# Controller-Pilot Data Link Communication Security
## 4 Threat Model
### Requirements for a Secure Communication System  
To provide the full protection against all possible attacks, the following general requirements for a secure communication system need to be fulfilled:  
1. **Authentication**. According to [14], CPDLC has a very transparent authentication process. Attackers with malicious intent may easily fool it and a simple undetected mistake can lead an incorrect logon being processed, as it was described in [19]. In its current state, not the pilot but the aircraft computer authenticates a connection with the ATSU. The procedure may be changed so that every active pilot in the aircraft makes a personal authentication, thereby removing the dependency between authentication and the flight plan. A personalized authentication system will adjust to the pilots operating different aircraft at various times. Such a dynamic setup as in case of personalized pilot authentication might result in a complicated key management system.
2. **Confidentiality** of the CPDLC is not covered at all, as everything is sent in simple plain text without any encryption enforced. With the recent technological advancements enabling active attackers to perform intrusions into the system, it becomes possible to receive and decode the messages' content and access the sensitive information, which can lead to a privacy breach for the participating parties.
3. **Integrity** is not guaranteed by the system either. Today's use of the forward error correction protocol, a lightweight version of the Reed-Solomon code, is only meant to correct apparent errors upon receipt of the information being sent. Any information tampering through a man-in-the-middle attack might go through the system as a valid message. It is up to the human recipient of the information to question its validity, which is unlikely to occur if the information does not conflict with the original intentions of the aircraft/ATC. Integrity combined with authentication is a robust foundation to aim for when securing the data link communication. It should be able to assure that a message received is valid and trustworthy.
4. **Non-repudiation**. Traditionally, asymmetric key cryptography has been used to provide non-repudiation. A digital signature assures that the public key used for message encryption is associated with the secret key used to decrypt the information by a trustworthy party. It does not cover the cases where a secret key would be compromised.
5. **Availability**. The system currently lacks any means to protect itself against an attack aimed at disrupting its availability. The consequences of an attack may vary depending on whether a single aircraft is denied services or the ground station is targeted. An attack will also be restricted to a specific geographical area as long as the attacker lacks physical access to the whole aeronautical telecommunication network.  
The response times of the system experiencing issues with its availability often increase above normal limits, which may lead to timeouts or complete denial of service. In this case, thoroughly developed backup procedures need to be specified in order to guarantee the robustness of the communication system and help to recover the affected network in a timely manner.