Towards a Cyber-Physical Range for the Integrated Navigation System (INS)

Abstract

The e-navigation concept was introduced by the IMO to enhance berth-to-berth navigation towards enhancing environmental protection, and safety and security at sea by leveraging technological advancements. Even though a number of e-navigation testbeds including some recognized by the IALA exist, they pertain to parts only of the Integrated Navigation System (INS) concept. Moreover, existing e-navigation and bridge testbeds do not have a cybersecurity testing functionality, therefore they cannot be used for assessing the cybersecurity posture of the INS. With cybersecurity concerns on the rise in the maritime domain, it is important to provide such capability. In this paper we review existing bridge testbeds, IMO regulations, and international standards, to first define a reference architecture for the INS and then to develop design specifications for an INS Cyber-Physical Range, i.e., an INS testbed with cybersecurity testing functionality.

1. Introduction

Marine accidents still occur in spite of technological advancements and issued regulations. Indeed, 54% of a total of 1801 marine accidents that occurred between 2014 and 2019 were caused by human error, while 28% were caused by system or equipment failure [1]. As modern vessels rely on information for safe navigation [2], the International Maritime Organization (IMO) introduced the concept of "e-navigation" to provide digital information and infrastructure for enhancing safety, security, and efficiency in the maritime domain [3]. According to the IMO, e-navigation is a "harmonized collection, integration, exchange, presentation and analysis of marine information on board and ashore by electronic means to enhance berth-to-berth navigation and related services for safety and security at sea and protection of the marine environment" [3].

An important element of e-navigation is the Integrated Navigation System (INS), defined as "A system in which the information from two or more navigation aids is combined in a symbiotic manner to provide an output that is superior to any one of the component aids" [4]. The INS combines information received from various devices onboard to improve navigation safety by assisting the Officer of the Watch (OOW) in planning and monitoring the navigation of a ship [5]. The data are provided to the operator in real time and accurately. Moreover, the INS alerts the operator instantly about dangerous situations, or equipment failures [5]. The INS enhances the situational awareness of the operator on the bridge, comprising six navigational tasks: route monitoring, route planning, collision avoidance, navigation control data, navigational status and data display, and alert management.

Even though the purpose and the functions performed by the INS are defined, a generic list of the devices that constitute an INS does not exist. This is largely because several parameters, such as the vessel's gross tonnage, vessel type, navigation zone, and ship construction date, directly affect the equipment to be fitted onboard. The testing of developed technologies on real ship bridges causes high costs and safety risks; this is why the development process may be divided into different stages [8]. Simulators can be used in the early development stages. However, not all aspects of a developed technology can be captured by a simulator, therefore porting such technologies to real vessels may still create problems [8], which can be avoided by the use of a testbed instead.

The INS, similarly to other marine systems on board and ashore, suffers from a number of cybersecurity vulnerabilities [10–12]. Further, several products have been developed to mitigate cyber threats against vessels [13,14]. Given that such developing technologies might inherently entail cyber risks, they must be verified in a safe environment before being installed in the network of a ship. Thus, in addition to using a testbed for verification and validation purposes of the INS, the same testbed, augmented with cybersecurity testing functionality, can be used to analyze the cybersecurity of the INS.

In this paper we first investigate the constituents of the INS in terms of sub-components, services, data, data flow, communication protocols, interfaces, connections, and dependencies, to define an INS reference architecture. Then we review and analyze existing bridge testbeds in terms of tools, architectural models, capabilities, functionalities, communication protocols, research instances, standards, and frameworks, towards defining the architecture of an INS testbed capable also to be used for analysing the cybersecurity posture of the INS under study. Our contribution is threefold: (1) We provide a complete list of INS constituents, with all components and their interactions presented, along with associated international rules, regulations and standards; (2) We provide a systematic literature review of publications on bridge testbeds; (3) We propose an architecture for a Cyber-Physical Range, i.e., a cybersecurity-enabled testbed for the INS.

2. Related Work

2.1. INS and Its Components

The academic literature appears to be poor in sources on the composition and functionality of the INS. In [11] the results of a survey of INSs provided by 35 vendors is presented. The findings have been used to develop a simplified model of a prototypical INS that is subsequently used as a basis for discussing cryptographical measures to improve the protection of the integrity of navigation data in INSs. Two resolutions define the performance standards of the INS, namely Resolution MSC.252(83) "Adoption of the Revised Performance Standards for Integrated Navigation Systems (INS)" [5–7], and Resolution MSC.86(70) Annex 3 "Recommendation on Performance Standards for an Integrated Navigation System (INS)" [16].

Resolution MSC.252(83) directly indicates some components of the INS. It also points to two IMO-related documents: SOLAS Chapter V "Safety of Navigation", Regulation 19 "Carriage requirements for shipborne navigational systems and equipment", and MSC/Circ.982 "Guidelines on Ergonomic Criteria for Bridge Equipment and Layout". A model of INSs with detailed information on components and their interactions is not available.

2.2. Networking

The International Electrotechnical Commission (IEC) 61162-3 (i.e., NMEA 2000) and 61162-450 networks are typically used onboard. The IEC 61162-460 network is also possible to procure a more secure network. The NMEA 2000 network is structured in five layers: the physical layer, data link layer, network layer, application layer, and network management. Tools (e.g., Sail Soft NMEA Studio, Maretron N2K Analyzer, NMEA Reader) that can be used to design and analyze a NMEA network exist [18].

Also, the International Telecommunication Union (ITU) issues technical standards for the interconnection of networks and technologies, and allocates global radio spectrum and satellite orbits [19]. The Recommendation ITU-R M.1371-5 [20] provides AIS-related specifications, and ITU-R M.823 [21] defines frequencies for the Differential Global Positioning System (DGPS) by region.

2.3. Testbeds

In order to identify relevant publications, a Systematic Literature Review (SLR) was conducted, following the methodology in [22]. The objective was to study modern bridge testbed environments with an explicit focus on surface vessels, so as to identify and classify existing architectural models, hardware and software tools that are utilized within contemporary bridge testbed environments.

The literature review was carried out in the ACM Digital Library, IEEE Xplore, ScienceDirect, Springer Link, and Wiley Online Library. The search string "((maritime) OR (marine)) AND ((ship) OR (vessel)) AND ((testbed) OR (test-bed) OR (test bed))" was used. Only technical reports and scientific articles published in conferences, workshops, and journals in English, between January 2010–December 2020 were considered. The initial search resulted in 9437 potentially relevant articles, reduced to 16 after three stages of assessment.

The SLR identified two bridge testbeds: the eMaritime Integrated Reference (eMIR) platform [38], developed by academia, and the Hyundai intelligent Collision Avoidance Support System (HiCASS) testbed [24], developed by industry. Of the two, the eMIR platform is among those recognized by IALA, whereas the HiCASS testbed is not. No testbeds targeting explicitly the INS were found.

eMIR consists of a mobile platform, a test field, a Verification and Validation (V&V) lab, and so on. LABSKAUS is the physical part of the eMIR platform, and HAGGIS is its simulation part. LABSKAUS is based on three layers: vessel, environment, and system. eMIR allows connection to different sensors such as GPS, compass, AIS etc. via a sensor box called NaviBox.

When comparing the two, eMIR was not developed for any specific marine applications, while HiCASS was specifically developed for testing the HiCASS system. The eMIR platform is quite flexible in terms of capabilities, which include risk assessment and performance tests of the components. On the other hand, the HiCASS testbed is deployed on a real vessel and can run only with real sensor data. The eMIR includes tools for various simulation and analysis purposes, e.g., human behavior, realistic environment, marine traffic analyses.

Even though mobility is a feature of both testbeds, a fixed platform of the eMIR is available as well. Both platforms were tested onboard ships. Moreover, a sensor box to connect sensors was developed in both. The eMIR's sensor box has the ability to transfer data to distant locations via LTE; Hyundai's testbed does not have such a function.

2.4. Cybersecurity of the INS

Shipboard cybersecurity has become a significant concern lately, with the IMO and several other organizations providing guidelines on how to address it. A cybersecurity-related survey on the INS was conducted in [11], where different aspects such as operating systems (e.g., Windows and Linux), networking (e.g., ethernet, CAN bus), internet connection possibility, sensor integration, and ECDIS controlled autopilot of a total of 22 INSs in the market were investigated.

The authors of [10] revealed cyber vulnerabilities of the INS on a roll-on/roll-off (RO-RO) type of vessel. The vulnerability analysis was carried out using the Nessus Professional vulnerability scanner [39]. After scanning the INS, the scanner produced a report consisting of 27 pieces of information, four of which were classified as vulnerabilities. Cyber threats and vulnerabilities in the Integrated Bridge System (IBS) are presented in [40].

Bridge simulators are used for the training of cadets and seafarers. Researchers from Tallinn University of Technology used bridge simulators for maritime cybersecurity training [42], and researchers from Plymouth University discussed combining a cyber range and a full mission bridge simulator for cybersecurity research [43]. However, although existing bridge testbeds have been used for some cybersecurity-related purposes, they have not been used for assessing the cybersecurity posture of an INS.

3. The Composition of the INS

Flag state requirements, class requirements, features of manufacturer products, and owner decisions directly affect the equipment in the INS. Since the IMO identifies minimum international requirements for member states, the IMO rules and regulations constitute a baseline for this study. The INS component list was determined according to the documents mentioned in Section 2.1.

3.1. INS Components

Table 2 presents the INS components together with their alternative names, where applicable, and the relevant IMO document. Components include: Anemometer, Automatic Identification System (AIS), Bridge Navigational Watch Alarm System (BNWAS), Central Alert Management Human Machine Interface (HMI), Controls for Main Engine, Main Rudder and Thruster, Echo-sounder, Electronic Chart Display and Information System (ECDIS), Global Positioning System (GPS), Gyro compass, Heading Control System (HCS), Indicators, Magnetic compass, Multifunctional Display (MFD), NAVTEX, RADAR, Rate of Turn Indicator (ROTI), Rudder pump selector switch, Sound reception system, Steering mode selector switch, Steering position selector switch, Track Control System (TCS), and Transmitting Heading Device (THD).

The AIS assists the OOW in navigating safely. It transmits three types of data (static, dynamic, and voyage-related) and safety-related messages to other vessels and shore stations [47]. The AIS performs four key functions: identifying ships, assisting in target tracking, exchanging information, and providing additional information for situation awareness. The anemometer is not only an indicator, but also a sensor to measure wind speed and direction.

The ECDIS is an essential component for digital navigation in contemporary maritime, as its use reduces the OOW's workload and enhances navigation safety. It provides real-time navigation information such as own ship's position and all chart information. Two ECDISs are deployed on modern vessel bridges, as primary and back-up.

3.2. Communication Protocols and Interfaces

The IEC 61162 "Maritime navigation and radio communication equipment and systems—Digital interfaces" standard defines digital interfaces for navigation, radio communication, and system integration in marine vehicles. It consists of five parts: IEC 61162-1 (Single talker and multiple listeners, also called NMEA 0183), IEC 61162-2 (High speed transmission), IEC 61162-3 (Multiple talkers and multiple listeners—Serial data instrument network, also called NMEA 2000), IEC 61162-450 (Ethernet interconnection), and IEC 61162-460 (Ethernet interconnection—Safety and security).

The Inter-VTS Data Exchange Format (IVEF) is a standard framework for data exchange between maritime control centers, developed by IALA. No official document containing a list of interfaces exists; instead, manufacturer brochures for bridge equipment were used to determine interfaces in use, such as DVI, RJ-45, RS-422, USB, RS-232, RS-485, and M12.

3.3. Data

The components in an INS may produce and/or present data to the bridge team, such as geographic location, COG, SOG, and heading. The data may be presented in analog or digital form. Moreover, a component transmits produced data to other components using communication protocols as mentioned in Section 3.2.

3.4. Sub-Components

INS components have hardware and/or software sub-components. Although the IMO defines minimum performance standards for the components, sub-components are not defined. The AIS works in connection with one GPS antenna and one VHF antenna. The ECDIS requires electronic charts (ENC or RNC) to work. Some bridge equipment such as ECDIS and RADAR require operating systems to work, such as Linux or Microsoft Windows.

3.5. Connections and Dependencies

The INS is based on showing information on the MFD, and the compulsory connections to the MFD vary according to allocated navigational tasks. The INS requirements do not strip down the individual dependencies among the equipment, but may increase the number of connections. Table 3 depicts the dependencies between individual components as per the IMO requirements. Alert management is essential for the INS; all connected equipment to the INS should be part of the alert management.

4. An INS Cyber-Physical Range

According to [110], "Cyber ranges are interactive, simulated representations of an organization's local network, system, tools, and applications that are connected to a simulated Internet level environment. They provide a safe, legal environment to gain hands-on cyber skills and a secure environment for product development and security posture testing." Accordingly, a testbed with functionality allowing the testing of the security posture of cyber-physical systems, such as the INS, would constitute a "cyber-physical range".

A cyber-physical range can be used for training, as it provides a controlled, interactive technology environment where trainees can learn how to detect and mitigate cyber attacks using the same kind of equipment that exists in the real world. The range allows attacks against the INS to be simulated, and to monitor a trainee's progress and performance. Beyond training, a cyber-physical range can be used to experiment with new cyber defense technologies, as it provides a safe environment to solve complex cybersecurity problems.

4.1. Capabilities and Functionalities

A cyber-physical range can be developed for the rapid test of hardware and software components both for INS concept and conventional bridges [27]. The performance of the components can be tested as per the requirements in maritime regulations. The range can be used for risk assessment [31,33]. It should provide a direct connectivity feature for V&V-related equipment. The range should be possible to be used as a mobile test environment [8], therefore it should be possible to be used for early testing of developing maritime technologies [26].

4.2. Standards and Frameworks

The S-100 Universal Hydrographic Data Model (UHDM) was developed by the IHO. S-100 is used in various products such as the ENC of the ECDIS [34]. The High-Level Architecture (HLA) is an architecture for integrated and distributed simulation, defined in IEEE Standard 1516. The "ISO 17894: Ships and marine technology—Computer applications" standard provides 20 principles for developing and testing Programmable Electronic Systems in marine applications [116].

4.3. Hardware Components

A virtual INS testbed can also be developed. Not only laptops, but also industrial computers can be used. The onboard sensors can be classified into three groups: movement sensors, environmental sensors, and internal ship sensors [36]. Real sensors such as AIS, wind sensor, RADAR, GPS, speed log can be used in the testbed [25,30]. A mobile connectable sensor box with several marine and surveillance equipment can be developed. For transportation, 10-foot or 20-foot containers may be used [25].

4.4. Monitoring and Management Tools

OpenCPN is a free chart plotter and navigational software that can be used for the AIS tracking function in the testbed [26,35]. RADAR tracking software can be used to identify RADAR tracks and process video [36]. Data flows among components can be controlled by a message broker software like RabbitMQ. The sensor box may require RADAR tracking software and RabbitMQ [35].

4.5. Simulation, Emulation, and Analysis Tools

Bridge Command, an open-source ship simulator software for Windows, Linux, and macOS, is used in eMIR [8,131]. MATLAB Simulink allows simulation, continuous test, automatic code generation, and verification of embedded systems [135]. Various virtual bridge elements for controlling and monitoring the bridge console can be developed [8]. Unreal Engine can be used to illustrate real-time ship motions in the simulation environment [140].

4.6. Cybersecurity-Specific Components

Real equipment mentioned in Section 3.1 may be used for cybersecurity research. Other than real equipment, software such as Bridge Command [131] or NMEA Simulator [141] could be utilized to transmit mimic IEC 61162-1 messages. For AIS research, the AIS BlackToolkit includes features such as an AIVDM message encoder [143]. Vulnerability scanners (e.g., Nessus Professional [39]) may be utilized to detect vulnerabilities of components and network. Kali Linux comes with more than 300 tools related to information security and penetration testing [148].

5. Conclusions

Technological advancements are crucial in enhancing marine safety. In addition to safety, digital infrastructure and obtained data contribute to the protection of the marine environment and increase the efficiency of the maritime economy. The need for e-navigation testbeds has been acknowledged by the IMO, and some developed testbeds have been recognized by IALA. A testbed allows the testing and development of maritime systems in a safe and economic environment. As cybersecurity concerns in the maritime sector are rising, it is also important to be able to assess the cybersecurity posture of the INS in the controlled environment that a testbed provides; such a testbed should have cybersecurity testing functionality that qualifies it as a cyber-physical range. In this paper we reviewed publications on bridge testbeds to identify tools, capabilities and functions, standards and frameworks, and architectural models used. Moreover, we identified technical aspects of the INS, including devices, sub-components, interfaces, communication protocols, data, dependencies, and connections, by considering in-force IMO rules and regulations and international standards. A total of 25 INS components were found, including ECDIS, AIS, RADAR, MFD, etc. We used these results to define design specifications for an INS Cyber-Physical Range.

References

Full reference list (151 sources) available in the original PDF.