NODUS FORTISHOW THE BOX BEHAVES
—

Aircraft work out where they are by listening to satellites. That signal is faint, unencrypted, and comes from 20,000 km away — and anyone with a few hundred dollars of radio gear, within a few kilometres, can broadcast a stronger fake one.

Why that is dangerous is the one mechanism worth holding on to: an autopilot holds its planned line by comparing its reported position against that line and steering to cancel the difference. A false report looks exactly like a real drift — so the correction it makes is real. The attacker never touches the aircraft. They move the report, and it flies itself to them. This is spoofing, and it has been used against shipping, aviation and drones.

Nodus Fortis is a small piece of hardware that sits in the cable between the satellite receiver and the autopilot. Everything the satellites say passes through it before the autopilot may use it. It is a gate on that one input — not a second pilot.

It carries its own motion sensors, which feel acceleration and turning directly. They never read the satellite broadcast, so faking that broadcast cannot change what they report — which is what earns them the right to judge it. A real change of place would have been felt. If it was not felt, it did not happen.

Six scenarios, about 20 seconds each. Press Play and watch one trip from A to C. Some have been shown working in simulation; one is a limit of physics no design can beat; one is what we are building toward and have not yet proved. Each says at the top which it is.

EVIDENCE SHOWN — ESTABLISHED PHYSICS · RECORDED ATTACK DATA · TESTED AGAINST REAL FLIGHT SOFTWARE, IN SIMULATION  ·  NEXT: CURRENT PROCESSOR AND PHYSICAL VALIDATION

INDEX — WHAT THE WORDS MEAN

Nodus Fortis
The name of this project. A small piece of hardware that fits in the cable between an aircraft's satellite receiver and its autopilot computer, to check that the satellite signal is telling the truth. It is not yet a finished product.
Spoofing
Broadcasting a fake satellite signal, stronger than the real one, so an aircraft believes it is somewhere it is not. Different from jamming, which simply blocks the signal — jamming is obvious, spoofing is quiet, and the aircraft carries on confidently while being wrong.
GPS / GNSS
GPS is the American satellite navigation system. GNSS is the general term covering GPS and its equivalents. This page uses them interchangeably; the problem is the same for all of them.
Autopilot / flight controller
The small computer on the aircraft that decides how to fly — it takes the position it is given and works out what the motors should do. It is not the thing under attack; it is the thing being lied to.
The box
This device. It sits in the wire, so everything from the satellite receiver passes through it before reaching the autopilot. It can let that information through, or stop it.
Motion sensors
Instruments that feel acceleration and turning directly — the same kind that rotate a phone's screen. They owe nothing to satellites, which is what makes them useful as a second opinion.
Witness
Any check that does not come through the satellite signal. Each one can only answer what it is physically able to observe: a motion sensor can say how far you moved, but not where you started.
The attacker
Someone with radio equipment costing a few hundred dollars, within a few kilometres of the aircraft. They never touch it and are usually never identified.
The operator
Whoever is responsible for flying the aircraft — a pilot on the ground, or a company running it remotely. They decide in advance what should happen if navigation becomes untrustworthy.
Source rejected / GNSS input blocked
The satellite information is no longer allowed to steer the aircraft. The box decides this. It does not decide what the aircraft does next — that is the operator's preset choice.
Position cannot be confirmed
Nothing has proved the position wrong, but nothing available can prove it right either. Reported as its own answer, instead of guessing.
Simulation
The aircraft and the world are modelled in software, but the autopilot software is the real thing, running as it would on the aircraft. It is a serious test. It is not a flight, and this page never calls it one.
FPGA
A chip that can be re-wired by software into whatever circuit you design. The first version of this design was built for one. It passed the chip maker's design and timing checks — but the chip was never physically made.
B2
The label on the map for how close the aircraft gets to its destination after an attack. It is a target being worked toward, not a measured result.