HTT Consulting

Oak Park MI 48237 USA rgm@labs.htt-consult.com

AX Enterprize

4947 Commercial Drive Yorkville NY 13495 USA adam.wiethuechter@axenterprize.com

Internet DRIP RFC This document describes a way for an Internet connected device to forward/proxy received Broadcast Remote ID to Network Remote ID using UAS Traffic Management (UTM) Supplemental Data Service Providers (SDSPs). This enables more comprehensive situational awareness and reporting of Unmanned Aircraft (UA) in a “crowd sourced” manner.

Note: This document is directly related and builds from . That draft is a “top, down” approach to understand the concept and high level design. This document is a “bottom, up” implementation of the CS-RID concept. The content of this draft is subject to change and adapt as further development continues. This document defines a mechanism to capture Broadcast Remote ID (RID) messages on any Internet connected device that receives them and can forward them to the Supplemental Data Service Providers (SDSPs) responsible for the geographic area the UA and receivers are in. This data can be aggregated and further decimated to other entities in Unmanned Aircraft Systems (UAS) Traffic Management (UTM) using Network RID . These Internet connected devices are herein called “Finders”, as they find UAs by listening for Broadcast RID. The Finders are Broadcast RID forwarding proxies. Their potentially limited spacial view of RID messages could result in bad decisions on what messages to send to the SDSP and which to drop. Thus they will send all received messages and the SDSP will make any filtering decisions in what it forwards into the UTM. Finders can be smartphones, tablets, connected cars, CS-RID special purpose devices or any computing platform with Internet connectivity that can meet the requirements defined in this document. It is not expected, nor necessary, that Finders have any information about a UAS beyond the content found in Broadcast RID. Finders MAY only need a loose association with SDSPs. The SDSP MAY require a stronger relationship to the Finders. The relationship MAY be completely open, but still authenticated to requiring encryption. The transport MAY be client-server based (using things like HIP or DTLS) to client push (using things like UDP or HTTPS).

The DRIP Architecture introduces the basic CS-RID entities including CS-RID Finder and SDSP. This document has minimal information about the actions of SDSPs. In general the SDSP is out of scope of this document. That said, the SDSPs should not simply proxy cast RID messages to their UTM(s). They should perform some minimal level of filtering and content checking before forwarding those messages that pass these tests in a secure manner to the UTM(s). The SDSPs are also capable of maintaining a monitoring map, based on location of active Finders. UTMs may use this information to notify authorized observers of where there is and there is not monitoring coverage. They may also use this information of where to place pro-active monitoring coverage. An SDSP should only forward Authenticated messages like those defined in to the UTM(s). Further, the SDSP SHOULD validate the RID and the Authentication signature before forwarding anything from the UA, and flagging those RIDs that were not validated. The SDSP MAY forward all Broadcast RID messages to the UTM, leaving all decision making on Broadcast messages veracity to the receiving UTM entity. When 3 or more Finders are reporting to an SDSP on a specific UA, the SDSP is in a unique position to perform multilateration on these messages and compute the Finder’s view of the UA location to compare with the UA Location/Vector messages. This check against the UA’s location claims is both a validation on the UA’s reliability as well as the trustworthiness of the Finders. Other than providing data to allow for multilateration, this SDSP feature is out of scope of this document. This function is limited by the location accuracy for both the Finders and UA.

The key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “NOT RECOMMENDED”, “MAY”, and “OPTIONAL” in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here. This document uses terms defined in and .

Elliptic Curve Integrated Encryption Scheme. A hybrid encryption scheme which provides semantic security against an adversary who is allowed to use chosen-plaintext and chosen-ciphertext attacks. In Internet connected device that can receive Broadcast RID messages and forward them to a SDSP. Multilateration (more completely, pseudo range multilateration) is a navigation and surveillance technique based on measurement of the times of arrival (TOAs) of energy waves (radio, acoustic, seismic, etc.) having a known propagation speed.

Broadcast and Network RID formats are both defined in using the same data dictionary. Network RID is specified in JSON sent over HTTPS while Broadcast RID is byte structures sent over wireless links.

Advantages over Network RID include: more readily be implemented directly in the UA. Network RID will more frequently be provided by the GCS or a pilot’s Internet connected device. If Command and Control (C2) is bi-directional over a direct radio connection, Broadcast RID could be a straight-forward addition. Small IoT devices can be mounted on UA to provide Broadcast RID. also be used by the UA to assist in Detect and Avoid (DAA). is available to observers even in situations with no Internet like natural disaster situations.

The USA Federal Aviation Authority (FAA), in the January 2021 Remote ID Final rule , postponed Network Remote ID and focused on Broadcast Remote ID. This was in response to the UAS vendors comments that Network RID places considerable demands on then currently used UAS. However, Network RID, or equivalent, is necessary for UTM knowing what soon may be in an airspace and is mandated as required in the EU. A method that proxies Broadcast RID into UTM can function as an interim approach to Network RID and continue adjacent to Network RID.

When a proxy is introduced in any communication protocol, there is a risk of corrupted data and DOS attacks. The Finders, in their role as proxies for Broadcast RID, SHOULD be authenticated to the SDSP (see ). The SDSP can compare the information from multiple Finders to isolate a Finder sending fraudulent information. SDSPs can additionally verify authenticated messages that follow . The SPDP can manage the number of Finders in an area (see ) to limit DOS attacks from a group of clustered Finders.

The strongest defense against fraudulent RID messages is to focus on conforming messages. Unless this behavior is mandated, an SDSP will have to use assorted algorithms to isolate messages of questionable content.

SDSPs and Finders SHOULD use EdDSA keys as their trusted Identities. The public keys SHOULD be registered DRIP UAS Remote ID (DETs) and . Other similar methods may be used. During this registration, the Finder gets the SDSP’s EdDSA Public Key. These Public Keys allow for the following options for authenticated messaging from the Finder to the SDSP. The SDSP uses some process (out of scope here) to register the Finders and their EdDSA Public Key. During this registration, the Finder gets the SDSP’s EdDSA Public Key. These Public Keys allow for the following options for authenticated messaging from the Finder to the SDSP. EdDSA keys are converted to X25519 keys per Curve25519 to use in ECIES. ECIES can be used with a unique nonce to authenticate each message sent from a Finder to the SDSP. ECIES can be used at the start of some period (e.g. day) to establish a shared secret that is then used to authenticate each message sent from a Finder to the SDSP sent during that period. HIP can be used to establish a session secret that is then used with ESP to authenticate each message sent from a Finder to the SDSP. DTLS can be used to establish a secure connection that is then used to authenticate each message sent from a Finder to the SDSP.

The Finders are regularly providing their SDSP with their location. This is through the Broadcast RID Proxy Messages and Finder Location Update Messages. With this information, the SDSP can maintain a monitoring map. That is a map of where there Finder coverage.

Finder density will vary over time and space. For example, sidewalks outside an urban train station can be packed with pedestrians at rush hour, either coming or going to their commute trains. An SDSP may want to proactively limit the number of active Finders in such situations. Using the Finder mapping feature, the SDSP can instruct Finders to NOT proxy Broadcast RID messages. These Finders will continue to report their location and through that reporting, the SDSP can instruct them to again take on the proxying role. For example a Finder moving slowly along with dozens of other slow-moving Finders may be instructed to suspend proxying. Whereas a fast-moving Finder at the same location (perhaps a connected car or a pedestrian on a bus) would not be asked to suspend proxying as it will soon be out of the congested area.

The CS-RID model is for Finders to send “batch reports” () to one or more SDSPs they have a relationship with. This relationship can be highly anonymous with little prior knowledge of the Finder (({unidirectional})) to very well defined and pre-established ().

is the report object, defined in CDDL, that is translated and adapted depending on the specific transport. It carries a batch of detections (up to a max of 10), the CDDL definition of which is shown in .

Examples of various translations can be found in .

Author Note: Section Title is WIP, suggestions welcome The unidirectional variant can allow for anonymous (non-strongly-authenticated) Finders to make reports to a publicly known SDSP endpoint. This is attractive for implementation to be lightweight, easy to deploy and use, such as over an open HTTPS API. Many clients (who run Finders in their software) may not be worried of being tracked for sending such reports. It is recommended to use bare EdDSA25519 keypairs during the interactions as keys are expected to change frequently and DETs would allow for long term tracking of Finders.

Use as CBOR/JSON.

Use as CBOR.

Author Note: Section Title is WIP, suggestions welcome The bidirectional variant imposes a strong authentication and Finder onboarding process. It is attractive for well defined deployments of CS-RID, such as being used for area security. Implementations are RECOMMENDED to use HIP or DTLS with a DET as their primary identity. A CS-RID SDSP SHOULD allow for any valid registered DET to report to it. Send as CBOR. Bidirectionally also gives an added benefit of sending various commands to Finders to alter their behavior with the relationship. Unlike where there is no control of the Finder behavior.

Defined all in CDDL. Adapted accordingly to given transport.

Same as but removes the lat/lon/alt from detections as stored and updated separately.

Provides the lat/lon/alt of the Finder.

Enables SDSP to negotiate changes to Finder parameters such as detection_count maximum.

Enabled SDSP to give “smarter” Finders filtering conditions of detections to be sent back to the SDSP.

TODO

TODO

TBD

TBD

TBD

The Crowd Sourcing idea in this document came from the Apple “Find My Device” presentation at the International Association for Cryptographic Research’s Real World Crypto 2020 conference.

HTT Consulting AX Enterprize AX Enterprize Intel Fraunhofer SIT This document describes using the ASTM Broadcast Remote ID (B-RID) specification in a "crowd sourced" smart phone or fixed receiver asset environment to provide much of the ASTM and FAA envisioned Network Remote ID (Net-RID) functionality. This crowd sourced B-RID (CS-RID) data will use multilateration to add a level of reliability in the location data on the Unmanned Aircraft (UA). The crowd sourced environment will also provide a monitoring coverage map to authorized observers. This document proposes a notational convention to express Concise Binary Object Representation (CBOR) data structures (RFC 7049). Its main goal is to provide an easy and unambiguous way to express structures for protocol messages and data formats that use CBOR or JSON. This document defines terminology and requirements for solutions produced by the Drone Remote Identification Protocol (DRIP) Working Group. These solutions will support Unmanned Aircraft System Remote Identification and tracking (UAS RID) for security, safety, and other purposes (e.g., initiation of identity-based network sessions supporting UAS applications). DRIP will facilitate use of existing Internet resources to support RID and to enable enhanced related services, and it will enable online and offline verification that RID information is trustworthy. Concise Binary Object Representation (CBOR) is a data format designed for small code size and small message size. There is a need for the ability to have basic security services defined for this data format. This document defines the CBOR Object Signing and Encryption (COSE) protocol. This specification describes how to create and process signatures, message authentication codes, and encryption using CBOR for serialization. This specification additionally describes how to represent cryptographic keys using CBOR. In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. AX Enterprize, LLC AX Enterprize, LLC HTT Consulting This document describes how to add trust into the Broadcast Remote ID (RID) specification discussed in the DRIP Architecture; first trust in the RID ownership and second in the source of the RID messages. The document defines message types and associated formats (sent within the Authentication Message) that can be used to authenticate past messages sent by an unmanned aircraft (UA) and provide proof of UA trustworthiness even in the absence of Internet connectivity at the receiving node. AX Enterprize, LLC RTFM llp This document describes the high level architecture for the registration and discovery of DRIP Entity Tags (DETs) using DNS. Discovery of DETs and their artifacts are through DRIP specific DNS structures and standard DNS methods. A general overview of the interfaces required between involved components is described in this document with future supporting documents giving technical specifications. AX Enterprize AX Enterprize HTT Consulting Intel Linköping University This document describes an architecture for protocols and services to support Unmanned Aircraft System (UAS) Remote Identification (RID) and tracking, plus UAS RID-related communications. This architecture adheres to the requirements listed in the DRIP Requirements document (RFC 9153). This document specifies the use of Datagram Transport Layer Security (DTLS) over the Datagram Congestion Control Protocol (DCCP). DTLS provides communications privacy for applications that use datagram transport protocols and allows client/server applications to communicate in a way that is designed to prevent eavesdropping and detect tampering or message forgery. DCCP is a transport protocol that provides a congestion-controlled unreliable datagram service. [STANDARDS-TRACK] This document describes an updated version of the Encapsulating Security Payload (ESP) protocol, which is designed to provide a mix of security services in IPv4 and IPv6. ESP is used to provide confidentiality, data origin authentication, connectionless integrity, an anti-replay service (a form of partial sequence integrity), and limited traffic flow confidentiality. This document obsoletes RFC 2406 (November 1998). [STANDARDS-TRACK] This document specifies the details of the Host Identity Protocol (HIP). HIP allows consenting hosts to securely establish and maintain shared IP-layer state, allowing separation of the identifier and locator roles of IP addresses, thereby enabling continuity of communications across IP address changes. HIP is based on a Diffie-Hellman key exchange, using public key identifiers from a new Host Identity namespace for mutual peer authentication. The protocol is designed to be resistant to denial-of-service (DoS) and man-in-the-middle (MitM) attacks. When used together with another suitable security protocol, such as the Encapsulating Security Payload (ESP), it provides integrity protection and optional encryption for upper-layer protocols, such as TCP and UDP. This document obsoletes RFC 5201 and addresses the concerns raised by the IESG, particularly that of crypto agility. It also incorporates lessons learned from the implementations of RFC 5201. The Concise Binary Object Representation (CBOR) is a data format whose design goals include the possibility of extremely small code size, fairly small message size, and extensibility without the need for version negotiation. These design goals make it different from earlier binary serializations such as ASN.1 and MessagePack. The Constrained Application Protocol (CoAP) is a specialized web transfer protocol for use with constrained nodes and constrained (e.g., low-power, lossy) networks. The nodes often have 8-bit microcontrollers with small amounts of ROM and RAM, while constrained networks such as IPv6 over Low-Power Wireless Personal Area Networks (6LoWPANs) often have high packet error rates and a typical throughput of 10s of kbit/s. The protocol is designed for machine- to-machine (M2M) applications such as smart energy and building automation. CoAP provides a request/response interaction model between application endpoints, supports built-in discovery of services and resources, and includes key concepts of the Web such as URIs and Internet media types. CoAP is designed to easily interface with HTTP for integration with the Web while meeting specialized requirements such as multicast support, very low overhead, and simplicity for constrained environments. This memo specifies two elliptic curves over prime fields that offer a high level of practical security in cryptographic applications, including Transport Layer Security (TLS). These curves are intended to operate at the ~128-bit and ~224-bit security level, respectively, and are generated deterministically based on a list of required properties. This document describes elliptic curve signature scheme Edwards-curve Digital Signature Algorithm (EdDSA). The algorithm is instantiated with recommended parameters for the edwards25519 and edwards448 curves. An example implementation and test vectors are provided. This document describes the use of Hierarchical Host Identity Tags (HHITs) as self-asserting IPv6 addresses, which makes them trustable identifiers for use in Unmanned Aircraft System Remote Identification (UAS RID) and tracking. Within the context of RID, HHITs will be called DRIP Entity Tags (DETs). HHITs provide claims to the included explicit hierarchy that provides registry (via, for example, DNS, RDAP) discovery for third-party identifier endorsement. This document updates RFCs 7401 and 7343. ASTM International United States Federal Aviation Administration (FAA) Unknown

Single-band, consumer grade, GPS on small platforms is not accurate, particularly for altitude. Longitude/latitude measurements can easily be off by 3M based on satellite position and clock accuracy. Altitude accuracy is reported in product spec sheets and actual tests to be 3x less accurate. Altitude accuracy is hindered by ionosphere activity. In fact, there are studies of ionospheric events (e.g. 2015 St. Patrick’s day ) as measured by GPS devices at known locations. Thus where a UA reports it is rarely accurate, but may be accurate enough to map to visual sightings of single UA. Smartphones and particularly smartwatches are plagued with the same challenge, though some of these can combine other information like cell tower data to improve location accuracy. FCC E911 accuracy, by FCC rules is NOT available to non-E911 applications due to privacy concerns, but general higher accuracy is found on some smart devices than reported for consumer UA. The SDSP MAY have information on the Finder location accuracy that it can use in calculating the accuracy of a multilaterated location value. When the Finders are fixed assets, the SDSP may have very high trust in their location for trusting the multilateration calculation over the UA reported location.

If the Finder has LIDAR or similar detection equipment (e.g. on a connected car) that has full sky coverage, the Finder can use this equipment to locate UAs in its airspace. The Finder would then be able to detect non-participating UAs. A non-participating UA is one that the Finder can “see” with the LIDAR, but not “hear” any Broadcast RID messages. These Finders would then take the LIDAR data, construct appropriate Broadcast RID messages, and forward them to the SDSP as any real Broadcast RID messages. There is an open issue as what to use for the actual RemoteID and MAC address. The SDSP would do the work of linking information on a non-participating UA that it has received from multiple Finders with LIDAR detection. In doing so, it would have to select a RemoteID to use. A seemingly non-participating UA may actually be a UA that is beyond range for its Broadcast RID but in the LIDAR range. This would provide valuable information to SDSPs to forward to UTMs on potential at-risk situations. At this time, research on LIDAR and other detection technology is needed. there are full-sky LIDAR for automotive use with ranges varying from 20M to 250M. Would more than UA location information be available? What information can be sent in a CS-RID message for such “unmarked” UAs?

The SDSP can confirm/correct the UA location provided in the Location/Vector message by using multilateration on data provided by at least 3 Finders that reported a specific Location/Vector message (Note that 4 Finders are needed to get altitude sign correctly). In fact, the SDSP can calculate the UA location from 3 observations of any Broadcast RID message. This is of particular value if the UA is only within reception range of the Finders for messages other than the Location/Vector message. This feature is of particular value when the Finders are fixed assets with highly reliable GPS location, around a high value site like an airport or large public venue.