Ais (Automatic Identification System) : Background
Ais (Automatic Identification System) : Background
Ais (Automatic Identification System) : Background
Background
Due to the great safety benefits offered by AIS, this technology was made
compulsory throughout the world in 2002 for all passenger ferries and
vessels over 300 gross tonnes.
1
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
An AIS transponder determines its own position, speed and course using a
built in GPS receiver. This information is combined with other important
navigation information and automatically communicated between AIS
equipped vessels without any user interaction.
The range or coverage of the system is similar to a VHF radios. The system
also has the advantage that VHF radio signals will travel around bends and
over islands giving better coverage than RADAR or enhancing a RADAR
picture when used together.
Benefits of AIS
Combined with radar, AIS gives you the best possible picture of
your situation in all conditions
2
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
A marine traffic coordinator using AIS and radar to manage vessel traffic.
3
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
An AIS equipped system onboard a ship presents the bearing and distance of
nearby vessels in a radar-like display format.
4
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
rate of turn indicator. Ships outside AIS radio range can be tracked with the
Long Range Identification and Tracking (LRIT) system with less frequent
transmission.
Collision avoidance
5
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
A vessel's text-only AIS display, listing nearby vessels' range, bearings, and
names
When a ship is navigating at sea, the movement and identity of other ships
in the vicinity is critical for navigators to make decisions to avoid collision
with other ships and dangers (shoal or rocks). Visual observation (unaided,
binoculars, night vision), audio exchanges (whistle, horns, VHF radio), and
radar or Automatic Radar Plotting Aid (ARPA) are historically used for this
purpose. However, a lack of positive identification of the targets on the
displays, and time delays and other limitation of radar for observing and
calculating the action and response of ships around, especially on busy
waters, sometimes prevent possible action in time to avoid collision.
While requirements of AIS are only to display a very basic text information,
the data obtained can be integrated with a graphical electronic chart or a
radar display, providing consolidated navigational information on a single
display.
In busy waters and harbors, a local Vessel Traffic Service (VTS) may exist to
manage ship traffic. Here, AIS provides additional traffic awareness and
provides the service with information on the kind of other ships and their
movement.
Aids to navigation
AIS was developed with the ability to broadcast positions and names of
objects other than vessels, like navigational aid and marker positions. These
aids can be located on shore, such as in a lighthouse, or on the water, on
platforms or buoys. The US Coast Guard suggests that AIS might replace
RACON, or radar beacons, currently used for electronic navigation aids.
The ability to broadcast navigational aid positions has also created the
concepts of Synthetic AIS and Virtual AIS. In the first case, an AIS
transmission describes the position of physical marker but the signal itself
originates from a transmitter located elsewhere. For example, an on-shore
base station might broadcast the position of ten floating channel markers,
each of which is too small to contain a transmitter itself. In the second case,
6
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
it can mean AIS transmissions that indicate a marker which does not exist
physically, or a concern which is not visible (i.e., submerged rocks, or a
wrecked ship). Although such virtual aids would only be visible to AIS
equipped ships, the low cost of maintaining them could lead to their usage
when physical markers are unavailable.
To aid SAR vessels and aircraft in locating people in distress a standard for
an AIS-SART AIS Search and Rescue Transmitter is currently being
developed by the International Electrotechnical Commission (IEC), the
standard is scheduled to be finished by the end of 2008 and AIS-SARTs will
be available on the market from 2009.
Accident Investigation
7
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
Other reference:
Binary messages
The Saint Lawrence Seaway uses AIS binary messages (message type 8) to
provide information about water levels, lock orders, and weather. The
Panama Canal uses AIS type 8 messages to provide information about rain
along the canal and wind in the locks.
Several computer programs have been created for use with AIS data. Some
programs (such as Ship Plotter and GNU AIS) use a computer to demodulate
the raw audio from a modified marine VHF radio telephone when tuned to
the AIS broadcast frequency (Channel 87 & 88) into AIS data. Some
programs can re-transmit the AIS information to a local or global network
allowing the public or authorized users to observe vessel traffic from the
web. Some programs display AIS data received from a dedicated AIS
receiver onto a computer or chart-plotter. Most of these programs are not
AIS transmitters, thus they will not broadcast your vessel's position but may
be used as an inexpensive alternative for smaller vessels to help aid
navigation and avoid collision with larger vessels that are required to
broadcast their position. Ship enthusiasts also use receivers to track and find
vessels to add to their photo collections.
AIS position data are available on the Internet through many privately
operated geographic information systems. In December 2004, the
International Maritime Organization's (IMO) Maritime Safety Committee
condemned the Internet publication of AIS data as follows:
Others [who?] have countered that AIS provides the same information that
can be obtained with a pair of binoculars and that ships have the option of
turning off AIS when they are in areas with security concerns.
In June 2008, ORBCOMM launched new low-earth orbit (LEO) satellites for
their machine-to-machine communications constellation. In parallel with
ORBCOMM's contract with the United States Coast Guard to launch its AIS
receiver-equipped Concept Demonstration Satellite (CDS), all of these new
satellites were equipped with AIS receivers. ORBCOMM became the first
commercial service provider of satellite AIS, having licensed satellite AIS
data service to qualified government and commercial subscribers since the
beginning of 2009. Additionally, ORBCOMM has incorporated AIS receivers in
its next 18 ORBCOMM Generation 2 (0G2) satellites under development. As
additional satellites are launched, ORBCOMM will increase its capability by
providing greater redundancy and more frequent updates of AIS data.
ORBCOMM's established terrestrial network of 15 Gateway Earth Stations
around the world ensures timely delivery of the satellite AIS data to its
subscribers.
On April 28, 2008, Canadian company COM DEV International, became the
first company to launch a space-based AIS nano-satellite designed to detect
AIS signals from space, and is currently deploying a full micro-satellite
constellation, global ground network and centralized data processing center
in order to offer global AIS data services. The service is operational and
available worldwide as of mid-2010 through exactEarth, COM DEV's data
services subsidiary. exactEarth uses a patent-pending ground and space-
based processing technology to minimize interference of collided AIS signals,
therefore dramatically improving detection compared with all other satellite-
9
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
based systems. As more satellites are launched, refresh rates will continue
to increase as well.
10
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
Class A AIS products are for ships over 300 tons or which are SOLAS vessels
and are required to meet the guidelines set out in the Marine Equipment
Directive.
Class B AIS products are for non-SOLAS vessels. They need testing and
certification under the R&TTE Directive for the European Union and FCC and
Industry Canada certification for North America.
Basic overview
Class A
11
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
Class B
Vessel mounted AIS transceiver (transmit and receive) which operates using
carrier-sense time-division multiple-access (CSTDMA). Class Bs transmit at
2 W and are not required to have an integrated display: Class Bs can be
connected to most display systems which the received messages will be
displayed in lists or overlayed on charts. Default transmit rate is normally
every 30 seconds, but this can be varied according to vessel speed or
instructions from base stations. The Class B type standard requires
integrated GPS and certain LED indicators. Class B equipment receives all
types of AIS messages.
12
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
AIS receivers are also available; these units will pick up broadcasts from
both Class A and Class B AIS transponders but don’t transmit their own
position. A receiver allows you to see the position of other vessels however
your position won’t be visible to them.
The following diagram shows what information each type of transponder will
receive from the other.
Please note that in the last example ‘Class B- Class A’ there are some
instances when a class A user may not see the name, call sign and vessel
type- however the users vessel will still be displayed in it’s correct position.
In this circumstance, the receiving vessels display may default to showing
the MMSI rather than the vessels name.
Base station
Shore based AIS transceiver (transmit and receive) which operates using
SOTDMA. Base stations have a complex set of features and functions which
in the AIS standard are able to control the AIS system and all devices
operating therein. Ability to interrogate individual transponders for status
reports and or transmit frequency changes.
Shore or buoy based transceiver (transmit and receive) which operates using
fixed-access time-division multiple-access (FATDMA). Designed to collect
and transmit data related to sea and weather conditions as well as relay AIS
messages to extend network coverage.
AIS receivers are not specified in the AIS standards, because they do not
transmit. The main threat to the integrity of any AIS system are non-
compliant AIS transmissions, hence careful specifications of all transmitting
AIS devices. However, it is well to note that AIS transponders all transmit on
multiple channels as required by the AIS standards. As such single-channel,
or multiplexed, receivers will not receive all AIS messages. Only dual-
channel receivers will receive all AIS messages. (Class A)
13
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
Each AIS transponder consists of one VHF transmitter, two VHF TDMA
receivers, one VHF Digital Selective Calling (DSC) receiver, and links to
shipboard display and sensor systems via standard marine electronic
communications (such as NMEA 0183, also known as IEC 61162). Timing is
vital to the proper synchronization and slot mapping (transmission
scheduling) for a Class A unit. Therefore, every unit is required to have an
internal time base, synchronized to a global navigation satellite system (e.g.
GPS) receiver. This internal receiver may also be used for position
information. However, position is typically provided by an external receiver
such as GPS, LORAN or an inertial navigation system and the internal
receiver is only used as a backup for position information. Other information
broadcast by the AIS, if available, is electronically obtained from shipboard
equipment through standard marine data connections. Heading information,
position (latitude and longitude), "speed over ground", and rate of turn are
normally provided by all ships equipped with AIS. Other information, such as
angle of heel, pitch and roll, destination, and ETA may also be provided.
original patent on March 30, 2010. In order to make the most efficient use of
the bandwidth available, vessels that are anchored or moving slowly
transmit less frequently than those that are moving faster or are
maneuvering. The update rate ranges from 3 minutes for anchored or
moored vessels, to 2 seconds for fast moving or maneuvering vessels, the
latter being similar to that of conventional marine radar.
Each AIS station determines its own transmission schedule (slot), based
upon data link traffic history and an awareness of probable future actions by
other stations. A position report from one station fits into one of 2,250 time
slots established every 60 seconds on each frequency. AIS stations
continuously synchronize themselves to each other, to avoid overlap of slot
transmissions. Slot selection by an AIS station is randomized within a
defined interval and tagged with a random timeout of between 0 and 8
frames. When a station changes its slot assignment, it announces both the
new location and the timeout for that location. In this way new stations,
including those stations which suddenly come within radio range close to
other vessels, will always be received by those vessels.
15
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
Shore-based AIS network systems are now being built up around the world.
One of the biggest fully operational, real time systems with full routing
capability is in China. This system was built between 2003 and 2007 and
was delivered by Saab TransponderTech. The entire Chinese coastline is
covered with approximately 250 base stations in hot-standby configurations
including 70 computer servers in three main regions. Hundreds of shore
based users, including about 25 VTS centers, are connected to the network
and are able to see the maritime picture, and can also communicate with
each ship using SRM's (Safety Related Messages). All data are in real time.
The system was designed to improve the safety and security of ships and
port facilities. It is also designed according to an SOA architecture with
socket based connection and using IEC AIS standardized protocol all the way
to the VTS users. The base stations have hot-standby units (IEC 62320-1)
and the network is the third generation network solution.
By the beginning of 2007, a new worldwide standard for AIS base stations
was approved, the IEC 62320-1 standard. The old IALA recommendation and
the new IEC 62320-1 standard are in some functions incompatible, and
therefore attached network solutions have to be upgraded. This will not
affect users, but system builders need to upgrade software to accommodate
the new standard. A standard for AIS base stations has been long awaited.
Currently many ad-hoc networks exist with class A mobiles. Base stations
can control the AIS message traffic in a region, which will hopefully reduce
the number of packet collisions.
Broadcast information
The vessel's Maritime Mobile Service Identity (MMSI) – a unique nine digit
identification number.
16
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
Navigation status – "at anchor", "under way using engine(s)", "not under
command", etc.
Positional accuracy:
Time stamp – UTC time accurate to the nearest second when these data
were generated
Type of ship/cargo
17
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
At the time of writing (November 2009) almost all Class B units use boards
from Software Radio Technology (SRT). Exceptions to this are Furuno and
AMEC.
This message is sent every 3 minutes where speed over ground (SOG) is
less than 2 knots, or every 30 seconds for greater speeds.
This message was designed for the SOTDMA protocol, and is too long to be
transmitted as CSTDMA. However a coast station can poll the transponder
for this message to be sent.
MMSI, time, SOG, COG, longitude, latitude, true heading, ship type,
dimensions.
18
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
This message is sent every 6 minutes, the same time interval as for Class A
transponders. Because of its length, this message is divided into two parts,
sent within one minute of each other.
Note that this message was defined after the original AIS specifications, so
some Class A units may need a firmware upgrade to be able to decode this
message.
MMSI, boat name, ship type, call sign, dimensions, and equipment vendor
id.
19
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
20
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
The first use of a transponder was onboard an aircraft during World War II,
as part of the Identify Friend or Foe (IFF) system. By answering secret
interrogation frequencies, pilots could indicate to radar operators that they
were friendly aircraft.
21
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
transponders, which operators will use to locate their vehicle in the event of
an emergency.
Cellular phones use a similar, albeit smaller, chip to send the phone's
location if it used to call an emergency number. Even casual television
viewing often involves the use of transponders. A network can uplink their
ground-based satellites to communications satellites orbiting the Earth, send
multiple channels of digitally compressed video and audio to a single
transponder onboard it, and local stations can then pick up the program and
re-broadcast it locally by aiming the appropriate ground-based dish.
As the world becomes more connected to the “Internet of Things”, Trend Micro’s Forward Looking
Threat researchers continue to look into technologies that could be abused by attackers in the near
future. Earlier today at the HITB security conference in Kuala Lumpur, , two researchers from this team
(Kyle Wilhoit and Dr. Marco Balduzzi), together with independent researcher Alessandro Pasta,
presented a series of experiments that showed AIS is comprehensively vulnerable to a wide range of
attacks that could be easily carried out by pirates, terrorists or other attackers. Trend Micro took care to
carry out responsible disclosure to all of the major standard bodies involved in AIS, as well as major
online providers of AIS tracking information.
The attacks can be divided into two parts. Firstly, we discovered that the main AIS Internet providers
that collect AIS information and distribute them publicly have vulnerabilities that allow an attacker to
tamper with valid AIS data and inject invalid AIS data, such as:
Modification of all ship details such as position, course, cargo, flagged country, speed, name,
MMSI (Mobile Maritime Service Identity) status etc.
Creation of fake vessels with all the same details e.g. having an Iranian vessel with nuclear cargo
show up off the coast of the US
Create and modify Aid to Navigations (AToN) entries, such as buoys and lighthouses. This leads
to scenarios such as blocking the entrance to a harbor, causing a ship to wreck, etc.
Create and modify search and rescue marine aircraft such as helicopters, and light aircraft e.g.
having a stationary search and rescue coast guard helicopter “take off” and travel on a set
course.
Secondly, we have also discovered flaws in the actual specification of the AIS protocol used by hardware
transceivers in all mandatory vessels. In addition to the above threats, we have proven additional
scenarios:
22
AIS (AUTOMATIC IDENTIFICATION SYSTEM)
Impersonate marine authorities to permanently disable the AIS system on a vessel, both forcing
the ship to stop communicating its position, and stop getting AIS notifications from all nearby
vessels (essentially a denial of service attack). This can also be tagged to a geographical area e.g.
as soon as ship enters Somalia sea space it vanishes of AIS, but the pirates who carried out the
attack can still see it.
Fake a “man-in-the-water” distress beacon at any location that will also trigger alarms on all
vessel within approximately 50 km.
Fake a CPA alert (Closest Point of Approach) and trigger a collision warning alert. In some cases this can
even cause software on the vessel to recalculate a course to avoid collision, allowing an attacker to
physically nudge a boat in a certain direction.
All of this is made possible because the AIS protocol was designed with seemingly zero security
considerations. In particular, we noted the following major issues:
Lack of Validity Checks. It is possible to send an AIS message from any location for a vessel at
another location e.g. you can send a message from a location near New York for a vessel that
claims to be in the Gulf of Mexico, and it will be accepted without question. No geographical
validity checks are carried out.
Lack of Timing Checks. It is also possible to replay existing (valid) AIS information, because no
timestamp information is included in the message e.g. you can replicate the position of a vessel.
Lack of Authentication. There is no authentication built into the AIS protocol. That means that
anyone who can craft an AIS packet can impersonate any other vessel on the planet, and all
receiving vessels will treat the message as fact.
Lack of Integrity Checks. All AIS messages are sent in an unencrypted and unsigned form, making
them trivial to intercept and modify.
While all the attacks we described above were carried out in our dedicated test lab setup – where we
used specific software defined radio equipment – we have also proven that an attacker is able to carry
out such attacks using a modified standard, easy to obtain VHF radio which costs approximately €150, or
approximately US$200.
Fixing the flaws in AIS is not trivial, as they exist right down to the core of the protocol. Even if the AIS
internet providers altered their sites, the underlying protocol is still open to lots of abuse. At a
minimum, a new version of AIS would need to incorporate defences for the three core issues outlined:
validity, authentication and encryption. We are fully aware that the costs to update AIS on all vessels is
high – but in the light of threats such as piracy and terrorism, there really are no alternatives.
23