Signal Jamming Attacks Against Communication-Based Train Control: Attack Impact and Countermeasure

TL;DR

This paper analyzes the impact of signal jamming on communication-based train control systems and proposes a frequency hopping spread spectrum countermeasure, including a prototype implementation, to mitigate attack effects and improve system resilience.

Contribution

It introduces a detailed impact analysis of jamming attacks on CBTC systems and develops a novel FHSS-based countermeasure tailored for leaky-medium communication infrastructure.

Findings

Jamming significantly increases train journey times and passenger congestion.

The proposed FHSS countermeasure effectively reduces the impact of jamming attacks.

Prototype implementation demonstrates feasibility of the proposed solution.

Abstract

We study the impact of signal jamming attacks against the communication based train control (CBTC) systems and develop the countermeasures to limit the attacks' impact. CBTC supports the train operation automation and moving-block signaling, which improves the transport efficiency. We consider an attacker jamming the wireless communication between the trains or the train to wayside access point, which can disable CBTC and the corresponding benefits. In contrast to prior work studying jamming only at the physical or link layer, we study the real impact of such attacks on end users, namely train journey time and passenger congestion. Our analysis employs a detailed model of leaky medium-based communication system (leaky waveguide or leaky feeder/coaxial cable) popularly used in CBTC systems. To counteract the jamming attacks, we develop a mitigation approach based on frequency hopping spread spectrum taking into account domain-specific structure of the leaky-medium CBTC systems. Specifically, compared with existing implementations of FHSS, we apply FHSS not only between the transmitter-receiver pair but also at the track-side repeaters. To demonstrate the feasibility of implementing this technology in CBTC systems, we develop a FHSS repeater prototype using software-defined radios on both leaky-medium and open-air (free-wave) channels. We perform extensive simulations driven by realistic running profiles of trains and real-world passenger data to provide insights into the jamming attack's impact and the effectiveness of the proposed countermeasure.