The Automatic Dependent Surveillance Broadcast (ADS-B) protocol can be used as a complement to Radar-based Air Traffic Control (ATC), or as a replacement in areas where the latter is impractical. However, ADS-B messages do not include any integrity or authenticity thus they can be easily tampered using inexpensive hardware and open source software. Modifying ADS-B message format is infeasible because it would render the already large implemented base obsolete. This paper proposes ADS-Bsec, which addresses the ADS-B limitations while being compatible with the installed base. ADS-Bsec provides the missing integrity and authenticity into ADS-B packets using a key management infrastructure without altering the existing packet format. This paper also argues for including the proposed framework as a component of the NextGen infrastructure based on our experience in prototyping efforts using cognitive radios, cryptography and multilateration together with existing radar-based ATC systems.