Figure 1  A cheap SDR (Software Defined Radio) can overpower GNSS signals and spoofs a single-frequency smartphone GPS into believing it is on Mount Everest.

 

Why GPS spoofing? 

Imagine a combat situation. Clearly, the side which uses GPS/GNSS technology would have an advantage over the side which does not. But what if one side could manipulate GPS receivers of their adversary? This could mean taking over control of autonomous vehicles and robotic devices which rely on GPS positioning. For example, in October 2018, Russia accused the US of spoofing a drone and redirecting it to attack a Russian air base in Syria(2).  

Figure 2 GNSS spoofing could be used to manipulate movement of aerial drones.

 

In the last 3 years over 600 incidents of spoofing have been recorded in the seas near the Russian border. These ships appeared to be “transported” to nearby airports (3). This type of spoofing might have been introduced as a defense mechanism to ground spy drones. Most semi-professional drones on the market have a built-in geo-fencing mechanism which lands them automatically if they come close to airports or other restricted areas (4).

Some of the most enthusiastic spoofers are Pokémon GO fans who use cheap SDRs (Software Defined Radios) to spoof their GPS position and catch elusive pokémon without having to leave their room.

 

Types of Spoofing

Spoofers overpower relatively weak GNSS signals with radio signals carrying false positioning information. There are two ways of spoofing:

1. 1. Rebroadcasting GNSS signals recorded at another place or time (so-called meaconing)
   2. Generating and transmitting modified satellite signals

 

Spoof-proof: how to protect your receiver against spoofing?

In order to combat spoofing, GNSS receivers need to detect spoofed signals out of a mix of authentic and spoofed signals. Once a satellite signal is flagged as spoofed, it can be excluded from positioning calculation.

There are various levels of spoofing protection that a receiver can offer. Let’s compare it to a house intrusion detection system. You can have a simple entry alarm system or a more complex movement detection system. For added security you might install video image recognition, breaking-glass sound detection or a combination of the above.

Like a house with an open door, an unprotected GNSS receiver is vulnerable to even the simplest forms of spoofing. Secured receivers, on the other hand, can detect spoofing by looking for signal anomalies, or by using signals designed to prevent spoofing such as Galileo OS-NMA and E6 or the GPS military code. 

Advanced interference mitigation technologies, such as the Septentrio AIM+, use signal-processing algorithms to flag spoofing by detecting various anomalies in the signal. For example, a spoofed signal is usually more powerful than an authentic GNSS signal.  

AIM+ won’t even be fooled by an advanced GNSS signal generator: Spirent GSS9000. With realistic power levels and with actual navigation data within the signal, AIM+ can identify it as a “non-authentic” signal.

Other advanced anti-spoofing techniques such as using a dual-polarized antenna are being researched today, read more about this method here.

 

Satellite navigation data authentication

Various countries invest in spoofing resilience by building security directly into their GNSS satellites. With OS-NMA (Open Service Navigation Message Authentication), Galileo is the first satellite system to introduce an anti-spoofing service directly on a civil GNSS signal.

OS-NMA is a free service on the Galileo E1 frequency. It enables authentication of the navigation data on Galileo and even GPS satellites. Such navigation data carries information about satellite location and if altered will result in wrong receiver positioning computation. While currently in development, OS-NMA is planned to become publicly available in the near future. Also GPS is experimenting with satellite based anti-spoofing for civil users with their recent Chimera authentication system.

Figure 3 European Galileo satellites provide an open authentication service on the E1 signal and a commercial authentication service on the E6 signal. Picture, courtesy of the European Space Agency.  

 

Recently, within the scope of the FANTASTIC project led by GSA, OS-NMA anti-spoofing protection was implemented on a Septentrio receiver.

 

The strongest shield: signal-level GNSS authentication

The Galileo system will be offering Commercial Authentication Service (CAS) on the E6 signal with the highest level of security for safety-critical applications such as autonomous vehicles. The signal level encryption will be based on similar techniques as the military GPS signals. Only the receivers who have the secret key are able to track such encrypted signals. The secret key is also needed to generate the signal making it impossible to fake. CAS authentication techniques are currently being prototyped at Septentrio in collaboration with the European Space Agency.

*Spoof-resilient GNSS means reliable precise positioning and timing, and a peace of mind for everyone touched by this indispensable technology.

 

Footnote:

[1] GNSS refers to the constellations of satellites broadcasting signals from space that transmit positioning and timing information to GNSS receivers on Earth. The receivers then use this information to determine their location. These systems include the American GPS, European Galileo, Russian GLONASS, Chinese BeiDou, Japanese QZSS (Michibiki) and the Indian NAVIC system. 

摘錄自：

https://www.septentrio.com/en/learn-more/insights/what-spoofing-and-how-ensure-gps-security