A Secure Steganographic Authentication Framework for Controller Pilot Data Link Communications over VDL-2: Design, Implementation and Evaluation

Abstract

CPDLC now carries a large share of routine air traffic control instructions, but the protocol as run over VDL-2 has no encryption and no way to check who sent a message. Low- cost Software Defined Radios make eavesdropping, message forgery, replay, and handover interception practical.  The study presents a framework that adds cryptographic protection to CPDLC in software only, leaving the radio, the avionics, and the on- the- wire message format untouched. The design has two parts. A session tier signs a log- on bundle with ECDSA over P-256 and encrypts it with AES-256-GCM, which gives non- repudiation and establishes a session key. A message tier then carries a 128-bit HMAC-SHA256 token across the session by encoding it with an RS(18,12) Reed–Solomon code and hiding the resulting symbols in protocol fields using LSB steganography. The central safety question—which fields can be used as carriers without risking a clearance value—is answered by a Green/Amber/Red (GART) taxonomy built from a field review of all 278 CPDLC message elements; embedding touches Green fields only, and a run- time gate blocks anything else.  The study implemented the framework in Python over a GNU Radio VDL-2 model and evaluated it across three calibrated channel conditions with 10,000 Monte Carlo iterations. Under nominal conditions, the mean attack success rate falls from 87.79% to 0.1242% (bootstrap 95% CI 0.1220%–0.1264%). The difference is significant (two-proportion z = 38.24, p < 0.001) and the effect size is very large (Cohen's h = 2.2646). Authentication is reliable: false acceptance is 0.12%, verification success is 99.30% nominally (falling to 84.70% under severe interference), and false rejection stays at 0.71% nominally, at a 0.4007ms cryptographic pipeline latency. The evidence supports the claim that CPDLC can be secured within VDL-2 constraints, and identifies where operational feasibility still needs live validation.