RIN Blog
Blog Home All Blogs

What is spoofing and how to ensure GPS security?

Posted By Administration, 03 October 2019

As technological advances make GPS/GNSS* devices more affordable, our lives are becoming increasingly dependent on precise positioning and timing. Industries such as survey, construction and logistics rely on precise positioning for automation, efficiency and safety. GNSS time provides the pulsating heartbeat for the backbone of our industry by synchronizing telecom networks, banks and the power grid. A single day of GNSS outage is estimated to cost 1 billion dollars in US alone (1). GNSS is a reliable system, and to keep it as such professional GNSS receivers need to be wary of all possible vulnerabilities which could be exploited. Using GNSS receivers which are robust against jamming and spoofing is key for secure PNT (Positioning, Navigation and Time).

*GNSS refers to the constellations of satellites broadcasting signals from space that transmit positioning and timing information to GNSS receivers on Earth. The receivers then use this information to determine their location. These systems include the American GPS, European Galileo, Russian GLONASS, Chinese BeiDou, Japanese QZSS (Michibiki) and the Indian NAVIC system. "


What is GPS/GNSS spoofing?

Radio interference can overpower weak GNSS signals, causing satellite signal loss and potentially loss of positioning. Spoofing, is an intelligent form of interference which makes the receiver believe it is at a false location. During a spoofing attack a radio transmitter located nearby sends fake GPS signals into the target receiver. For example, a cheap SDR (Software Defined Radio) can make a smartphone believe it’s on Mount Everest!

Figure 1: cheap SDR (Software Defined Radio) can overpower GNSS signals and spoofs a single-frequency smartphone GPS into believing it is on Mount Everest.

 

Why GPS spoofing?

Imagine a combat situation. Clearly, the side which uses GPS/GNSS technology would have an advantage over the side which does not. But what if one side could manipulate GPS receivers of their adversary? This could mean taking over control of autonomous vehicles and robotic devices which rely on GPS positioning. For example, in October 2018, Russia accused the US of spoofing a drone and redirecting it to attack a Russian air base in Syria(2).

Figure 2: GNSS spoofing could be used to manipulate movement of aerial drones.

In the last 3 years over 600 incidents of spoofing have been recorded in the seas near the Russian border. These ships appeared to be “transported” to nearby airports (3). This type of spoofing might have been introduced as a defense mechanism to ground spy drones. Most semi-professional drones on the market have a built-in geo-fencing mechanism which lands them automatically if they come close to airports or other restricted areas (4).

Some of the most enthusiastic spoofers are Pokémon GO fans who use cheap SDRs (Software Defined Radios) to spoof their GPS position and catch elusive pokémon without having to leave their room.


Types of Spoofing


Spoofers overpower relatively weak GNSS signals with radio signals carrying false positioning information. There are two ways of spoofing:

Rebroadcasting GNSS signals recorded at another place or time (so-called meaconing)
Generating and transmitting modified satellite signals


Spoof-proof: how to protect your receiver against spoofing?
In order to combat spoofing, GNSS receivers need to detect spoofed signals out of a mix of authentic and spoofed signals. Once a satellite signal is flagged as spoofed, it can be excluded from positioning calculation.

There are various levels of spoofing protection that a receiver can offer. Let’s compare it to a house intrusion detection system. You can have a simple entry alarm system or a more complex movement detection system. For added security you might install video image recognition, breaking-glass sound detection or a combination of the above.

Like a house with an open door, an unprotected GNSS receiver is vulnerable to even the simplest forms of spoofing. Secured receivers, on the other hand, can detect spoofing by looking for signal anomalies, or by using signals designed to prevent spoofing such as Galileo OS-NMA and E6 or the GPS military code.

Advanced interference mitigation technologies, such as the Septentrio AIM+, use signal-processing algorithms to flag spoofing by detecting various anomalies in the signal. For example, a spoofed signal is usually more powerful than an authentic GNSS signal.

AIM+ won’t even be fooled by an advanced GNSS signal generator: Spirent GSS9000. With realistic power levels and with actual navigation data within the signal, AIM+ can identify it as a “non-authentic” signal.

Other advanced anti-spoofing techniques such as using a dual-polarized antenna are being researched today, read more about this method here.


Satellite navigation data authentication


Various countries invest in spoofing resilience by building security directly into their GNSS satellites. With OS-NMA (Open Service Navigation Message Authentication), Galileo is the first satellite system to introduce an anti-spoofing service directly on a civil GNSS signal.

OS-NMA is a free service on the Galileo E1 frequency. It enables authentication of the navigation data on Galileo and even GPS satellites. Such navigation data carries information about satellite location and if altered will result in wrong receiver positioning computation. While currently in development, OS-NMA is planned to become publicly available in the near future. Also GPS is experimenting with satellite based anti-spoofing for civil users with their recent Chimera authentication system.

Figure 3: European Galileo satellites provide an open authentication service on the E1 signal and a commercial authentication service on the E6 signal. Picture, courtesy of the European Space Agency.

Recently, within the scope of the FANTASTIC project led by GSA, OS-NMA anti-spoofing protection was implemented on a Septentrio receiver.


The strongest shield: signal-level GNSS authentication


The Galileo system will be offering Commercial Authentication Service (CAS) on the E6 signal with the highest level of security for safety-critical applications such as autonomous vehicles. The signal level encryption will be based on similar techniques as the military GPS signals. Only the receivers who have the secret key are able to track such encrypted signals. The secret key is also needed to generate the signal making it impossible to fake. CAS authentication techniques are currently being prototyped at Septentrio in collaboration with the European Space Agency.

Spoof-resilient GNSS means reliable precise positioning and timing, and a peace of mind for everyone touched by this indispensable technology.



References:

1. arstechnica.com/science/2019/06/study-finds-that-a-gps-outage-would-cost-1-billion-per-day

2. rntfnd.org/2018/10/26/russia-claims-us-spoofed-drones-to-attack-base/

3. gps.gov/governance/advisory/meetings/2018-12/goward.pdf

4. gpsworld.com/spoofing-in-the-black-sea-what-really-happened/

5. Technical paper by Septentrio - Authentication by polarization: a powerful anti-spoofing method

6. insidegnss.com/new-report-details-gnss-spoofing-including-denial-of-service-attacks/

 

This blog is courtesy of Septentrio. See more at www.septentrio.com

Tags:  gnss  gps  resilience  spoofing 

Share |
PermalinkComments (0)
 

An iPad Nightmare

Posted By David Broughton, 28 August 2018

 

Fly/Sail is always the most-fun weekend of the year, and this year it was going to be at Solent Airport and the Hornet Services Sailing Club, Gosport. A handful of fliers and sailors gather at Saturday lunchtime, with the sailors being flown around the local area in the afternoon and then, after a very sociable evening, the sailors accommodating the fliers overnight and taking them for a sail the next morning. All head homewards with huge grins after Sunday lunch.

But, flying from Conington, Peterborough, meant that I had a good hour’s flight to Solent, having to pass by Luton and Heathrow airports amongst a handful of other restricted areas. The aircraft I was to hire was a beautiful-looking and modernised Piper PA-28, with drooping wingtips. I had previously looked carefully at its navigation fit: it had a couple of VOR receivers and an elderly GPS with no graphics.

 


So I bit the bullet and decided that, as an almost-octogenarian, I would treat myself to an iPad and navigation software. I needed one with GPS, so checked with the experts at the Mac store in Cambridge – yes, all new iPads have GPS they confirmed. I decided to buy it on offer from the largest department store in Cambridge, whose expert also confirmed that the iPad 6th Generation 32GB for £319 ‘has GPS’.

I had also had an offer of free SkyDemon for a month, so I took that up; it works well on the iPad but, sadly, not on my Mac desk- or lap-tops. So I put the track (Conington-Cranfield-Woodley NDB-Solent) directly into the iPad; it was incredibly easy to do and let me play with height to avoid airspace infringements. As well as a very usable chart, it produced an excellent flight-plan, complete with many useful frequencies, for viewing or printing.

 


By now I had been to AeroExpo and bought a smart knee-pad from Pooley’s to hold the iPad. So, to convince myself that all was working, I tried it in the car, with my wife driving of course. But as soon as I went into SkyDemon navigate mode, I received a warning that I could only undertake a 30-minute flight under the free trial. Wow, thank goodness I had given it a try – had I only read the instructions with the trial I would have known that. But the navigation in the car seemed to work well; the aircraft symbol tracked us around and aligned itself with heading. So I paid £12 for a month of trial that would allow SkyDemon to work as a useful navigator.

On the Saturday morning, with the aircraft full of fuel and overnight kit, we taxied out at Conington. My co-pilot was a lapsed PPL who, between take-off and landing, was happy to hold height and heading, allowing me to devote time to the iPad strapped to my knee. As soon as we headed south, I opened-up the iPad on my knee – to be greeted with the message ‘Current Location Not Available’. The beast obviously had no intention of navigating, so I threw it onto the back seat and scrambled for my chart and printed pilot-log. Thankfully, I had prepared a 250k chart with the track and timing marks and the flight continued as an unexpected and sweaty map-reading exercise. Thankfully, we made it to Solent with no infringements, thanks in part to a very helpful Farnborough Lower Airspace Radar Service (LARS).

It turns out that the iPad that I had bought, in spite of assurances from Mac and department store staff, has no GPS (or any other GNSS). I can only assume that it worked during my car trial by using the car’s Bluetooth and inbuilt navigation. I spoke to a handful of fliers at Solent, who confirmed what I had just discovered about my iPad; a couple showed me their small Bluetooth GNSS receivers which, at around £90, had resolved the problem for them completely by pairing with the iPad and allowing it to navigate.

So a lesson or two learnt: make sure that free software trials fully do what you need; don’t glibly believe what sales staff assure you about iPads; and, most importantly, ensure that you have a properly-prepared paper chart and hard-copy flight-plan at your fingertips... and brush-up by reading the Institute’s booklet on ‘Infringement Avoidance’.

Tags:  Aircraft  Fly/Sail  GPS  Navigation Software 

Share |
PermalinkComments (0)