'Spoofing' and how to ensure GPS security

As technological advances make GPS/GNSS devices more affordable, our lives are becoming increasingly dependent on precise positioning and timing. Industries such as survey, construction and logistics rely on precise positioning for automation, efficiency and safety.

GNSS time provides the pulsating heartbeat for the backbone of our industry by synchronising telecom networks, banks and the power grid. A single day of GNSS outage is estimated to cost $1 billion in the US alone. GNSS is a reliable system, and to keep it as such professional GNSS receivers need to be wary of all possible vulnerabilities that could be exploited. Using GNSS receivers which are robust against jamming and spoofing is key for secure PNT (positioning, navigation and time).

What is GPS/GNSS spoofing?

Radio interference can overpower weak GNSS signals, causing satellite signal loss and potentially loss of positioning. Spoofing is an intelligent form of interference that makes the receiver believe it is at a false location. During a spoofing attack a radio transmitter located nearby sends fake GPS signals into the target receiver. For example, a cheap SDR (software-defined radio) can make a smartphone believe it’s on Mount Everest!

Why GPS spoofing?

Imagine a combat situation. Clearly, the side that uses GPS/GNSS technology would have an advantage over the side that does not. But what if one side could manipulate GPS receivers of their adversary? This could mean taking over control of autonomous vehicles and robotic devices that rely on GPS positioning. For example, in October 2018, Russia accused the US of spoofing a drone and redirecting it to attack a Russian air base in Syria.

In the last three years over 600 incidents of spoofing have been recorded in the seas near the Russian border. These ships appeared to be ‘transported’ to nearby airports. This type of spoofing might have been introduced as a defence mechanism to ground spy drones. Most semi-professional drones on the market have a built-in geofencing mechanism that lands them automatically if they come close to airports or other restricted areas.

Some of the most enthusiastic spoofers are Pokémon GO fans who use cheap SDRs to spoof their GPS position and catch elusive Pokémon without having to leave their room.

Types of spoofing

Spoofers overpower relatively weak GNSS signals with radio signals carrying false positioning information. There are two ways of spoofing:

1. Rebroadcasting GNSS signals recorded at another place or time (so-called meaconing).
2. Generating and transmitting modified satellite signals.

Spoof-proof: how to protect your receiver against spoofing

In order to combat spoofing, GNSS receivers need to detect spoofed signals out of a mix of authentic and spoofed signals. Once a satellite signal is flagged as spoofed, it can be excluded from positioning calculation.

There are various levels of spoofing protection that a receiver can offer. Let’s compare it to a house intrusion detection system. You can have a simple entry alarm system or a more complex movement detection system. For added security you might install video image recognition, breaking-glass sound detection or a combination of the above.

Like a house with an open door, an unprotected GNSS receiver is vulnerable to even the simplest forms of spoofing. Secured receivers, on the other hand, can detect spoofing by looking for signal anomalies, or by using signals designed to prevent spoofing such as Galileo OS-NMA and E6 or the GPS military code.

Advanced interference mitigation technologies, such as the Septentrio AIM+, use signal-processing algorithms to flag spoofing by detecting various anomalies in the signal. For example, a spoofed signal is usually more powerful than an authentic GNSS signal.

AIM+ won’t even be fooled by an advanced GNSS signal generator: Spirent GSS9000. With realistic power levels and with actual navigation data within the signal, AIM+ can identify it as a ‘non-authentic’ signal.

Other advanced anti-spoofing techniques, such as using a dual-polarised antenna, are being researched today.

Satellite navigation data authentication

Various countries invest in spoofing resilience by building security directly into their GNSS satellites. With OS-NMA (Open Service Navigation Message Authentication), Galileo is the first satellite system to introduce an anti-spoofing service directly on a civil GNSS signal.

OS-NMA is a free service on the Galileo E1 frequency. It enables authentication of the navigation data on Galileo and even GPS satellites. Such navigation data carries information about satellite location and if altered will result in wrong receiver positioning computation. While currently in development, OS-NMA is planned to become publicly available in the near future. Also, GPS is experimenting with satellite based anti-spoofing for civil users with their recent Chimera authentication system.

Recently, within the scope of the FANTASTIC project led by GSA, OS-NMA anti-spoofing protection was implemented on a Septentrio receiver.

The strongest shield: signal-level GNSS authentication

The Galileo system will be offering Commercial Authentication Service (CAS) on the E6 signal with the highest level of security for safety-critical applications such as autonomous vehicles. The signal-level encryption will be based on similar techniques as the military GPS signals. Only the receivers who have the secret key are able to track such encrypted signals. The secret key is also needed to generate the signal, making it impossible to fake. CAS authentication techniques are currently being prototyped at Septentrio in collaboration with the European Space Agency.

Spoof-resilient GNSS means reliable precise positioning and timing, and peace of mind for everyone touched by this indispensable technology.

Top image credit: ©stock.adobe.com/au/denisismagilov

Please follow us and share on Twitter and Facebook. You can also subscribe for FREE to our weekly newsletter and bimonthly magazine.

Originally published here.