A Taxonomy Framework for Maritime Cybersecurity: A Demonstration Using the Automatic Identification System

Abstract

The maritime transportation system is increasingly a target of cyber attacks. This paper describes a taxonomy that supports the creation of adversarial cyber models, risk mitigation, and resiliency plans as applied to the maritime industry, using the Automatic Identification System as a specific illustration of the approach. This method has already been applied to the aviation sector; retooling it for a maritime example demonstrates its broad applicability to the transportation sector, in general.

Keywords: Automatic Identification System (AIS), Taxonomy, Taxonomy Framework, Cyber Attack, Maritime Transportation System, Risk Mitigation, Cyber Security, Maritime Cyber Security.

1. Introduction

Cybersecurity vulnerabilities, exploits, and threats are on the rise across all critical infrastructure sectors, particularly transportation. In previous work, the authors proposed a graph-based, communications-oriented framework and taxonomy with which to create adversarial models, risk mitigation, and resiliency plans for the aviation sector (Haass, Craiger, & Kessler, 2018). We propose to apply this framework and taxonomy to maritime systems in order to demonstrate the general applicability of the methodology.

There are many analogues between the aviation and maritime transportation sectors; whereas aviation has airport operations, air traffic control, airline operations, aircraft operations, and unmanned aircraft systems, maritime has port operations, vessel traffic services (VTS), shipping line operations, vessel operations, and unmanned maritime systems, respectively. Both sectors have manufacturing, cargo and passenger transport, and handoffs of passengers and cargo to other modes of transportation. Both have a broad variety of users, including commercial, military, individual, corporate, and public sector craft. And both are subject to attack by a variety of cyber actors, ranging from criminals and hacktivists, to spies, terrorists, and information warriors.

Numerous maritime-specific communications systems are used for navigation, ship-to-ship and ship-to-shore information exchange, vessel management and control, cargo scheduling and management, passenger entertainment, and safety. Most of these systems were created without cybersecurity in mind and well before the widespread cyberattacks that are now so common on the Internet. From maritime automated navigation systems and the Automatic Identification System (AIS) to Global Navigation Satellite Systems (GNSS) and the Long-Range Identification and Tracking (LRIT) network, it is clear that it is important to design, deploy, and maintain critical maritime systems with appropriate adversarial models, risk frameworks, and resiliency plans (Kessler, 2019).

Using a general system-of-systems approach outlined in a review paper by Haass, Sampigethaya, and Capezzuto (2016) and an aviation-specific application of the approach described by Haass et al. (2018), this paper provides a framework for addressing maritime cybersecurity challenges in a systematic fashion, rather than on an isolated and ad hoc system-by-system or protocol-by-protocol basis (Mansouri, Gorod, Wakeman, & Sauser, 2009). Where possible, a system will be isolated and reflected in the decision tree taxonomy. Dependencies and shared assumptions can be expressed with a language useful for the many constituents within the maritime environment. Through the application of this framework, many cybersecurity issues can be addressed, including communication challenges that will be particularly important as unmanned and autonomous systems are incorporated into the shared maritime space (MarEx, 2018; Ridden, 2018).

2. The Maritime System

The importance of the maritime transportation system (MTS) to the global and national economy cannot be over-stated. Globally, roughly 94,000 ships, with an asset value of nearly $1.5 trillion, transport more than $19 trillion of cargo each year, with an annual trade value increase of about 3% (Barki & Dèlèze-Black, 2017). In the U.S. alone, 53% of imports and 38% of exports are by ship, and maritime represents the largest import/export transportation modality. Furthermore, maritime cargo contributes at least $649 billion annually to the U.S. gross domestic product and supports more than 13 million jobs. The U.S. MTS also includes 25,000 miles of navigable channels, more than 360 ports, at least 3700 marine terminals, and more than 12 million recreational boats (DOT, n.d.).

The global maritime system — including all civilian, commercial, and military ship traffic — is actually a system of systems. Each system can be described as a set of components and the communication pathways between those components. Of course, one system can also be seen as having dependencies upon other systems as all of the systems intercommunicate (Figure 1). There are many communications systems used within the MTS including all of the data networking at ports, on board ships, within a shipping line, between supply chain partners, and more. Communications within and between systems are dependent upon protocols whose behavior will be dictated by the specific system. Vulnerability analysis requires recognition of the uniqueness of each system and application, and needs to include the examination of all types of disruption ranging from weather to hostile actions; this is known as the all-hazards approach. This categorization distinguishes between vulnerabilities that impact only cyber systems (e.g., data, information, and communication) from those that include cyber-physical threats (e.g., control, navigation, or other systems) (Roberts, 2015; Serpanos, 2018). Indeed, this categorization also allows us to distinguish between vulnerabilities that we can control or mitigate (e.g., attacks by people) and those that we cannot control (e.g., nature, weather, stochastic failure).

An individual ship is itself a complex cyber-physical network node with a large variety of communication systems for crew, passengers, external sources, and internal operations, including: Bridge Navigation Systems (e.g., GPS, Electronic Chart Display and Information System [ECDIS], AIS, LRIT); External Communication Systems (e.g., satellite communications, FleetBroadband, Internet); Mechanical Systems (e.g., main engine, auxiliary engine, steering control, ballast management); Ship Monitoring and Security Systems (e.g., closed-circuit television, Ship Security Alert System [SSAS], access control systems, sensors); Cargo Handling Systems (e.g., valve remote control systems, level/pressure monitoring systems); and other specialized networks (e.g., Combat Command & Control Systems on warships, Entertainment Systems and Point-Of-Sale terminals on passenger vessels, Vessel Management Systems on commercial fishing vessels). Ship electronics, sensors, and actuators are all integrated within the communication systems listed above. Internet-of-Things (IoT) devices will become increasingly ubiquitous as smart ships and smart ports evolve. The huge amount of information gathered by Vessel Data Recorders (VDR) demonstrate the complexity and number of critical components that a cybersecurity taxonomy must address when considering event logging or cybersecurity incidents.

The proposed framework supports the assignment of types of vulnerabilities, attacks, and exploits with their potential disruptive effects, ranging from critical (e.g., vessel stability and safety) to minor (e.g., reduction in entertainment or service quality). Cyber components include the core software, computing, and network infrastructure of the ship itself, together with additional shipping line-specific software systems. Additionally, GPS, ECDIS, AIS, and other systems include real-time updates while underway, and can include different nodes as the vessel crosses global boundaries. An adversary can be thought of as another part — albeit a malicious one — of the system of systems. An actor is malicious if they attempt to modify, subvert, or in any other way cause the cyber or cyber-physical system to behave beyond the limits of its intended operation. For purposes of the remainder of this paper, we will explore AIS in some detail as an example of the application of this analysis.

3. AIS Background

The Automatic Identification System is a tracking system that allows a vessel to view local marine traffic (i.e., within 10–20 nautical miles) and to be seen by other nearby ships or AIS equipment installations. AIS was originally designed so that a ship fitted with an appropriate chartplotter could view the local traffic and quickly determine any given ship's name, unique International Maritime Organization (IMO) registration number, size (i.e., length, beam, draft, and gross tonnage), position (latitude and longitude), course, bearing, destination, status (e.g., anchored, docked, underway under power, etc.), and other information (Figure 2). More recently, many Web sites collect and aggregate AIS information and have created a database so that anyone can look up information about any AIS-equipped vessel in near-real-time (Figure 3). AIS was introduced in the 2002 International Convention for the Safety of Life at Sea (SOLAS). Chapter V of the SOLAS agreement, titled "Safety of Navigation," mandates that ships of a certain size and/or function carry AIS transceivers as an additional safety measure (IMO, 2002). Ships in U.S. waters generally fall under U.S. Coast Guard (USCG) regulations; 33 CFR 164.46 defines AIS requirements, which include all vessels of 1600 or more gross tons, commercial power vessels 65 or more feet (19.8 meters) in length, and a power vessel certified to carry more than 150 passengers; warships are exempted from AIS requirements although all modern warships carry AIS (USCG, 2018).

A key component of AIS is the use of precise positioning technology. AIS does not specify — nor does it depend upon — which GNSS is employed; AIS merely broadcasts a position using a feed from the ship's navigation and positioning system. That said, any cybersecurity vulnerabilities in the vessel's GNSS will affect the precision of the AIS transmissions regarding location. GNSS vulnerabilities, particularly those related to GPS, are integral to AIS vulnerabilities but will not be specifically addressed in this paper (except as they affect AIS) (Czaplewski & Goward, 2016).

AIS communications protocols are described in International Telecommunication Union Radiocommunication sector (ITU-R) Recommendations M.585-7 and M.1371-5 (ITU, 2014, 2015). AIS employs a shared radio-communication channel using a form of time-division multiple access (TDMA). Time on the radio channel is divided into 2,250 slots per minute so that each slot has a duration of 26.67 milliseconds. The protocol defines how AIS stations stay in synchronization so that they do not overlap their transmissions and advertise when they will be transmitting next. New AIS stations, such as those on a ship coming within radio range close to other ships, can also be added to the lineup of transmitters on the channel (Wikipedia, 2018).

SOLAS-compliant Class A AIS transponders employ a Self-Organizing TDMA (SOTDMA) broadcast mode, transmitting information every 2 to 10 seconds while underway (depending on the ship's speed and whether it is maneuvering) and every three minutes while at anchor; these transponders can also transmit and receive safety-related text messages. Less expensive Class B AIS transponders employ a Carrier-Sense TDMA (CSTDMA) broadcast mode, transmitting dynamic information (e.g., position, course, and speed) every 30–180 seconds, static data (e.g., vessel name and IMO number) every six minutes, and, optionally, safety-related text messages (Shine Micro, n.d.; Wikipedia, 2018). AIS messages are formatted according to the National Marine Electronics Association (NMEA) 0183 serial communications protocol standard and are referred to as sentences. The two common AIS sentences are !AIVDM (data received from other vessels) and !AIVDO (the vessel's transmitted information). There are just over two dozen AIS message types. At a data rate of 9600 bits/sec, messages are limited to 256 bits of information per time slot. AIS employs maritime very high frequency (VHF) channels 87B (161.975 MHz) and 88B (162.025 MHz) (Raymond, 2016; Wikipedia, 2018).

4. Security Concerns

AIS improves vessel traffic management and safety through increased situational awareness. AIS messages, however, are transmitted in plaintext, which introduces a potential security risk since these unencrypted AIS messages can be read by anyone with a receiver. Add to this the Web sites with instructions for building AIS receivers using inexpensive hardware and open source software, and it is clear that AIS is vulnerable to a variety of exploits.

Attacks on AIS, and information in general, can affect the information's confidentiality, integrity, and availability (the so-called CIA Triad) as well as three other characteristics, namely, possession, authenticity, and utility; these six together are sometimes called the Parkerian Hexad (Parker, 2015):

• Confidentiality refers to protecting information from unauthorized access or disclosure.
• Integrity refers to the state of information being free from inadvertent or deliberate manipulation.
• Availability refers to the users' ability to access information when needed.
• Possession (or control) refers to the loss of data by the authorized user (even if the "thief" cannot access the data).
• Authenticity (aka authentication) refers to being able to prove the identity of the sender of information.
• Utility refers to the usefulness of the data to the user (e.g., possessing encrypted data without a decryption key or receiving a message to do something after the date when the action is required are examples of low utility).

Plaintext messages have long been a security vulnerability in the storage of data on computers and transmission of data on networks. Various types of protections have been implemented in order to protect information and information systems from attacks on all elements of the Parkerian hexad. Cryptography plays a particularly key role in protecting the confidentiality, integrity, and authenticity of information. In its most simple form, the process of creating encrypted ciphertext requires the original unencrypted plaintext message, an encryption algorithm, and a key (or, sometimes, two keys). Secret key cryptographic protocols protect data confidentiality because ciphertext is unreadable as long as the key required to decrypt the message remains secret. One-way cryptographic hashes are used to verify the integrity of a message, using a mathematical algorithm that provides a digital fingerprint of the message; changing even one bit in a message will cause the hash value to change, indicating that the content of the message has changed. Message authentication codes (MAC) use a shared secret key and can be used to verify the integrity of a message, as well as providing authentication, verifying the identity of the message sender. Authentication can also be provided using public key cryptographic methods (Kessler, 2018).

The AIS protocols provide no internal mechanism for message integrity and encryption. While some AIS products have the ability to transmit and receive using an encryption mode, the methods are proprietary and are designed to allow a "fleet" of ships to see each other but not be seen outside of the encrypted group. Indeed, the U.S. Coast Guard has described Encrypted AIS (EAIS) for military and law enforcement purposes, although products implementing that specification are not generally available to civilian classes of vessels (USCG, 2014).

AIS was designed to assist vessels in situational awareness by providing them knowledge of maritime traffic beyond their ability to visualize it and beyond the capability of traditional radar. By the nature of AIS broadcasts, then, a lot of information can be received by anyone who just wants to know what is going on in their proximity, which might include individuals with nefarious intent such as pirates, terrorists, or other criminal actors. But this level of information leakage is nothing compared to aggregation sites that broadcast on the Web the location of thousands of ships around the globe, such as FindShip, MarineTraffic, VesselFinder, Vesseltracker, and many more. The IMO Maritime Safety Committee warned about the dangers of this information leakage as far back as 2004, noting that "the publication on the world-wide web... of AIS data transmitted by ships could be detrimental to the safety and security of ships and port facilities and was undermining the efforts of the Organization and its Member States to enhance the safety of navigation and security in the international maritime transport sector" (IMO, 2018, para. 1).

5. Threat Assessments

There are a variety of approaches to examining the security threat landscape in any system. We will examine several here and apply them to AIS. Figure 4 provides a graphical overview of AIS components, communication pathways, and threat vectors. In this description, each component — including bad actors — is shown along with communication links composed of valid messages, software-based threats, and radio frequency-based threats. This is a similar approach taken by graph theory, by identifying the communicating elements and the communication links (Boukhtouta, Mouheb, Debbabi, Alfandi, Iqbal, & El Barachi, 2015).

As mentioned earlier in the paper, there are lessons that the various transportation sectors can learn from each other in terms of cybersecurity. A great deal of work has gone into studying security vulnerabilities of Automatic Dependent Surveillance-Broadcast (ADS-B), a system for providing aircraft in flight with the same situational awareness as AIS provides ships at sea. It has been instructive to see how some of the ADS-B security literature applies to the maritime domain. Based upon a threat assessment model for ADS-B described by Gauthier and Seker (2018), we can identify three primary types of intentional, human-initiated cyberattacks on AIS:

• Disruption of GPS signals (any references to GPS also apply to any GNSS).
• Jamming of the wireless communications.
• Manipulation of AIS transmissions — further subdivided into: message injection (spoofing); message deletion (denial-of-service); message modification (alteration of message contents, i.e., data diddling).

This perspective is very much in line with the system of systems approach; each of the three main categories actually represents a different system that must be secured in order to secure AIS; namely, GNSS or other positioning systems, radiocommunication propagation paths, and AIS transceivers. Strohmeier et al. (2015) identified five primary threat categories to ADS-B that can also apply to AIS; the first is a passive attack and the remaining are active attacks:

• Eavesdropping: a simple, passive attack easily accomplished since AIS is, by definition, a broadcast radio system, and messages are generally transmitted unencrypted.
• Jamming: can occur at both the ground station level or at the vessel level, via radio signal jamming or a denial-of-service attack making AIS transmission slots unavailable.
• Message injection: inserting spurious messages into the vessel traffic communication system, possible because AIS messages are unencrypted and unauthenticated.
• Message deletion: through destructive or constructive interference, the latter by producing many bit errors so the receiver drops the message due to data corruption.
• Message modification: altering a message's bit stream, generally by bit-flipping or overshadowing (using a high-power source to overwrite part of, or an entire, target message).

Combining attack descriptions from a variety of sources (including Balduzzi et al., 2014; Gauthier & Seker, 2018; Purton, Abbass, & Alam, 2010; and Strohmeier, Lenders, & Martinovic, 2015), we can identify the following cyber threats to AIS: (1) GPS signal jamming, (2) GPS device failure or poor quality transmissions, (3) AIS device powered down, (4) AIS device malfunction, (5) AIS programming error, (6) AIS radio channel jamming, (7) AIS radio transmission bit errors, (8) AIS vessel spoofing, (9) AIS traffic eavesdropping, (10) AIS system flooding, (11) ghost vessel, (12) Closest Point-of-Approach / AIS Search-and-Rescue Transponder (CPA/AIS-SART) spoofing, (13) vessel disappearance, (14) Aids-to-Navigation (AtoN) spoofing, (15) data diddling, (16) weather forecast spoofing.

Table 1 summarizes these cyber threats to AIS and classifies them according to the Parkerian Hexad vulnerability, and using the systems approach and categories described above. Table 1 suggests that while the Parkerian Hexad provides a useful way to generally categorize the impact of vulnerabilities, it is not useful in describing specific threat vectors and vulnerabilities in given cyber systems. This said, this table does seem to suggest that there are more threats to integrity and authenticity than to availability, which is not surprising given the lack of integrity and authentication checks in AIS. We also see that models that focus only on human-initiated attacks are not sufficient to describe the suite of threats to information within a given system. Table 1 also suggests that while the "systems of systems" method is an inviting approach to understanding the vulnerabilities in the system in question — here, AIS — it does not necessarily help in the defense of that system. In particular, an AIS device vendor or software designer must be aware of AIS dependencies on GPS and radio frequency (RF) vulnerabilities but, in fact, cannot do anything to control them. As an example, AIS will fail if someone turns off the GPS receiver yet no AIS protections can defend against that eventuality. Indeed, if we were to analyze every GPS and radio transmission vulnerability in order to understand AIS, we would have to consider additional systems' vulnerabilities as they might impact GPS and radio. Ultimately, someone designing AIS equipment has to be aware of the dependency on GPS, for example, and may even put in some mechanisms to test the integrity of the GPS feed, but cannot protect AIS from all of the problems that GPS might have.

6. Risk Assessment and Management

The threats identified above include intentional attacks from human bad actors as well as errors due to natural causes. In order to prepare appropriate risk management plans, a proper risk assessment must be performed. Common risk management analysis for information systems includes accounting for natural threats or hazards (e.g., hurricanes, floods, and blizzards) as well as equipment failure. This all-hazards approach speaks to the fact that a natural disaster is as devastating as a deliberate attack but, from the perspective of initial response, all that matters is the immediate impact of an event rather than the actual attack vector. Identifying vulnerabilities is only the first step in building a cyber defense and understanding the true potential impact of these vulnerabilities. Not all vulnerabilities are equally exploitable or likely; therefore, a risk assessment must be conducted on each vulnerability so that one can determine how to manage these risks. Unless clear quantitative measures are available, a qualitative approach is commonly employed to describe such characteristics as a vulnerability's likelihood of exploit, severity should the exploit be realized, ease of attack, and whether it is a human-initiated attack (including human error) or a natural hazard (Table 2). Note that these categorizations are relative to the AIS system rather than the vessel itself; i.e., a vulnerability that is critical to AIS is bad news for the ship but, by itself, not critical to its operation.

There are a number of conclusions that can be drawn from Table 2. First, while there are more potential intentional threats than natural hazards, they tend to have about the same likelihood (hazards: mean 3.67, std 1.15; intentional threats: mean 3.77, std 1.01). Second, the most vulnerable attack vectors on AIS are those where data can be inserted into the system; many of these attacks can be realized in software-generated transmissions rather than by attacking the radio frequencies themselves. Third, the most severe attack on AIS is when the AIS receiver is off; at that point, a vessel is driving blind with respect to AIS information. Fourth, the most significant vulnerabilities in AIS affect individual AIS messages rather than the entire AIS system itself. Finally, most of the intentional threats result directly from the fact that AIS messages are neither encrypted nor authenticated, coupled with the lack of integrity checking and bit-error correction mechanisms.

Finally, ease of attack is, in some sense, the most difficult to quantify because the feasibility of an attack often depends upon the adversary. An attack that is beyond the means of a "pedestrian" hacker might be well within the cyberattack toolkit of a nation-state. In any case, this table seems to suggest that none of the identified vulnerabilities in AIS are "very difficult" to exploit.

7. Future Research

Understanding the vulnerabilities of AIS provides a number of ideas about where to shore up the system. There are a variety of directions that might lead to added security in AIS; some of these ideas are borrowed from the aviation industry:

• Some form of physical (radio transmission) layer authentication. This methodology varies in its difficulty, cost, and scalability, and would require additional AIS software and/or hardware, but would not change the AIS protocol itself (Strohmeier et al., 2015).
• Use of Kalman filtering or other techniques to track relative signal strength of individual ship transmissions in order to detect possible spoofing of that ship by an attacker. The cost and difficulty for such an approach would be low although scalability might be difficult. As above, no new AIS messages would be required (Strohmeier et al., 2015).
• Encrypted AIS (EAIS) has already been proposed (USCG, 2014) and some variants are in limited use for special-purpose fleets. EAIS, however, has limited utility for any vessel outside of the "trusted" group. Using some form of lightweight public-key infrastructure (PKI) for AIS communication security, not terribly unlike the use of certificates in the Secure Sockets Layer (SSL) already in widespread use on the Web, could prevent certain types of attacks, such as man-in-the-middle spoofing. The downside to this approach is the high degree-of-difficulty to design and implement, and likely high cost to deploy widely (Strohmeier et al., 2015).
• Predictive AIS: an AIS position message contains a ship's latitude, longitude, course (bearing), rate and direction of turn, and speed. The rate at which these messages are transmitted is based upon the vessel's speed and whether it is maneuvering; in any case, a ship will change position by no more than about 230 feet (69 meters) between sequential reports. It should be relatively simple, therefore, for a receiver to predict the sender's approximate location at the next transmission. Predictive AIS has been described by a number of sources as a way to use historic AIS information to predict the path of other vessels (Hexeberg, Flåten, Eriksen, & Brekke, 2017; Last, Bahlke, Hering-Bertram, & Linsen, 2014; Mazzarella, Arguedas, & Vespe, 2015), and these methods are already used for research and practice for additional collision avoidance techniques and better understanding of traffic patterns. But if a station stores the position at just the last transmission, it can predict a range where the sender should be at the next transmission. If the next announced position, or any of the associated message parameters, vary greatly from the prediction, that could indicate an integrity problem. This type of capability would require additional software, but would be relatively simple and inexpensive to deploy, and could be a simple add-on to existing equipment without requiring any change to the AIS protocol.

Understanding AIS vulnerabilities is the first step toward hardening it; the directions above show solutions ranging from simple, inexpensive software add-ons to structural improvements such as encryption and public-key infrastructures that require broad international investment and coordination.

8. Conclusions

We have all become more and more dependent upon technology. Many younger mariners do not recall a day at sea without radar, GPS, AIS, ECDIS, and the other myriad data, communication, and navigation systems aboard today's large ships. Indeed, the U.S. Navy stopped teaching celestial navigation in 1996 due to the prevalence of GPS; they brought it back 20 years later most likely due to the susceptibility of cyber threats against GPS (Hrala, 2016). Hardware engineers, software developers, protocol designers, and researchers must maintain awareness of the potential cyber threats and vulnerabilities in all systems that they build and this security awareness must be built-in from the beginning of a project. The framework and taxonomy proposed here are small steps that demonstrate that these methods can be employed throughout the transportation sector and, presumably, applied to other critical infrastructures.

The model described here focuses on identifying vulnerabilities in our systems rather than identifying threat actors. A well-known cybersecurity maxim states, "If you know the vulnerabilities (weaknesses), you've got a shot at understanding the threats (the probability that the weaknesses will be exploited, how, and by whom)... But if you focus only on the threats, you're likely to be in trouble" (Johnston, 2018, p. 10). The object lesson is that if you concentrate on who is trying to attack you, you will mostly likely get it wrong because it is hard to correctly predict threats and, in any case, as suggested above, threats are beyond your control. Vulnerabilities, on the other hand, are easier to identify, particularly if you think like an attacker.

In terms of the improved situational awareness promised by AIS, it is important to realize that while loss of AIS decreases safety in the immediate area, there are many other mechanisms to compensate for its loss, such as radar, radio, increased human lookouts, etc. AIS, then, is an important part of vessel safety but its absence does not cause safety at sea to fall apart. The potential devastating impact of AIS vulnerabilities would come about if attackers relentlessly exploited the lack of integrity and authentication checking, and bombarded the system with enough bogus messages so as to threaten the very veracity of the system. Indeed, in this latter case, AIS could be viewed as doing more harm than good, and if only a tiny fraction of AIS messages are fake, users will lose confidence in the entire system.

References

Full reference list (33 sources) available in the original PDF.