Multiple Security Domain Nondeducibility Air Traffic Surveillance Systems

Traditional security models partition the security universe into two distinct and completely separate worlds: high and low level. This partition is absolute and complete. More complex situations, such as those that arise in cyber-physical systems (CPS) are better treated as sets of increasingly more secure domains. In a CPS, security partitions often overlap and the high-low distinction does not hold well. This paper utilizes Multiple Security Domain Nondeducibility (MSDND) as a model to determine information flow among multiple partitions, such as those that occur in a CPS. MSDND is applied to selected aspects of Automatic Dependent Surveillance-Broadcast (ADS-B) air traffic surveillance system under various physical and cyber security vulnerabilities to determine when the actual operational state can, and cannot be, deduced. It is also used to determine what additional information inputs and flight physics are needed to determine the actual operational state. Several failure scenarios violating the integrity of the system are considered with mitigation using invariants.