Secure BLE Interface for Connected Aircraft Systems

In next generation integrated avionics, a key requirement is enabling Bluetooth Low Energy (BLE) connectivity between the pilot’s handheld devices such as iPhones, Electronic Flight Bag (EFB) and avionics systems to enable real time intuitive features such as audio/call streaming and mission management, including pilot based control (e.g., track selection, pause/play/stop, call pickup/disconnect), safe audio prioritization during ATC communications, and bidirectional exchange of mission critical data (alternate flight plans, operational procedures, tactical scenarios, SOPs) via an Avionics IoT Gateway. However, BLE- which is designed for consumer use cases lacks robust, built in security and remains vulnerable to attacks (e.g., DDoS), with reliability for mission critical aerospace not fully validated. Our threat modelling (attack tree) across eight BLE phases which includes device discovery, gateway advertisement, EFB pairing/bonding, connection management, pilot data exchange, disconnection/reconnection - identifies at least 23 significant attack vectors spanning advertisement through application data exchange, including risks of sensitive data exfiltration by nearby intruders and malicious mission data injection affecting flight safety. To address these challenges, we propose a novel Defence in Depth (DID) security architecture for the BLE interface between the pilot’s devices and the integrated avionics suite, combining hidden advertisements, secure pairing, device whitelisting, passive scanning, encrypted communications, stringent access control, secure key storage, robust connection management, and real time monitoring using secure keys. Effectiveness is quantified via an Overall Security Metric (OSM) over Secure Pairing Strength, Data Confidentiality, Integrity Protection, System Reliability, and Attack Surface Exposure, ensuring the product exceeds a defined threshold; the design enforces fail safe behaviour (e.g., suppressing audio playback during ATC) to prioritize mission critical functions. The architecture reduces BLE attack surface through minimized service exposure and continuous authentication/integrity checks, aligning with DO 326A and DO 356A for prevention, detection, and mitigation. An experimental aircraft bench with an Avionics IoT Gateway, SATCOM router, pilot EFBs, and cloud services (real time weather/wind/traffic via ADS B) demonstrates secure pairing, bidirectional data exchange, and resilience under multiple penetration tests using off the shelf sniffers, collected gateway logs confirm the DID’s effectiveness across flight phases. In summary, the proposed DID not only defends against diverse BLE attacks but also enables a broader set of secure avionics use cases.