In modern rail transport systems, balises are widely used to exchange track–train information via air-gap interface. In this paper, we first present the vulnerabilities on the standard balise air-gap interface, and then conduct vulnerability simulations using the system parameters that were specified in the European Train Control System. The simulation results show that the vulnerabilities can be exploited to launch effective and practical attacks, which could lead to catastrophic consequences, such as train derailment or collision. To mitigate the vulnerabilities and attacks, we propose to implement a challenge–response authentication process in the air-gap interface in the existing transport infrastructure.

https://ink.library.smu.edu.sg/cgi/viewcontent.cgi?article=4819&context=sis_research

Vulnerabilities, Attacks, and Countermeasures in Balise-Based Train Control Systems

Balise is a popular wayside device to provide accurate location information for subway station parking by sending telegrams to passing trains. By craftily disturbing wireless signals of balise telegrams, this paper proposes three attacks that may make passengers fall and even cause injury. Concretely, the first attack is to jam telegrams such that balises cannot be detected by a passing train; the second attack changes the location of transmitting telegrams by jamming and replaying; and the third attack is to change the total time of transmitting telegrams. All the attacks exploit the train localization mechanism such that a passing train localizes its position inaccurately and then takes improper control actions. Furthermore, since these attacks are independent, they can be launched at the same time to achieve advanced attacks. As the attacks do not require to tamper with the balises, they can be launched easily. Our simulations demonstrate the effectiveness of the proposed attacks. To defeat these attacks, the received telegrams need be verified by a train based on fidelity of telegram data.

https://ink.library.smu.edu.sg/cgi/viewcontent.cgi?article=5225&context=sis_research

Position Manipulation Attacks to Balise-Based Train Automatic Stop Control

With the rapid development of wireless communications, passengers are able to surf the internet on the subway trains through mobile communication systems, even wireless local area networks (WLAN). That leads to communications-based train control (CBTC) systems interfered by WLAN equipments in the carriage due to working on the same frequency (2.4GHz frequency band). In this paper, we evaluate the interference from WLAN equipments for the spatial deployment for CBTC systems. To investigate the impact of the carriage to radio propagation, the test on the shielding effectiveness of the carriage is carried out and also verifies the simulation results based on ray-tracing method. Then, multiple spatial deployment scenarios for access points (APs) and mobile radios (MRs) of CBTC systems are investigated on anti-interference to WLAN equipments, respectively. From the analysis, the suggestions of the deployment for APs and MRs are provided.

Evaluation on anti-interference to WLAN equipments for spatial deployment of CBTC systems in tunnels

Live video programs can bring in better travel experience for subway passengers and earn abundant advertisement revenue for subway operators. However, because the train-trackside channels for video dissemination are easily accessible to anyone, the video traffic are vulnerable to attacks, which may cause deadly tragedies. This paper presents a situation-aware authenticated video broadcasting scheme in the railway network, which consists of train, on-board sensor, trackside global system for mobile communications-railway (GSM-R) device, WiFi access point (AP), and train control center. Specifically, the scheme has four modules: 1) a train uses its on-board sensors to obtain its speed, location, and received signal strength indicator of train-trackside WiFi channel; 2) the train reports these real-time measurements to the railway control center with the legacy GSM-R networks; 3) according to the measurements, the control center or its WiFi AP adaptively customizes the protected codestream bitrate and AP-train handover time; and 4) the train renders the received codestream, which passes the authenticity verification process. As shown in the performance analysis, the present scheme ensures the codestream authenticity and provides high quality of service in the lossy subway WiFi environment.

https://ink.library.smu.edu.sg/cgi/viewcontent.cgi?article=5101&context=sis_research

Situation-Aware Authenticated Video Broadcasting Over Train-Trackside WiFi Networks

As a key component of urban rail transit systems, communications-based train control (CBTC) is an automated train control system using train-ground communications to ensure efficient operation of rail vehicles. In addition to CBTC systems, passenger information systems (PISs) are adopted in urban rail transit systems to improve quality of service (QoS) offered to customers. The interference between CBTC systems and PISs is an important factor impacting QoS of both CBTC systems and PISs. With recent advances in cognitive dynamic systems, in this paper, we take a cognitive control approach to interference mitigation considering the co-existence of CBTC systems and PISs. In our cognitive control approach, the notion of information gap is adopted to quantitatively describe effects of interference on CBTC. The wireless channel is modeled as a finite-state Markov chain with multiple state transition probability matrices, which are derived from real field measurements. Simulation results show that the proposed cognitive control approach can significantly improve performance of CBTC train-ground communications under interference from co-existing PISs.

/pdf/a-cognitive-control-approach-to-interference-mitigation-in-2gfbvgnokn.pdf

A cognitive control approach to interference mitigation in communications-based train control (CBTC) co-existing with passenger information systems (PISs)

A new portable and mobile relay device called MiFi which can provide personal Wi-Fi access with the aid of the cellular networks as the backhaul becomes increasing popular. However, as MiFi can be deployed without operators' planning, the devices can cause interference problems when they are brought in subway carriages. Hence, to investigate the interference on the Communication Based Train Control (CBTC) system imposed by MiFi devices, the coexistence scenario and system models are proposed. Based on the models, the performance loss of the CBTC downlink and the effectiveness of a proposed anti-interference algorithm with the Constant Contention Window (CCW) Distributed Coordination Function (DCF) protocol are studied. Research results show that the metro train indeed may be forced to stop by MiFi devices with the growth of the MiFi devices and the MiFi Data Frame Length (DFL). Additionally, our anti-interference algorithm can reduce the performance loss of the CBTC system without any change of the existing CBTC hardware equipments.

Study on coexistence and anti-interference solution for subway CBTC system and MiFi devices

Abstract Secondary organic aerosol (SOA) represents a major fraction of atmospheric fine particles. Both biogenic and anthropogenic volatile organic compounds (VOCs) can contribute to SOA through (photo-) oxidation. However, the current understanding of their combined, interactive effect on SOA formation and composition is still limited, challenging the accuracy in assessing global SOA budget, sources, and climate effect. Here we combine laboratory experiments and modelling to show that isoprene can suppress SOA formation from photo-oxidation of anthropogenic aromatics (toluene and p -xylene) with the presence of NO x , and similar SOA suppression phenomena are observed when replacing isoprene with propene. We find that the decreased SOA in such mixed-VOC conditions can be largely attributed to OH scavenging effect, resulting in reduced consumption of parent aromatics. However, various changes in SOA oxidation state (i.e., O/C) and oxidation pathways (i.e., more carbonyls formation) are observed following addition of isoprene, and the SOA chemical composition may not be similar to any single parent hydrocarbon, which implies the existence of complex interactions between the degradation chemistry for alkenes and aromatics. Under the conditions of this work, the OH scavenging effect is largely determined by gas-phase chemistry, which is expected to be widespread in binary or more complex systems in ambient air. More broadly, we infer that the global budget of anthropogenic SOA and its corresponding radiative forcing could be affected by biogenic emission of isoprene, particularly in urban environments with appreciable vegetation coverage. 

/pdf/suppression-of-anthropogenic-secondary-organic-aerosol-1ubw0vrh.pdf

Suppression of anthropogenic secondary organic aerosol formation by isoprene

Photocontrolled gel-sol reversible transition for tuning fluorescence emission of dyes

Photocontrolled Gel-Sol Reversible Transition for Tuning Fluorescence Emission of Dyes

In intelligent substations, the MMS Lite software package is widely used to realize station control layer network communication based on IEC61850. The protocol uses the BER coding of ASN.1, so there is more redundant information, which affects the transmission efficiency. Under the background of domestic independent control in the domestic power industry, there have been increasingly urgent demands for transforming and upgrading intelligent substations based on MMS protocol. This paper proposes a heterogeneous data fusion method for the secondary equipment of substation monitoring systems, which supports the simultaneous access and data interaction of the bay-level equipment of CMS protocol and MMS protocol. The thread synchronization mechanism is studied to avoid the avalanche data loss caused by transient failure, and improve the safety and reliability of data operation and maintenance, which further improves the support for the operation monitoring, remote access, and other services of the centralized control master station.

https://iopscience.iop.org/article/10.1088/1742-6596/2479/1/012035/pdf

Hai Yu

Papers

Study on coexistence and anti-interference solution for subway CBTC system and MiFi devices

Suppression of anthropogenic secondary organic aerosol formation by isoprene

Photocontrolled gel-sol reversible transition for tuning fluorescence emission of dyes

Photocontrolled Gel-Sol Reversible Transition for Tuning Fluorescence Emission of Dyes

Research on Heterogeneous Data Fusion Technology of Substation Secondary Equipment