. The position verification system634includes the processor202, the receiver204, the transmitter206, the memory210, and the display device220, as described with reference toFIG.2. The processor202is configured to verify positions of aircraft based on ADS-B messages and accessing a tamper-resistant distributed public ledger, as described with reference toFIGS.1and2.

Any number of other systems may be included in the aircraft600. Although an aerospace example is shown, the present disclosure can be applied to other industries. For example, the position verification system634can be used onboard a manned or unmanned vehicle (such as a satellite, a spacecraft, a watercraft, or a land-based vehicle), or in a building or other structure.

Apparatus and methods included herein can be employed during any one or more of the stages of the method500ofFIG.5. For example, components or subassemblies corresponding to production process508can be fabricated or manufactured in a manner similar to components or subassemblies produced while the aircraft600is in service, at512for example and without limitation. Also, one or more apparatus implementations, method implementations, or a combination thereof can be utilized during the production stages (e.g., stages502-510of the method500), for example, by substantially expediting assembly of or reducing the cost of the aircraft600. Similarly, one or more of apparatus implementations, method implementations, or a combination thereof can be utilized while the aircraft600is in service, at for example and without limitation, to maintenance and service, at514.

Although one or more ofFIGS.1-6may illustrate systems, apparatuses, and/or methods according to the teachings of the disclosure, the disclosure is not limited to these illustrated systems, apparatuses, and/or methods. One or more functions or components of any ofFIGS.1-6as illustrated or described herein may be combined with one or more other portions of another ofFIGS.1-6. For example, one or more elements of the method400ofFIG.4may be performed in combination with one or more other elements of the method400ofFIG.4or with other operations described herein. Accordingly, no single implementation described herein should be construed as limiting and implementations of the disclosure may be suitably combined without departing form the teachings of the disclosure. As an example, one or more operations described with reference toFIG.4may be optional, may be performed at least partially concurrently, and/or may be performed in a different order than shown or described.

The illustrations of the examples described herein are intended to provide a general understanding of the structure of the various implementations. The illustrations are not intended to serve as a complete description of all of the elements and features of apparatus and systems that utilize the structures or methods described herein. Many other implementations may be apparent to those of skill in the art upon reviewing the disclosure. Other implementations may be utilized and derived from the disclosure, such that structural and logical substitutions and changes may be made without departing from the scope of the disclosure. For example, method operations may be performed in a different order than shown in the figures or one or more method operations may be omitted. Accordingly, the disclosure and the figures are to be regarded as illustrative rather than restrictive.