SYSTEM AND METHOD FOR VERIFYING AIRCRAFT POSITION INFORMATION - Patent application

Abstract

To provide a method for verifying positional information of an aircraft on the basis of an ADS-B message containing the reception of the ADS-B message that indicates an identifier of the aircraft and a position of the aircraft.SOLUTION: A present method includes the steps of: accessing a dispersion type public registry with a fraudulent opening prevention mechanism of authentication completed flight planning data; and determining whether or not flight planning data related to an identifier is stored in the dispersion type public registry with the fraudulent opening prevention mechanism. The present method includes a step of comparing a position with a flight passage indicated by the flight planning data under a condition of the determination that the flight planning data is stored in the dispersion type public registry with the fraudulent opening prevention mechanism. The present method includes a step of selecting a characteristic of an icon corresponding to an aircraft on the basis of the determination whether or not the position corresponds to the flight passage. The present method further includes a step of displaying the icon at a place corresponding to the position on the basis of the characteristic on a display device.SELECTED DRAWING: Figure 4

Description

[Technical field]

[0001] The present disclosure relates generally to verifying aircraft position information. [Background technology]

[0002] Automatic Dependent Surveillance-Broadcast (ADS-B) is a technology that allows aircraft to determine their position using electronics on board the aircraft and transmit the position information using a digital data link. For example, an aircraft can determine its position using a Global Positioning System (GPS) receiver, and the aircraft can then transmit the position information in an ADS-B message to other aircraft, an air traffic control tower or other ground station, or other recipients. The Federal Aviation Administration (FAA) mandates that aircraft be equipped to transmit ADS-B messages by 2020. Thus, aircraft manufacturers are increasingly including ADS-B capabilities in aircraft. To remain transparent to the recipient, ADS-B messages are not encrypted. Because ADS-B messages are not encrypted, there are concerns that malicious actors could issue inaccurate or unreliable ADS-B messages. Summary of the Invention

[0003] In a particular implementation, a method for verifying aircraft position information based on an Automatic Dependent Surveillance-Broadcast (ADS-B) message includes receiving an ADS-B message indicating an identifier of the aircraft and indicating a position of the aircraft. The method includes accessing a tamper-proof distributed public ledger of authenticated flight plan data and determining whether flight plan data associated with the identifier is stored in the tamper-proof distributed public ledger. The method includes comparing the location to a flight path indicated by the flight plan data, conditioned on a determination that the location corresponds to the flight path. The method includes selecting a characteristic of an icon corresponding to the aircraft based on a determination of whether the location corresponds to the flight path. The method further includes displaying an icon on a display device at a location corresponding to the location based on the characteristic.

[0004] In another particular implementation, an apparatus for verifying aircraft position information based on ADS-B messages includes a receiver configured to receive ADS-B messages indicating an aircraft identifier and indicating a position of the aircraft. The apparatus includes a processor coupled to the receiver and configured to access a tamper-proof distributed public ledger of authenticated flight plan data to determine whether flight plan data associated with the identifier is stored in the tamper-proof distributed public ledger. The processor is configured to compare the location with a flight path indicated by the flight plan data, conditioned on a determination that the location corresponds to the flight path. The processor is further configured to select a characteristic of an icon corresponding to the aircraft based on a determination of whether the location corresponds to the flight path. The apparatus further includes a display device coupled to the processor, the display device configured to display an icon at a location corresponding to the location based on the characteristic.

[0005] In another particular implementation, a computer-readable storage device stores instructions that, when executed by a processor, cause the processor to perform operations including receiving an ADS-B message indicating an aircraft identifier and indicating a location of the aircraft, the operations including accessing a tamper-proof distributed public ledger of authenticated flight plan data and determining whether flight plan data associated with the identifier is stored in the tamper-proof distributed public ledger, the operations including comparing the location to a flight path indicated by the flight plan data, conditioned on a determination that the flight plan data is stored in the tamper-proof distributed public ledger, the operations including selecting a characteristic of an icon corresponding to the aircraft based on a determination of whether the location corresponds to the flight path, the operations further including initiating display of an icon on a display device at a location corresponding to the location based on the characteristic. [Brief description of the drawings]

[0006] [Figure 1] FIG. 1 illustrates the use of ADS-B messages and a tamper-evident distributed public ledger to verify aircraft position information. [Diagram 2] 1 shows a diagram of a particular implementation of a location verification system. [Diagram 3] 1 illustrates the generation of icons on a display device based on information retrieved from a tamper-proof distributed public ledger and ADS-B messages. [Figure 4] FIG. 2 is a flow diagram of an embodiment of a method for verifying aircraft position information based on ADS-B messages. [Diagram 5] FIG. 1 is a flow diagram of a method associated with a position verification system. [Figure 6] FIG. 1 is a block diagram of an aircraft including a position verification system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0007] Particular implementations are described with reference to the drawings. In the description, common features are given common reference numbers throughout the drawings. As used herein, various terms are used for the purpose of describing particular implementations only and are not intended to be limiting. For example, the singular forms "a" and "the" are intended to include the plural unless the context clearly indicates otherwise. Furthermore, the terms "comprise, comprises, and comprising" may be used interchangeably with "include, includes, or including." Additionally, the term "wherein" may be used interchangeably with "where." As used herein, "exemplary" may refer to examples, implementations, and / or aspects and is not to be construed as limiting or as indicating a preferred or preferred implementation. As used herein, ordinal terms (e.g., "first," "second," "third," etc.) used to modify elements such as structures, components, operations, etc. do not, in and of themselves, indicate a priority or order of the element relative to another element, but merely distinguish the element from other elements that have the same name (apart from the use of the ordinal term). As used herein, the term "set" refers to a grouping of one or more elements, and the term "plurality" refers to a plurality of elements.

[0008] In this disclosure, terms such as "determine," "calculate," "generate," "adjust," "modify," and the like may be used to describe how one or more operations are performed. It should be noted that such terms are not to be construed as limiting, and that similar operations may be performed utilizing other techniques. Additionally, as used herein, "generate," "calculate," "use," "select," "access," and "determine" may be used interchangeably. For example, "generating," "calculating," or "determining" a parameter (or signal) may refer to actively generating, calculating, or determining a parameter (or signal), or to using, selecting, or accessing a parameter (or signal) that has already been generated, such as by another component or device. Additionally, "adjust" and "modify" may be used interchangeably. For example, "adjusting" or "modifying" a parameter may refer to changing the parameter from a first value to a second value (a "modified value" or "adjustment value"). As used herein, "coupled" may include "communicatively coupled," "electrically coupled," or "physically coupled," or (alternatively) any combination thereof. Two devices (or components) may be directly or indirectly coupled (communicatively coupled, electrically coupled, or physically coupled) via one or more other devices, components, wires, buses, networks (wired networks, wireless networks, or combinations thereof), etc. Two devices (or components) that are electrically coupled may be included in the same device or different devices and may be coupled via electronics, one or more connectors, or inductive coupling, as illustrative, non-limiting examples. In some implementations, two devices (or components) that are communicatively coupled, such as by electrical communication, may send and receive electrical signals (digital or analog signals) directly or indirectly via one or more wires, buses, networks, etc.As used herein, "directly coupled" is used to describe two devices that are coupled (e.g., communicatively coupled, electrically coupled, or physically coupled) with no intervening components.

[0009] The present disclosure describes a system and method for verifying aircraft position information based on ADS-B messages. The position information contained in the ADS-B messages is verified by accessing a tamper-proof distributed public ledger (e.g., blockchain) used to store flight plan data for flights in an associated geographic region. For example, a first aircraft (or an air traffic control (ATC) station) receives an ADS-B message indicating an identifier of a second aircraft and a location of the second aircraft. Additionally, a ground-based flight management system maintains a tamper-proof distributed public ledger (e.g., blockchain) of flight plan data by adding an entry each time a flight plan (flight plans) is received. The first aircraft (or the ATC station) accesses the tamper-proof distributed public ledger and determines whether flight plan data is stored therein for the identifier of the second aircraft. If flight plan data exists (e.g., stored in a tamper-proof distributed public ledger), the first aircraft (or ATC station) compares the position of the second aircraft indicated by the ADS-B message with the flight path indicated by the flight plan data.

[0010] If the location matches (within a threshold) a location along the flight path, the first aircraft (or ATC station) displays an icon corresponding to the second aircraft on a display screen. The icon has a first characteristic (a first color, border, shading, size, or combination thereof) to indicate that the location of the second aircraft has been confirmed. If the location does not match a location along the flight path (or flight plan data corresponding to the second aircraft's identifier is not stored in the tamper-proof distributed public ledger), the aircraft (or ATC station) displays an icon with a second characteristic to indicate that the location of the second aircraft has not been confirmed. The aircraft (or ATC station) can then take additional steps to verify whether the location of the second aircraft is accurate, such as by querying a flight management system (which may have more up-to-date information indicating that the second aircraft is in an unexpected location, and may contact the second aircraft to verify the location if that information exists and is not the result of a malicious actor). Thus, the techniques disclosed herein can verify the location information indicated by ADS-B messages using a tamper-proof distributed public ledger that improves the security of ADS-B technology.

[0011] 1 illustrates an example of a particular implementation of a system 100 for verifying position information based on ADS-B messages. The system 100 includes a first aircraft 102, a second aircraft 104, a flight management system 108, and a tamper-proof distributed public ledger 110 (e.g., a blockchain). As described further herein, operations of the first aircraft 102 and the second aircraft 104 are performed by components of the respective aircraft, such as processors, receivers, transmitters, etc.

[0012] The FMS 108 may be included in or integrated with a ground base station, such as a station operated by a government agency, a station operated by one or more airlines, an ATC station, or any other form of ground base station. In some implementations, the FMS 108 may include or correspond to a desktop computer, a laptop computer, a tablet computer, a server, a mainframe, a mobile device (e.g., a cell phone), or any other type of computing device.

[0013] The FMS 108 is configured to create and maintain a tamper-proof distributed public ledger 110. For example, the FMS 108 is configured to receive flight plans from one or more airlines, ground station systems, or the aircraft itself. The FMS 108 is configured to authenticate the flight plans. For example, each airline may be issued a private key, and flight plan data received from an airline may be digitally signed using the private key. The FMS 108 verifies the digital signature using a public key associated with the airline. In this manner, successful verification of the digital signature of the flight plan data serves as authentication of the flight plan data (e.g., by use of public and private keys). In other implementations, other techniques for authentication of the flight plan data are used.

[0014] After authenticating the received flight plan data, the flight management system 108 is configured to generate one or more entries in the tamper-proof distributed public ledger 110 contingent on the authentication of the received flight plan data. For example, the flight management system 108 generates an entry in the tamper-proof distributed public ledger 110 that includes the received flight plan data. Each entry in the tamper-proof distributed public ledger 110 includes flight plan data for one or more aircraft for a particular time period. In a particular implementation, the entries in the tamper-proof distributed public ledger 110 correspond to a particular geographical region. For example, different tamper-proof distributed public ledgers may be maintained for storing flight plan data for different geographical regions.

[0015] By way of example, the tamper-proof distributed public ledger 110 is shared in a distributed manner among the flight management system 108, aircraft, ATC stations, airline systems, government systems, and other systems (e.g., across multiple devices). In a particular implementation, each system stores an instance of the tamper-proof distributed public ledger 110 in local memory within the respective system. In another implementation, the flight management system 108 stores the tamper-proof distributed public ledger, portions of which are replicated across multiple systems in a manner that maintains the security of the tamper-proof distributed public ledger 110 as a public (i.e., available to other devices) and tamper-proof (or tamper-proof / backed) ledger.

[0016] The tamper-proof distributed public ledger 110 stores flight plan data for multiple flight plans for multiple aircraft in a particular geographic region during a particular time period. In a particular implementation, each entry in the tamper-proof distributed public ledger 110 specifies an identifier, a corresponding arrival point, a corresponding departure point, a corresponding flight path, a corresponding altitude, or a combination thereof. Additionally, each entry in the tamper-proof distributed public ledger 110 includes a hash value that corresponds to a previous entry in the tamper-proof distributed public ledger 110. For example, each entry includes information that identifies the entry (e.g., entry / block ID) and allows another device or system to verify the integrity of the tamper-proof distributed public ledger 110. For example, the entry ID may include or correspond to the result of a hash function (such as, but not limited to, a Secure Hash Algorithm 256 (SHA-256) hash function, a RACE Integrity Primitive Evaluation Message Digest (RIPEMD) hash function, a Message Digest Algorithm 5 (MD5) hash function, or a BLAKE2 hash function) based on the flight plan data in the entry and based on the entry ID from a previous entry (e.g., block) in the tamper-proof distributed public ledger 110 (e.g., blockchain). For example, in FIG. 1, a first entry including a first flight plan data 112 includes a hash value based on the first flight plan data 112. A second entry including a second flight plan data 114 includes a hash value based on the second flight plan data 114 and the hash value of the first entry. Similarly, a third entry includes a hash value based on a third flight plan data 116 and the hash value of the second entry. This chained arrangement of hash values ​​makes each entry (e.g., block) authenticable with respect to the entire tamper-proof distributed public ledger 110 (e.g., blockchain), such that tampering or modification of the value of any entry in the tamper-proof distributed public ledger 110 is evident by calculating and verifying the hash value of the final entry in the tamper-proof distributed public ledger 110.Thus, the tamper-proof distributed public ledger 110 serves as a public ledger for flight plan data.

[0017] In some implementations, each entry includes flight plan data for one aircraft. In other implementations, the flight management system 108 bundles flight plans for multiple aircraft into one entry before adding the entry to the tamper-proof distributed public ledger 110, for example, according to an entry addition (e.g., block addition) scheme. For example, the flight management system 108 is configured to determine when an entry (e.g., block) addition trigger satisfies an entry addition condition. The entry addition trigger may include or correspond to a number of flight plans received, a time interval since the last entry was added to the tamper-proof distributed public ledger 110, another criterion, or a combination thereof. Once the entry addition condition is met (e.g., a threshold number of flight plans are received or a threshold amount of time has passed), a new entry is generated and added to the tamper-proof distributed public ledger 110. In certain implementations, the flight management system 108 includes a flight plan data buffer that stores the received flight plan data until the entry addition trigger satisfies the entry addition condition.

[0018] In certain implementations, the flight management system 108 maintains the tamper-proof distributed public ledger according to an entry conflict resolution scheme. By way of example, in implementations where multiple systems can add entries to the tamper-proof distributed public ledger 110, entry conflicts can occur. An entry (e.g., block) conflict refers to a situation where a first system forms and transmits a first entry and, at or near the same time, a second system forms and transmits a second entry that is different from the first entry. In this situation, some systems receive the first entry while other systems receive the second entry before the first entry. In this situation, both the first entry and the second entry are provisionally added to the tamper-proof distributed public ledger 110, causing a branch of the tamper-proof distributed public ledger 110. The branch is resolved when a next entry is added to one end of the branch, resulting in one branch being longer than the other branch (or branches). In such a situation, the longest branch is designated as the dominant branch. Once the longest branch is selected, any flight plan data found in the entry corresponding to the shorter branch but not in the longer branch is returned to the flight management system 108 (e.g., flight plan data buffer) for inclusion in a subsequent entry.

[0019] Entries in the tamper-proof distributed public ledger 110 are not encrypted. Thus, the tamper-proof distributed public ledger is open and available to aircraft (e.g., the first aircraft 102 and the second aircraft 104), ATC stations, airlines, and government systems. Additionally, although the flight management system 108 is said to maintain (e.g., add entries to) the tamper-proof distributed public ledger 110, in other implementations, other systems may share the maintenance of the tamper-proof distributed public ledger 110, provided they are configured to authenticate received flight plan data and execute according to the rules of the tamper-proof distributed public ledger 110 (e.g., entry addition scheme, inconsistency resolution scheme, etc.).

[0020] In the example of Figure 1, the flight management system 108 receives flight plan data for the first aircraft 102, the second aircraft 104, and the third aircraft. Based on the flight plan data associated with the first aircraft 102, the flight management system 108 generates an entry in the tamper-proof distributed public ledger 110 that includes the first flight plan data 112. Based on the flight plan data associated with the second aircraft 104, the flight management system 108 generates an entry in the tamper-proof distributed public ledger 110 that includes the second flight plan data 114. Based on the flight plan data associated with the third aircraft, the flight management system 108 generates an entry in the tamper-proof distributed public ledger 110 that includes the third flight plan data 116. In other implementations, the flight management system 108 generates one entry that includes the first flight plan data 112, the second flight plan data 114, and the third flight plan data 116.

[0021] The flight management system 108 maintains a tamper-proof distributed public ledger that allows aircraft, ATC stations, or other organizations to verify the position data in received ADS-B messages. In the example of FIG. 1, during flight, the first aircraft 102 receives an ADS-B message 120 from the second aircraft 104. The ADS-B message 120 indicates an identifier 122 of the second aircraft and a position 124 (e.g., latitude and longitude) of the second aircraft. Although not shown, the ADS-B message may include other information such as, but not limited to, altitude, azimuth speed, etc. In certain implementations, the ADS-B message is not encrypted to allow public access to the position information indicated therein.

[0022] By way of example, in certain implementations, the second aircraft 104 includes a positioning system, such as a GPS receiver, configured to determine a position of the second aircraft 104. The second aircraft 104 is configured to determine its position and indicate its position by periodically transmitting ADS-B messages (e.g., ADS-B message 120) using a transmitter. Additionally, while the first aircraft 102 is referred to as receiving the ADS-B messages, the first aircraft 102 also includes a GPS receiver or other positioning system in some implementations and the first aircraft 102 is configured to determine its position and indicate its position by transmitting ADS-B messages.

[0023] After receiving the ADS-B message 120 from the second aircraft 104, the first aircraft 102 accesses the tamper-proof distributed public ledger 110 to determine whether flight plan data associated with the identifier 122 is stored in the tamper-proof distributed public ledger 110. For example, the first aircraft 102 determines whether any of the flight plan data stored in the tamper-proof distributed public ledger 110 includes the identifier 122. If the flight plan data stored in the tamper-proof distributed public ledger 110 matches the identifier 122, the first aircraft 102 compares its position 124 to the flight path indicated by the matching flight plan data. For example, conditioned on a determination that the second flight plan data 114 defines the identifier 122, the first aircraft 102 compares its position 124 to the flight path indicated by the second flight plan data 114.

[0024] A location 124 corresponds to a flight path if the location 124 is within a threshold distance of a predicted location along the flight path. For example, the flight path may indicate multiple locations, and the first aircraft 102 compares the location 124 (indicated by the ADS-B message 120) to each location indicated by the flight path to determine whether the location 124 is within a threshold distance of at least one of the locations indicated by the flight path.

[0025] Based on the comparison, the first aircraft 102 selects a characteristic of an icon to represent the second aircraft 104 on an information display. The characteristic includes a color, a border, a shading, a size, a shape, or a combination thereof, of the icon. For example, if the location 124 corresponds to a location along the flight path indicated by the second flight plan data 114, the first aircraft 102 selects a first color (e.g., a first characteristic) for the icon corresponding to the second aircraft 104. An icon having the first characteristic indicates that the position information of the corresponding aircraft has been verified. The first aircraft then displays the icon on the display device at a location corresponding to the location based on the characteristic. For example, the display device is configured to display an icon of the aircraft in the airspace of the first aircraft 102. An icon displayed with the first characteristic (e.g., a first color) indicates an aircraft whose position information has been verified. An icon displayed with the second characteristic (e.g., a second color) indicates an aircraft whose position information has not been verified, and further actions may be taken as further described herein.

[0026] 1 , the first aircraft 102 also receives an ADS-B message 130 from another source 106. In this example, the other source 106 is a malicious actor, such as a hacker, and is not from an aircraft that is properly transmitting the ADS-B message. The ADS-B message 130 includes an identifier 132 of the third aircraft and a location 134 of the third aircraft. However, in this example, the ADS-B message 130 is a malicious message and the third aircraft is not actually at location 134.

[0027] Rather than simply processing the ADS-B message 130 and displaying an icon corresponding to the third aircraft, thereby providing the pilot with a false representation of the airspace, the first aircraft 102 accesses the tamper-proof distributed public ledger 110 to verify the ADS-B message 130. By way of example, the first aircraft 102 determines whether any flight plan data stored in the tamper-proof distributed public ledger 110 matches the identifier 132. Because there is a flight plan corresponding to the third aircraft, the first aircraft 102 can match the identifier 132 with the third flight plan data 116.

[0028] The first aircraft 102 then compares the location 134 with the flight path indicated by the third flight plan data 116. Because the location 134 was selected by the malicious actor, the location 134 is not associated with the flight path of the third aircraft. Based on a determination that the location 134 does not correspond to any location indicated by the flight path of the third flight plan data 116, the first aircraft 102 selects a characteristic (e.g., a second color) for the icon corresponding to the third aircraft and begins displaying the icon based on the selected characteristic. For example, the display device of the first aircraft 102 displays a second icon having the second color, the second icon corresponding to the third aircraft. Thus, if the identifier 132 does not match the identifier indicated by the flight plan data stored in the tamper-proof distributed public ledger 110, the first aircraft selects the second color for the icon corresponding to the third aircraft (e.g., because the location 134 cannot be verified by the flight plan data). Because the icon has a second color, a pilot looking at the display device can understand that the position of the third aircraft could not be verified and can better understand the airspace around the first aircraft 102.

[0029] In circumstances where the location information indicated in the ADS-B message cannot be verified, the first aircraft 102 may take additional action to attempt to verify the location. For example, the first aircraft 102 transmits a first message 140 to the flight management system 108. The first message 140 is transmitted conditioned on a determination that the location 134 does not correspond to the flight path indicated by the third flight plan data 116 (or that the flight plan data stored in the tamper-proof distributed public ledger 110 does not match the identifier 132). In a particular implementation, the first message 140 includes the identifier 132 and the location 134.

[0030] The flight management system 108 is configured to receive the first message 140 and attempt to verify the position 134. For example, the flight management system 108 may have access to an updated flight plan for a third aircraft that has not been added to the tamper-proof distributed public ledger 110. Additionally or alternatively, the flight management system 108 may receive information that the aircraft is off-route. The information may be received from an airline or an ATC station. Thus, the flight management system 108 may store or have access to information indicating the position of the third aircraft. If the flight management system 108 does not have access to such information, the flight management system 108 may also attempt to communicate with the third aircraft to verify its position directly from the third aircraft. After verifying (or failing to verify) the position of the third aircraft, the flight management system 108 generates and transmits a second message 142 to the first aircraft 102. The second message 142 confirms whether the position 134 has been verified.

[0031] The first aircraft 102 updates the display of the icon corresponding to the third aircraft based on the second message 142. For example, if the second message 142 indicates that the position 134 is verified, the first aircraft 102 modifies a characteristic of the icon (e.g., changes the icon from a second color to a first color) to indicate that the position of the third aircraft is verified. As another example, if the second message 142 indicates that the third aircraft is not present or that the position 134 could not be verified (e.g., the ADS-B message 130 is not a legitimate ADS-B message), the first aircraft 102 removes the icon corresponding to the third aircraft from the display device or changes a third characteristic for display. Thus, if the ADS-B message cannot be verified by the first aircraft 102 and the flight management system 108, the message is interpreted as malicious and inaccurate and the icon is not displayed on the display device. In other implementations, the icon remains in the second characteristic.

[0032] A method is provided for verifying ADS-B messages provided by malicious actors by verifying whether the position data contained in the ADS-B messages is correct using a tamper-proof distributed public ledger 110. Because the tamper-proof distributed public ledger 110 is maintained by the flight management system 108, and because each entry contains a hash value that points to the previous entry, flight plan data stored in the tamper-proof distributed public ledger 110 can be trusted to be authenticated and accurate. Thus, aircraft, ATC stations, or other recipients of the ADS-B messages can verify the position data contained therein and ignore malicious ADS-B messages, thereby improving the security of the ADS-B technology without requiring encryption or other techniques that may reduce the transparency of the ADS-B technology.

[0033] 2 illustrates an example of a position verification system 200. In a particular implementation, the position verification system 200 is included in or integrated with an aircraft (such as the first aircraft 102 of FIG. 1). In another particular implementation, the position verification system 200 is included in, integrated with, or coupled to an ATC station or other ground base station that receives ADS-B messages. In some implementations, the position verification system 200 includes or corresponds to a desktop computer, a laptop computer, a tablet computer, a server, a mainframe, a mobile device (e.g., a cell phone), a component of a vehicle, or any other type of computing device.

[0034] The location verification system 200 includes a processor 202, a receiver 204, a transmitter 206, a memory 210, and a display device 220. In other implementations, the location verification system 200 includes additional components, such as input / output interfaces. Alternatively, one or more components may be external to the location verification system 200. For example, in some implementations, the display device 220 is external to the location verification system 200.

[0035] The processor 202 is configured to execute instructions 212 stored in the memory 210 to perform the operations described herein. For example, the processor 202 verifies the location data indicated by the ADS-B message, as further described herein.

[0036] The transmitter 206 is configured to enable the location verification system 200 to transmit data to one or more other devices, either by a direct connection or via one or more networks, and the receiver 204 is configured to enable the location verification system 200 to receive data from one or more other devices, either by a direct connection or via one or more networks. The one or more networks may include an IEEE (Institute of Electrical and Electronics Engineers) 802 wireless network, a Bluetooth network, a telephone network, a satellite network, an optical or radio frequency network, or other wired or wireless network. Although described as separate components, in other implementations the transmitter 206 and receiver 204 may be replaced with a transceiver that enables data to be transmitted to and received from one or more other devices.

[0037] In a particular implementation, the receiver 204 is configured to receive ADS-B messages from an aircraft (or other source). For example, the receiver 204 receives ADS-B message 120 and ADS-B message 130, as described with reference to FIG. 1. The ADS-B messages are processed by the processor 202, as described further herein.

[0038] The memory 210 includes a volatile memory device (e.g., a random access memory (RAM) device), a non-volatile memory device (e.g., a read only memory (ROM) device, a programmable read only memory, and a flash memory), or both. The memory 210 is configured to store instructions 212 that are executed by the processor 202 to perform the operations described herein. In some implementations, the memory 210 is also configured for at least a portion of a tamper-evident distributed public ledger (e.g., the tamper-evident distributed public ledger 110 of FIG. 1).

[0039] Display device 220 includes a display screen configured to display an icon corresponding to the aircraft. In a particular implementation, display device 220 includes a display screen, a liquid crystal display (LCD) screen, a touch screen, or other type of display device. In a particular implementation where position verification system 200 is included in an aircraft, display device 220 may include a primary flight display (PFD) or a traffic collision avoidance system (TCAS) display. In another particular implementation where position verification system 200 is included in an ATC station, display device 220 may include a radar screen.

[0040] During operation, the receiver 204 receives ADS-B messages. For example, the receiver 204 receives an ADS-B message 120 (e.g., from the second aircraft 104 of FIG. 1 ) and an ADS-B message 130 (e.g., from another source 106 of FIG. 1 ). The ADS-B message 120 indicates an identifier 122 of the second aircraft 104 and a position 124 of the second aircraft 104, while the ADS-B message 130 indicates an identifier 132 of a third aircraft and a position 134 of the third aircraft. However, as described with reference to FIG. 1 , the ADS-B message 130 was generated by a malicious actor and the third aircraft is not actually at the position 134.

[0041] The processor 202 accesses the tamper-proof distributed public ledger 110 of FIG. 1 to determine whether flight plan data associated with the identifier indicated by the ADS-B message is stored in the tamper-proof distributed public ledger 110. For example, the processor 202 compares the identifier indicated by the ADS-B message with an entry specified by an entry in the tamper-proof distributed public ledger 110. For example, the receiver 204 receives the first flight plan data 112, the second flight plan data 114, and the third flight plan data 116 from the tamper-proof distributed public ledger 110. In some implementations, the first flight plan data 112, the second flight plan data 114, the third flight plan data 116, or a combination thereof, are stored in the memory 210 as part of the tamper-proof distributed public ledger 214.

[0042] If the identifier matches the identifier included in the entry, the processor 202 compares the location indicated by the ADS-B message with the flight path included in the entry to determine whether the location corresponds to the flight path. If the location corresponds to the flight path, the processor 202 selects a first characteristic (e.g., a first color, a first shading, a first boundary, etc.) for an icon to display on the display device 220. The icon with the first characteristic indicates that the location information of the corresponding aircraft has been verified. If the location does not correspond to the flight path (or the identifier indicated by the ADS-B message does not match an identifier specified by any of the entries in the tamper-proof distributed public ledger 110), the processor 202 selects a second characteristic (e.g., a second color, a second shading, a second boundary, etc.) for an icon to display on the display device 220. The icon with the second characteristic indicates that the location information of the corresponding aircraft could not be verified.

[0043] For example, in a first embodiment, the receiver 204 receives an ADS-B message 120 from the second aircraft 104. The processor 202 accesses the tamper-proof distributed public ledger 110 and determines whether the identifier 122 matches an identifier specified by flight plan data stored in the tamper-proof distributed public ledger 110. The processor 202 compares the identifier 122 to the first flight plan data 112, the second flight plan data 114, and the third flight plan data 116 and determines whether the identifier 122 matches an identifier specified by any of the flight plan data 112-116. In this embodiment, the identifier 122 matches an identifier specified by the second flight plan data 114 (e.g., flight plan data corresponding to the second aircraft 104). Conditioned on a determination that the identifier 122 matches an identifier specified by the second flight plan data 114, the processor 202 compares the location 124 to the flight path specified by the second flight plan data 114. In this example, the location 124 corresponds to the flight path. Thus, the processor 202 selects a first characteristic (e.g., a first color, a first shading, a first border, etc.) for displaying a first icon 222 corresponding to the second aircraft 104. The display device 220 displays the first icon 222 at a location on the display device corresponding to the location 124. Using the first characteristic to display the first icon 222 indicates to the pilot that the location information corresponding to the first icon 222 has been verified.

[0044] In a second embodiment, the receiver 204 receives the ADS-B message 130 from the other source 106. The processor 202 accesses the tamper-proof distributed public ledger 110 and determines whether the identifier 132 matches an identifier specified by flight plan data stored in the tamper-proof distributed public ledger 110. The processor 202 compares the identifier 132 to the first flight plan data 112, the second flight plan data 114, and the third flight plan data 116 and determines whether the identifier 132 matches an identifier specified by any of the flight plan data 112-116. In this embodiment, the identifier 132 matches an identifier specified by the third flight plan data 116 (e.g., flight plan data corresponding to a third aircraft). Conditioned on a determination that the identifier 132 matches an identifier specified by the third flight plan data 116, the processor 202 compares the position 124 to the flight path specified by the second flight plan data 116. In this example, location 134 does not correspond to the flight path. Thus, processor 202 selects a second characteristic (e.g., a second color, a second shading, a second border, etc.) for displaying second icon 224 corresponding to the third aircraft. Display device 220 displays second icon 224 at a location on the display device that corresponds to location 134. Using the second characteristic for displaying second icon 224 indicates to the pilot that the location information corresponding to second icon 224 could not be verified.

[0045] In some implementations, the position verification system 200 may perform additional operations to attempt to verify the position 134 of the ADS-B message 130. For example, the transmitter 206 may transmit a first message 140 to the flight management system 108 of FIG. 1 to verify the position of the third aircraft, conditioned on determining that the position 134 that does not correspond to the flight path of the flight plan data associated with the identifier 132 is not stored in the tamper-proof distributed public ledger 110. The first message 140 includes the identifier 132 and the position 134, as well as any other information from the ADS-B message 130. As described with reference to FIG. 1, the flight management system 108 may have more up-to-date information than the tamper-proof distributed public ledger 110, and the flight management system 108 may attempt to communicate directly with the third aircraft. In response to transmitting the first message 140, the receiver 204 may receive a second message 142 from the flight management system 108. A second message 142 verifies that the location 134 is correct or indicates that the location 134 could not be verified.

[0046] Based on the second message 142, the processor 202 modifies the second icon 224. For example, if the second message 142 indicates that the location 134 is correct, the processor 202 modifies the second icon 224 to have the first characteristic (e.g., a first color, a first shading, a first border, etc.) instead of the second characteristic. Alternatively, if the second message 142 indicates that the location 134 could not be verified, the second icon 224 is removed from the display device 220. In other implementations, the second icon 224 remains with the second characteristic or is modified to have a third characteristic.

[0047] The location verification system 200 thus enables the display of icons corresponding to aircraft such that the icons have different characteristics (e.g., color, shading, borders, etc.) based on whether the location information corresponding to the aircraft has been verified. A pilot or air traffic controller can quickly and easily ascertain from the icons which aircraft are verified and which aircraft may be due to malicious messages. Thus, the pilot or air traffic controller can maintain proper awareness of the airspace.

[0048] Figure 3 illustrates generating icons on a display device based on information retrieved from the tamper-proof distributed public ledger and the ADS-B messages. In the example of Figure 3, the tamper-proof distributed public ledger 110 includes flight plan information entries, including a first flight plan information entry 302, a second flight plan information entry 304, and a third flight plan information entry 306. The flight plan information entries 302-306 correspond to information specified by the flight plan data 112-116 of Figures 1 and 2.

[0049] In the example of FIG. 3, each flight plan information entry includes an identifier, a point of arrival (POA), a point of departure (POD), a flight path, a cruising altitude, an arrival time, a departure time, and a hash value. In other implementations, one or more of these components are optional or additional information is included. Each flight plan information entry corresponds to a different aircraft. For example, a first flight plan information entry 302 corresponds to a first aircraft having an identifier “ID_1” (e.g., the first aircraft 102 of FIG. 1), a second flight plan information entry 304 corresponds to a second aircraft having an identifier “ID_2” (e.g., the second aircraft 104 of FIG. 1), and a third flight plan information entry 306 corresponds to a third aircraft having an identifier “ID_3”.

[0050] As described with reference to FIG. 2, the position verification system 200 receives an ADS-B message 120 from the second aircraft 104 of FIG. 1. The ADS-B message 120 includes an identifier 122 ("ID_2") and a location 124 (e.g., 30.2672 degrees north latitude, 97.7431 degrees west longitude). The position verification system 200 examines the flight plan information entries 302-306 to determine whether any include the identifier 122. Because the second flight plan information entry 304 includes "ID_2," the position verification system 200 compares the location 124 to the flight path included in the second flight plan information entry 304 to determine whether the location 124 corresponds to the flight path. If the location 124 corresponds to the flight path (e.g., is within a threshold distance of a location included in the flight path), the position verification system 200 selects a first characteristic (e.g., a first boundary) for use in displaying the first icon 222.

[0051] In addition, the position verification system 200 receives an ADS-B message 130 from another source 106 of FIG. 1. The ADS-B message 130 includes an identifier 132 ("ID_3") and a location 134 (e.g., 30.0711 degrees north latitude, 96.9813 degrees west longitude). The position verification system 200 examines the flight plan information entries 302-306 to determine whether any include the identifier 132. Because the third flight plan information entry 306 includes "ID_3," the position verification system 200 compares the location 134 to the flight path included in the third flight plan information entry 306 to determine whether the location 134 corresponds to the flight path. If the location 134 does not correspond to the flight path, the position verification system 200 selects a second characteristic (e.g., a second boundary) to use to display the second icon 224.

[0052] The display device 220 displays icons corresponding to aircraft within a particular geographic region, such as the region around the position verification system 200. In a particular implementation in which the position verification system 200 is incorporated in a first aircraft, the display device 220 displays an icon 310 corresponding to the location of the first aircraft. The display device 220 also displays a first icon 222 and a second icon 224. The first icon 222 is displayed on the display device 220 at a location corresponding to the location 124, and the second icon is displayed on the display device 220 at a location corresponding to the location 134. As shown in FIG. 3, the first icon 222 has a first boundary (e.g., a straight boundary) and the second icon 224 has a second boundary (e.g., a dotted boundary). In other implementations, the first icon 222 and the second icon 224 may be distinguished by other characteristics, such as different colors, different shading, different sizes, different shapes, etc. A border of the first icon 222 indicates that the position of the corresponding aircraft has been verified, and a border of the second icon 224 indicates that the position of the corresponding aircraft could not be verified. In some implementations, in response to a message from the flight management system 108 (e.g., second message 142), the second icon 224 can be modified by changing the border if the position information has been verified, or by removing the second icon 224 by the flight management system 108 if the position information could not be verified.

[0053] 4 illustrates a method 400 for verifying aircraft position information based on ADS-B messages. In a particular implementation, the method 400 is performed by the first aircraft 102 (or an air traffic control station) of FIG. 1 or by the position verification system 200 of FIG. 2 (e.g., by the processor 202 executing instructions 212).

[0054] The method 400 includes receiving an ADS-B message indicating an identifier of the aircraft and indicating a location of the aircraft, at 402. For example, the first aircraft 102 or the processor 202 receives the ADS-B message 120 indicating the identifier 122 and the location 124. In a particular implementation, the ADS-B message is unencrypted when received.

[0055] The method 400 includes, at 404, accessing the tamper-proof distributed public ledger of authenticated flight plan data to determine whether flight plan data associated with the identifier is stored in the tamper-proof distributed public ledger. For example, the first aircraft 102 or the processor 202 accesses the tamper-proof distributed public ledger 110 to determine whether the first flight plan data 112, the second flight plan data 114, or the third flight plan data 116 is associated with the identifier 122.

[0056] The method 400 includes, at 406, comparing the location to the flight path indicated by the flight plan data, conditioned on a determination that the flight plan data is stored in the tamper-proof distributed public ledger. For example, the first aircraft 102 or the processor 202 compares the location 124 to the flight path indicated by the second flight plan data 114, conditioned on a determination that the identifier 122 is associated with the second flight plan data 114.

[0057] The method 400 includes, at 408, selecting a characteristic of the icon corresponding to the aircraft based on the determination of whether the location corresponds to the flight path. For example, the processor 202 determines a characteristic of the first icon 222 based on whether the location 124 corresponds to the flight path. In particular implementations, the characteristic includes color, border, shading, size, shape, other characteristics, or combinations thereof. In particular implementations, the location corresponds to the flight path based on the location being within a threshold distance of a predicted location along the flight path.

[0058] The method 400 further includes displaying an icon on the display device at a location corresponding to the location based on the characteristic, at 410. For example, the processor 202 initiates displaying a first icon 222 via the display device 220 at a location corresponding to the location 124. The first icon 220 has a first characteristic selected by the processor 202.

[0059] In certain implementations, the method 400 includes transmitting a message to the flight management system to confirm the location of the aircraft, conditioned on a determination that the location does not correspond to the flight path or that the flight plan data is not stored in the tamper-proof distributed public ledger. For example, if the location 124 does not correspond to the flight path of the corresponding flight plan data or if no flight plan data is stored in the tamper-proof distributed public ledger 110 that matches the identifier 122, the first aircraft (or the transmitter 206) transmits a first message 140 to the flight management system 108. In some implementations, the method 400 further modifies a characteristic of the icon in response to receiving the message confirming the location of the aircraft. For example, in response to receiving the second message 142 (and the second message 142 confirming the location 134), the processor 202 modifies the second icon 224 to have a first characteristic (e.g., a first color, shading, border, shape, size, etc.). In some implementations, the method 400 further includes removing the icon in response to receiving a message indicating that the aircraft is not present or that the position is incorrect. For example, in response to the second message 142 (and the second message 142 indicating that the position 134 could not be verified), the processor 202 removes the second icon 224 from the display device 220.

[0060] In a particular implementation, the entries in the tamper-proof distributed public ledger are not encrypted. Additionally or alternatively, each entry in the tamper-proof distributed public ledger includes flight plan data for one or more aircraft during a particular time period. The flight plan data for a particular aircraft defines a corresponding arrival point, a corresponding departure point, a corresponding flight path, a corresponding altitude, or a combination thereof. For example, the first flight plan data 112, the second flight plan data 114, and the third flight plan data 116 include flight plan data for aircraft during a particular time period, such as a POA, a POD, a flight path, an altitude, an arrival time, a departure time, or a combination thereof, as shown in FIG. 3. Additionally or alternatively, each entry in the tamper-proof distributed public ledger 110 includes a hash value corresponding to a previous entry in the tamper-proof distributed public ledger, as described with reference to FIG. 1.

[0061] In certain implementations, entries in the tamper-proof distributed public ledger are generated by the flight management system subject to authentication by the flight management system of corresponding flight plan data. For example, the flight management system 108 receives flight plan data from other sources, such as airlines, ATC stations, aircraft, etc., and the flight management system 108 authenticates the flight plan data before adding the authenticated flight plan data to the tamper-proof distributed public ledger 110. In some implementations, the flight management system maintains the tamper-proof distributed public ledger according to an entry addition scheme, as described with reference to FIG. 1.

[0062] Method 400 improves the security of ADS-B technology. For example, a tamper-proof distributed public ledger is used to provide a way to determine whether a malicious actor is providing an inaccurate ADS-B message by verifying whether the position data included in the ADS-B message is correct. Thus, an aircraft, ATC station, or other recipient of the ADS-B message can verify the position data included therein and ignore the malicious ADS-B message, thereby improving the security of the ADS-B technology without requiring encryption or other techniques that may reduce the transparency of the ADS-B technology.

[0063] In some implementations, the method 400 of FIG. 4 is embodied as instructions stored in a computer-readable storage device. In a particular implementation, the computer-readable storage device stores instructions that, when executed by a processor, cause the processor to perform operations including receiving an ADS-B message indicating an aircraft identifier and indicating a location of the aircraft. The operations include accessing a tamper-proof distributed public ledger of authenticated flight plan data and determining whether flight plan data associated with the identifier is stored in the tamper-proof distributed public ledger. The operations include, conditioned on a determination that the flight plan data is stored in the tamper-proof distributed public ledger, comparing the location to a flight path indicated by the flight plan data. The operations include selecting a characteristic of an icon corresponding to the aircraft based on a determination of whether the location corresponds to the flight path. The operations further include initiating an icon display on a display device at a location corresponding to the location based on the characteristic.

[0064] With reference to Figures 5 and 6, an embodiment of the disclosure is described in the context of an aircraft manufacturing and service method 500, which is illustrated by the flow diagram of Figure 5, and an aircraft 600, which is illustrated by the block diagram of Figure 6.

[0065] Referring to FIG. 5, a flow diagram of an exemplary embodiment of a method relating to a location verification system is shown as 500. At a pre-production stage, the exemplary method 500 includes at 502 a specification and design of an aircraft, such as the aircraft 600 described with reference to FIG. 6. During the creation of the aircraft specification and design, the method 500 includes a processor, a memory, a receiver, a transmitter, a display device, or a combination thereof. In a particular implementation, the processor, the memory, the receiver, the transmitter, and the display device each include or correspond to the processor 202, the memory 210, the receiver 204, the transmitter 206, and the display device 220 of FIG. 2. At 504, the method 500 includes procuring materials. For example, the method 500 may include procuring materials (such as a processor, a memory, a receiver, a transmitter, a display device, or a combination thereof) for the location verification system.

[0066] During production, the method 500 includes manufacturing the components and subassemblies at 506 and system integration with the aircraft at 508. In certain implementations, the method 500 includes manufacturing the components and subassemblies of the location verification system (e.g., manufacturing a processor, memory, receiver, transmitter, display device, or combinations thereof) and system integration of the location verification system (e.g., coupling a receiver to a processor). The method 500 includes certification and delivery of the aircraft at 510 and placing the aircraft in service at 512. In some implementations, the certification and delivery includes certification of the location verification system. Placing the aircraft in service also includes commissioning the location verification system. While being operated by a customer, the aircraft may be scheduled for routine maintenance and upkeep (which may also include modifications, reconfigurations, refurbishments, etc.). The method 500 includes performing maintenance and upkeep on the aircraft at 514. In certain implementations, the method 500 includes performing maintenance and upkeep on the location verification system. For example, service and maintenance of the location verification system may include replacing one or more of the processor, memory, receiver, transmitter, display device, or combinations thereof.

[0067] Each of the processes of method 500 may be performed or carried out by a system integrator, a third party, and / or an operator (e.g., a customer). For purposes of this specification, a system integrator includes, but is not limited to, any number of aircraft manufacturers and major system subcontractors, a third party includes, but is not limited to, any number of vendors, subcontractors, and suppliers, and an operator is an airline, a leasing company, a military entity, a service organization, etc.

[0068] Referring to Figure 6, a block diagram of an example implementation of an aircraft including components of a position verification system is shown as 600. In at least one implementation, the aircraft 600 is manufactured by at least a portion of the method 500 of Figure 5. As shown in Figure 6, the aircraft 600 includes an airframe 618 with a number of systems 620 and an interior 622. Examples of the number of systems 620 include one or more of a propulsion system 624, an electrical system 626, an environmental system 628, and a hydraulic system 630.

[0069] Aircraft 600 also includes a location verification system 634. Location verification system 634 includes processor 202, receiver 204, transmitter 206, memory 210, and display device 220, as described with reference to Figure 2. Processor 202 is configured to verify the location of the aircraft based on the ADS-B messages and access to a tamper-proof distributed public ledger, as described with reference to Figures 1 and 2.

[0070] Any number of other systems may be included in aircraft 600. Although an aerospace example is shown, the present disclosure may be applied to other industries. For example, position verification system 634 may be used onboard a manned or unmanned vehicle, such as a satellite, spacecraft, ship, or land vehicle, or may be used within a building or other structure.

[0071] Apparatus and methods included herein may be employed during any one or more stages of method 500 of FIG. 5. For example, components or subassemblies corresponding to manufacturing process 508 may be fabricated or manufactured in a manner similar to components or subassemblies manufactured while aircraft 600 is in service, such as at 512, but without limitation. Also, one or more apparatus implementations, method implementations, or combinations thereof may be utilized during the manufacturing stages (e.g., stages 502-510 of method 500), such as by substantially streamlining or reducing the cost of assembling aircraft 600. Similarly, one or more of the apparatus implementations, method implementations, or combinations thereof may be utilized during the operation of aircraft 600, such as, without limitation, during maintenance and upkeep, such as at 514.

[0072] One or more of Figures 1-6 may illustrate systems, devices, and / or methods according to the teachings of the present disclosure, but the present disclosure is not limited to these illustrated systems, devices, and / or methods. One or more functions or components of any of Figures 1-6 illustrated or described herein may be combined with one or more other parts of another of Figures 1-6. For example, one or more elements of method 400 of Figure 4 may be performed in combination with one or more other elements of method 400 of Figure 4 or other operations described herein. Thus, the implementations described herein are not to be construed as being limiting in any way, and implementations of the present disclosure may be appropriately combined without departing from the teachings of the present disclosure. By way of example, one or more operations described with reference to Figure 4 may be optional, may be performed at least partially simultaneously, and / or may be performed in a different order than illustrated or described.

[0073] The illustrations of the embodiments described herein are intended to provide a general understanding of the structure of various implementations. These illustrations are not intended to serve as an exhaustive description of all elements and features of apparatuses and systems utilizing the structures or methods described herein. Many other implementations may become apparent to those skilled in the art upon review of the present disclosure. Other implementations may be derived and utilized from the present disclosure, such that structural and logical substitutions and changes may be made without departing from the scope of the present disclosure. For example, the operations of the method may be performed in an order different from that shown in the figures, or one or more method operations may be omitted. Thus, the present disclosure and the figures should be considered illustrative rather than limiting.

[0074] Further, while specific embodiments have been illustrated and described herein, it should be recognized that any subsequent configurations designed to achieve the same or similar results may be substituted for the specific implementations shown. The present disclosure is intended to include any and all adaptations or variations that follow from the various implementations. Combinations of the above implementations, and other implementations not specifically described herein, will be apparent to those of skill in the art upon review of this specification.

[0075] Furthermore, the present disclosure includes implementations according to the following provisions:

[0076] Clause 1. A method (400) for verifying aircraft position information based on Automatic Dependent Surveillance-Broadcast (ADS-B) messages (120, 130), comprising: receiving an ADS-B message (120) indicating an aircraft identifier (122) and indicating a position (124) of said aircraft; accessing a tamper-proof distributed public ledger (110) of authenticated flight plan data (112-116) to determine whether flight plan data associated with said identifier (122) is stored in said tamper-proof distributed public ledger (110); comparing said location (124) to a flight path indicated by said flight plan data, subject to a determination that said flight plan data is stored in said tamper-proof distributed public ledger (110); selecting a characteristic of an icon (222) corresponding to the aircraft based on a determination of whether the location (124) corresponds to the flight path; and displaying said icon (222) on a display device (220) at a location corresponding to said location (124) based on said characteristic; A method (400) comprising:

[0077] Clause 2. The method (400) of clause 1, further comprising, conditioned on determining that the position (124) does not correspond to the flight path or that the flight plan data is not stored in the tamper-proof distributed public ledger (110), sending a message (140) to a flight management system (108) to confirm the position (124) of the aircraft.

[0078] Clause 3. The method (400) of clause 2, further comprising modifying the characteristic of the icon (222) in response to receiving a message (142) confirming the position (124) of the aircraft.

[0079] Clause 4. The method (400) of clause 2, further comprising removing the icon (222) in response to receiving a message indicating that the aircraft is not present or that the position (124) is incorrect.

[0080] Clause 5. A method (400) according to any one of clauses 1 to 4, wherein the position (124) corresponds to the flight path based on the position (124) being within a threshold distance of a predicted position along the flight path.

[0081] Clause 6. The method (400) of any one of clauses 1 to 5, wherein the ADS message (120) is unencrypted when received.

[0082] Clause 7. The method (400) of any one of clauses 1 to 6, wherein the characteristics include a color, a border, a shading, a size, a shape, or a combination thereof, of the icon (222).

[0083] Clause 8. The method (400) of any one of clauses 1 to 7, wherein entries in the tamper-proof distributed public ledger (110) are not encrypted.

[0084] Clause 9. The method (400) of any one of clauses 1 to 8, wherein each entry in the tamper-proof distributed public ledger (110) contains flight plan data for one or more aircraft for a particular time period.

[0085] Clause 10. The method (400) of clause 9, wherein the flight plan data for a particular aircraft defines a corresponding arrival point, a corresponding departure point, a corresponding flight path, a corresponding altitude, or a combination thereof.

[0086] Clause 11. The method (400) of clause 9 or 10, wherein each entry in the tamper-proof distributed public ledger (110) further includes a hash value corresponding to a previous entry in the tamper-proof distributed public ledger (110).

[0087] Clause 12. The method (400) of any one of clauses 1 to 11, wherein entries in the tamper-proof distributed public ledger (110) are generated by a flight management system (108) subject to authentication by the flight management system of corresponding flight plan data.

[0088] Clause 13. The method (400) of clause 12, wherein the flight management system (108) maintains the tamper-proof distributed public ledger (110) according to an entry addition scheme.

[0089] Clause 14. An apparatus (200) for verifying aircraft position information based on Automatic Dependent Surveillance-Broadcast (ADS-B) messages (120, 130), comprising: a receiver (204) configured to receive ADS-B messages indicating an aircraft identifier (122) and indicating a position (124) of said aircraft; A processor (202) coupled to the receiver (204), accessing a tamper-proof distributed public ledger (110) of authenticated flight plan data (112-116) to determine whether flight plan data associated with said identifier (122) is stored in said tamper-proof distributed public ledger (110); conditional on a determination that the flight plan data is stored in the tamper-proof distributed public ledger (110), comparing the location (124) to a flight path indicated by the flight plan data; selecting a characteristic of an icon (222) corresponding to the aircraft based on a determination of whether the location (124) corresponds to the flight path; A processor (202) configured to: a display device (220) coupled to the processor (202), the display device (220) configured to display the icon (222) at a location corresponding to the position (124) based on the characteristic; An apparatus (200) comprising:

[0090] Clause 15. The apparatus (200) of clause 14, further comprising a transmitter (206) configured to transmit a message (140) to a flight management system (108) to confirm the position (124) of the aircraft, subject to a determination that the position (124) does not correspond to the flight path or the flight plan data is not stored in the tamper-proof distributed public ledger (110).

[0091] Clause 16. The apparatus (200) of clause 14 or 15, further comprising a memory (210) configured to store at least a portion (214) of the tamper-proof distributed public ledger (110).

[0092] Clause 17. The apparatus (200) of any one of clauses 14 to 16, wherein the receiver (204), the processor (202), and the display device (220) are incorporated in the second aircraft (600).

[0093] Clause 18. The apparatus (200) of any one of clauses 14 to 17, wherein the receiver (204), the processor (202), and the display device (220) are integrated within or coupled to an air traffic control station.

[0094] Clause 19. A computer-readable storage device storing instructions that, when executed by a processor (202), cause the processor (202) to: receiving an Automatic Dependent Surveillance-Broadcast (ADS-B) message (120) indicating an aircraft identifier (122) and indicating a position (124) of said aircraft; accessing a tamper-proof distributed public ledger (110) of authenticated flight plan data (112-116) to determine whether flight plan data associated with said identifier (122) is stored in said tamper-proof distributed public ledger (110); comparing said location (124) to a flight path indicated by said flight plan data, subject to a determination that said flight plan data is stored in said tamper-proof distributed public ledger (110); selecting a characteristic of an icon (222) corresponding to the aircraft based on a determination of whether the location (124) corresponds to a flight path; initiating display of said icon (222) on a display device (220) at a location corresponding to said location (124) based on said characteristic; A computer-readable storage device that causes operations including

[0095] Clause 20. The computer-readable storage device of clause 18, wherein the authenticated flight plan data (112-116) corresponds to a particular geographic region.

[0096] The "Summary" of the disclosure is submitted with the understanding that it will not be used to interpret or limit the scope or meaning of the claims. In addition, in the above "Detailed Description," various features may be grouped together or described in a single implementation for the purpose of brevity of the disclosure. The above-described embodiments are illustrative of the present disclosure, but are not intended to limit the disclosure. Also, many modifications and variations are possible in accordance with the principles of the disclosure. As reflected in the following claims, the claimed subject matter may not be directed to all features in any of the disclosed embodiments. The scope of the disclosure is therefore defined by the following claims and their equivalents.

Claims

1. A method (400) for verifying aircraft position information based on Automatic Dependent Surveillance-Broadcast (ADS-B) messages (120, 130), comprising: receiving an ADS-B message (120) indicating an aircraft identifier (122) and indicating a position (124) of said aircraft; accessing a tamper-proof distributed public ledger (110) of authenticated flight plan data (112-116) to determine whether flight plan data associated with said identifier (122) is stored in said tamper-proof distributed public ledger (110); conditioned on a determination that the flight plan data is stored in the tamper-proof distributed public ledger (110), comparing the location (124) to a flight path indicated by the flight plan data; Selecting a characteristic of the icon (222) corresponding to the comparison result; displaying said icon (222) on a display device (220) at a location corresponding to said location (124) based on said characteristic; The method (400) comprising:

2. conditioned on determining that the position (124) does not correspond to the flight path or that the flight plan data is not stored in the tamper-proof distributed public ledger (110), sending a message (140) to a flight management system (108) to confirm the position (124) of the aircraft; and optionally, modifying the characteristic of the icon (222) in response to receiving a first message (142) confirming the position (124) of the aircraft; or removing said icon (222) in response to receiving a message (142) indicating that said aircraft is not present or that said position (124) is incorrect; The method of claim 1 , further comprising at least one of:

3. A method (400) according to claim 1 or 2, wherein, based on the comparison result, if the position (124) is within a threshold distance of a predicted position along the flight path, it is determined that the position (124) corresponds to the flight path.

4. The method (400) of any one of claims 1 to 3, wherein the ADS-B message (120) is unencrypted when received.

5. The method (400) of any one of claims 1 to 4, wherein the characteristics include a color, a border, a shading, a size, a shape, or a combination thereof, of the icon (222).

6. 6. The method (400) of any one of claims 1 to 5, wherein entries in the tamper-proof distributed public ledger (110) are not encrypted.

7. Each entry in the tamper-proof distributed public ledger (110) contains flight plan data for one or more aircraft for a particular time period, and optionally: the flight plan data for a particular aircraft defines a corresponding arrival point, a corresponding departure point, a corresponding flight path, a corresponding altitude, or a combination thereof; or each entry in the tamper-evident distributed public ledger (110) further includes a hash value corresponding to a previous entry in the tamper-evident distributed public ledger (110); The method (400) of any one of claims 1 to 6, wherein the method (400) is at least one of:

8. 8. The method (400) of any one of claims 1 to 7, wherein entries in the tamper-proof distributed public ledger (110) are generated by a flight management system (108) subject to authentication by the flight management system (108) of corresponding flight plan data, and optionally the flight management system (108) maintains the tamper-proof distributed public ledger (110) according to an entry addition scheme.

9. 1. An apparatus (200) for verifying aircraft position information based on Automatic Dependent Surveillance-Broadcast (ADS-B) messages (120, 130), comprising: a receiver (204) configured to receive an ADS-B message (120) indicating an aircraft identifier (122) and indicating a position (124) of said aircraft; A processor (202) coupled to the receiver (204), accessing a tamper-proof distributed public ledger (110) of authenticated flight plan data (112-116) to determine whether flight plan data associated with said identifier (122) is stored in said tamper-proof distributed public ledger (110); conditioned on a determination that the flight plan data is stored in the tamper-proof distributed public ledger (110), comparing the location (124) to a flight path indicated by the flight plan data; Selecting the characteristic of the icon (222) corresponding to the comparison result; A processor (202) configured to: a display device (220) coupled to the processor (202), the display device (220) configured to display the icon (222) at a location corresponding to the position (124) based on the characteristic; An apparatus (200) comprising:

10. 10. The apparatus (200) of claim 9, further comprising a transmitter (206) configured to transmit a message (140) to a flight management system (108) to confirm the position (124) of the aircraft, conditioned on a determination that the position (124) does not correspond to the flight path or the flight plan data is not stored in the tamper-proof distributed public ledger (110).

11. 11. The apparatus (200) of claim 9 or 10, further comprising a memory (210) configured to store at least a portion (214) of the tamper-proof distributed public ledger (110).

12. The apparatus (200) of any one of claims 9 to 11, wherein the receiver (204), the processor (202), and the display device (220) are integrated within a second aircraft (600).

13. 10. The apparatus (200) of claim 9, wherein the receiver (204), the processor (202), and the display device (220) are integrated within or coupled to an air traffic control station.

14. A computer-readable storage device storing instructions that, when executed by a processor (202), cause the processor (202) to: receiving an Automatic Dependent Surveillance-Broadcast (ADS-B) message (120) indicating an aircraft identifier (122) and indicating a position (124) of said aircraft; accessing a tamper-proof distributed public ledger (110) of authenticated flight plan data (112-116) to determine whether flight plan data associated with said identifier (122) is stored in said tamper-proof distributed public ledger (110); conditioned on a determination that the flight plan data is stored in the tamper-proof distributed public ledger (110), comparing the location (124) to a flight path indicated by the flight plan data; Selecting a characteristic of the icon (222) corresponding to the comparison result; initiating display of said icon (222) on a display device (220) at a location corresponding to said position (124) based on said characteristic; A computer-readable storage device that causes operations including

15. The computer readable storage device of claim 14, wherein the authenticated flight plan data (112-116) corresponds to a particular geographic region.

Images